Explainer · checked 2026-11-08

MDR vs EDR vs XDR

Two of these are software. One is people. Most buyers end up with an EDR or XDR product and an MDR service on top of it.

In brief

EDR watches endpoints; XDR adds identity, email, cloud and network data to the same detection; both are software your team has to run. MDR is a service whose analysts run that software for you around the clock and respond. Of 27 MDR providers on this board, 16 say they can run on an EDR you already own; 11 bring their own.

Three different things

EDR, XDR and MDR compared
	EDR	XDR	MDR
What it is	Software on each endpoint that records activity, detects threats and can isolate a device	A platform that joins endpoint data with identity, email, cloud and network data for detection and response	A service: a provider’s analysts watch your tools around the clock, investigate alerts and respond for you
What you buy	A licence, usually per endpoint	A licence, per endpoint or user, sometimes with data volume	A subscription to a service, priced per endpoint, user or asset, or as an annual contract
Who watches the alerts	Your team	Your team	The provider’s analysts (with yours, if you have them)
Who acts at 3 a.m.	Your team, or automated rules you set	Your team, or automated playbooks you set	The provider, within the actions you agree in the contract
What it needs from you	People who can triage alerts 24/7	People, plus the integrations that feed it	Admin access for the provider, an agreed list of response actions, and someone to call

Endpoint detection and response (EDR). “EDR combines real-time continuous monitoring and collection of endpoint data (for example, networked computing devices such as workstations, mobile phones, servers) with rules-based automated response and analysis capabilities.” — The White House Office of Management and Budget (memo M-22-01)

Extended detection and response (XDR). “Extended detection and response (XDR) is a software as a service (SaaS) tool that combines security products and data into simplified solutions.” — Microsoft, a vendor that sells XDR and MDR

Managed detection and response (MDR). “Managed detection and response (MDR) is a cybersecurity service that helps proactively protect organizations from cyberthreats using advanced detection and rapid incident response.” — Microsoft, a vendor that sells MDR

Managed EDR, managed XDR, MXDR

Providers sell the same idea under different names. The name tells you what the provider watches, not how well.

Managed EDR (also sold as “managed endpoint detection and response”) is MDR that watches endpoints only. Managed XDR and MXDR promise the wider view: identity, email, cloud and network alerts as well. Microsoft, which sells it, puts it this way: “Like MDR, MXDR is a managed service that combines tech solutions with human expertise. However, with MXDR, the provider uses XDR security solutions to extend protection across a wider variety of IT environments.” (Microsoft).

What matters is which sources the provider actually ingests and acts on. Each entry on the provider board lists the other telemetry the provider says it monitors.

What the providers on this board call their service
Managed XDR or MXDR	BlueVoyant, Ontinue, Trustwave (LevelBlue), Todyl
Managed EDR	Huntress, Binary Defense, Blackpoint Cyber, Deepwatch
MDR	23 of 27

What MDR adds: people, and someone who acts

The point of MDR over EDR alone is the response. This is what the providers on this board say about it.

27of 27 state 24/7 monitoring by human analysts

26say they contain threats for you (isolate hosts, disable accounts)

6say full remediation is included

19state a response or escalation time

Speed is the case for paying someone to watch at night. In the incidents Mandiant investigated in 2025, attackers went unnoticed for a median of 14 days: “Global median dwell time rose to 14 days from 11 days.” (M-Trends 2026).

Containment and remediation are different promises. Containment stops the spread: the provider isolates the laptop or locks the account. Remediation cleans up: removing persistence, restoring systems. Ask for the list of actions the provider may take without calling you, and the price of incident response if it is not included.

Which EDRs the MDR providers run on

A filled dot means the provider names that EDR as one its service runs on; a hollow dot, that it works with that EDR only in a limited way (taking its data without responding through it, or running alongside it); a square, the provider's own EDR. Columns are the EDRs at least two providers name. Checked November 8, 2026.

EDRs each MDR provider says it works with
Provider	Microsoft Defender	CrowdStrike Falcon	SentinelOne	Palo Alto Cortex	Carbon Black	Sophos	Trend Micro	Cisco Secure Endpoint	Bitdefender	Trellix	Symantec	Tanium	Fortinet	Arctic Wolf Aurora (Cylance)	Malwarebytes	ESET	Third-party
Field EffectOwn: Field Effect MDR	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	—
HuntressOwn: Huntress	limited	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	—
Rapid7Own: Rapid7 Insight Agent	yes	yes	yes	yes	no	yes	no	no	no	no	no	no	no	no	no	no	5
Arctic Wolf	yes	yes	yes	yes	yes	yes	yes	yes	no	no	yes	yes	yes	own	yes	yes	13
Binary DefenseOwn: BDVision	yes	yes	yes	yes	yes	no	no	no	no	no	no	no	no	no	no	no	5
Bitdefender	no	no	no	no	no	no	no	no	own	no	no	no	no	no	no	no	—
eSentireOwn: Atlas Endpoint Agent / eSentire MDR Agent	yes	yes	yes	yes	yes	limited	limited	no	limited	limited	limited	limited	no	limited	limited	limited	5
Expel	yes	yes	yes	yes	yes	no	yes	yes	no	yes	yes	yes	no	yes	no	no	13
Red Canary (Zscaler)Own: Zscaler MDR Linux EDR	yes	yes	yes	yes	yes	no	yes	no	no	no	no	no	no	no	no	no	7
Sophos	yes	yes	yes	yes	yes	own	yes	yes	no	yes	yes	no	no	yes	no	no	10
Adlumin (N-able)Own: Adlumin Endpoint Agent	no	yes	yes	yes	yes	yes	yes	yes	yes	no	no	no	no	yes	no	yes	10
Blackpoint CyberOwn: SNAP Agent	yes	yes	yes	no	no	yes	no	no	yes	no	no	no	no	yes	yes	no	8
BlueVoyant	yes	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	4
Critical Start	yes	yes	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	4
CrowdStrike	no	own	no	no	no	no	no	no	no	no	no	no	no	no	no	no	—
Deepwatch	yes	yes	yes	yes	yes	no	no	no	no	no	no	no	no	no	no	no	5
Fortinet	no	no	no	no	no	no	no	no	no	no	no	no	own	no	no	no	—
Ontinue	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	1
Palo Alto Networks Unit 42	no	no	no	own	no	no	no	no	no	no	no	no	no	no	no	no	—
Secureworks (Sophos Taegis)	yes	yes	yes	no	yes	own	no	no	no	no	no	no	no	no	no	no	4
SentinelOne	no	no	own	no	no	no	no	no	no	no	no	no	no	no	no	no	—
Trustwave (LevelBlue)	yes	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	3
Kroll	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	1
Mandiant (Google Cloud)	yes	yes	yes	no	no	no	no	no	no	yes	no	no	no	no	no	no	4
Trend Micro	no	no	no	no	no	no	own	no	no	no	no	no	no	no	no	no	—
Microsoft	own	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	—
TodylOwn: Todyl Endpoint Security	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	—

From each provider’s own integrations or product pages, linked from its entry. An empty row means the provider doesn’t name the EDRs it supports on its public pages, not that it supports none. Most named: Microsoft Defender (17), CrowdStrike Falcon (16), SentinelOne (16).

Already own an EDR?

Tell us which one, and how many endpoints. We reply by email with the providers on this board that run on it, and what each publishes.

We only pass your details to a provider if you ask us to.

Get a shortlist

Questions

What is the difference between MDR and EDR?

EDR is software: an agent on each laptop and server that records what happens and can block or isolate. MDR is a service: a provider’s analysts watch the EDR (theirs or yours) around the clock, investigate what it flags and respond. You can buy EDR without MDR, if you have people to watch it.

What is the difference between MDR and XDR?

XDR is a product that pulls endpoint, identity, email, cloud and network data into one place for detection and response. MDR is a service. Many MDR providers run on an XDR platform, their own or yours, and some call the result “managed XDR” or MXDR.

What is managed EDR?

Managed EDR is MDR focused on endpoints: a provider runs and watches your EDR for you. Huntress, Binary Defense, Blackpoint Cyber, Deepwatch use the name for their service. Ask whether identity, cloud and email alerts are covered too, or only endpoints.

Do I need EDR if I buy MDR?

Yes: MDR needs something to watch. 11 providers on this board bring their own EDR agent; 16 say they can run on one you already own, most often Microsoft Defender, CrowdStrike Falcon, SentinelOne.

Is XDR better than EDR?

It sees more: identity sign-ins, email, cloud and network as well as endpoints, so it can join up an attack that crosses them. It also needs more set-up and, usually, more licences. Whether it is worth it depends on who will watch it.

06 · sources

Sources for this page

The White House Office of Management and Budget (memo M-22-01): Endpoint detection and response (EDR) — The definition of EDR quoted above.
Microsoft, a vendor that sells XDR and MDR: Extended detection and response (XDR) — The definition of XDR quoted above.
Microsoft, a vendor that sells MDR: Managed detection and response (MDR) — The definition of MDR quoted above.
Microsoft, a vendor that sells it: Managed extended detection and response (MXDR) — The definition of MXDR quoted above.
Google Cloud / Mandiant: M-Trends 2026 — Median time attackers went undetected in incidents Mandiant investigated in 2025.
Each provider’s own integrations and product pages — The EDR matrix and the response counts.

Each provider’s own sources are linked from its entry on the provider board. How providers are chosen and ordered, and how to correct an entry: methodology.

Cite this page

MDR Companies. “MDR vs EDR vs XDR: software, platform, or a service.” Updated November 8, 2026. https://mdrcompanies.com/mdr-vs-edr-vs-xdr/