Antivirus vs. EDR: What Gulf Coast SMBs Actually Need

A Panama City marketing agency called us after their accountant opened an attachment from "QuickBooks." It installed ransomware. Every file on the network — client projects, financial records, email archives — was encrypted and held for ransom.

Their antivirus (built into Windows Defender) didn't catch it. The attachment was a new variant, not in any signature database yet.

Could EDR have caught it? Maybe. EDR looks for suspicious behavior — a spreadsheet suddenly spawning scripts, encrypting thousands of files in minutes — rather than just matching known malware signatures.

But EDR costs more and requires more management. For this marketing agency, basic antivirus with good backups would have been fine. They didn't need EDR. They needed faster detection and better backup restoration.

This article explains the difference so you can make the right call for your business.

What this solves (in real business terms)

Antivirus (AV): Scans files and programs for known malicious patterns (signatures). If it sees something that matches a database of known malware, it blocks it.

Endpoint Detection and Response (EDR): Monitors behavior on the device. Instead of asking "is this file bad?", it asks "is this behavior suspicious?" A new program that opens your tax software, reads your files, and starts encrypting them — EDR catches that even if the program itself is unknown.

Next-Generation Antivirus (NGAV): Combines signature-based detection with behavioral analysis and machine learning. Windows Defender (built into Windows 10/11) is actually NGAV, not basic AV. Don't pay for old-style antivirus on modern Windows.

What can go wrong

Relying on outdated antivirus. Old antivirus products that aren't updated won't catch new threats. If your team is running Norton 2015 on Windows 7, you're basically unprotected.

Thinking antivirus equals security. Antivirus catches malware. It doesn't catch phishing, credential theft, insider threats, or sophisticated attackers who move slowly. "We have antivirus" is not a security strategy.

EDR alert fatigue. EDR products generate alerts. Without someone reviewing them, you get a blinking dashboard and a false sense of security. EDR without monitoring is expensive noise.

Ransomware while backups are connected. Ransomware encrypts everything it can reach, including mapped network drives and external hard drives. If your backup is always connected, ransomware encrypts it too.

Not testing restores. You have backups. Ransomware hits. You try to restore. The backup is corrupted, incomplete, or the restoration process takes three days instead of three hours. Backups that aren't tested are not backups.

What it costs (honest ranges)

• Windows Defender (built-in): Free — enabled by default on Windows 10/11. This is genuinely good antivirus.
• Third-party antivirus: $30-$80/device/year — only needed if you're on Windows Home (no Defender) or have specific compliance requirements.
• EDR solutions (SentinelOne, CrowdStrike, Microsoft Defender for Business): $5-$15/device/month for SMB-focused products. Enterprise products run $20+/device/month.
• Managed detection and response (MDR): $15-$40/user/month — EDR + 24/7 monitoring by a security team. Most Gulf Coast MSPs offer this.
• Ransomware-specific backup: $100-$500/month for business-grade backup with immutable copies (can't be encrypted by ransomware).

Vendor questions (copy/paste)

1. "Are we using Windows Defender, or do you recommend a different antivirus product?"
2. "Do you monitor antivirus alerts, or does that just go to us?"
3. "Do you provide EDR? If so, what's monitored and who responds to alerts?"
4. "How are backups configured? Are they isolated from the network so ransomware can't encrypt them?"
5. "When was the last time we tested a restore from backup? What was the result?"
6. "What's your ransomware response procedure? How quickly can we be back online?"

Minimum viable implementation

Option A: Basic protection (for low-risk businesses)

If you're a 5-15 person company with straightforward operations (no sensitive data, no regulatory requirements):

1. Verify Windows Defender is on. Settings > Update & Security > Windows Security > Virus & threat protection. Make sure real-time protection is enabled.

2. Keep Windows updated. Settings > Update & Security > Windows Update. Enable automatic updates.

3. Use a business-grade backup. Carbonite, Backblaze Business, or Acronis. Set it to back up continuously, not just daily. Verify one restore per quarter.

4. Train your team on phishing. Antivirus won't stop a convincing email that tricks someone into wiring money or sharing credentials.

Option B: Enhanced protection (for higher-risk businesses)

If you handle sensitive data (customer SSNs, financial records, healthcare info), have more than 15 employees, or are in a targeted industry:

1. Deploy EDR across all devices. Microsoft Defender for Business ($5-$8/device/month) or SentinelOne Singularity ($8-$12/device/month).

2. Enable managed detection. Either use your MSP's MDR service or sign up directly with a vendor (SentinelOne, CrowdStrike, Sophos).

3. Configure alert rules. Not every alert needs immediate attention, but critical behaviors should page someone 24/7:

   • Ransomware behavior (mass file encryption)
   • New admin accounts created
   • Remote access tools installed

4. Isolate backups. Use backup solutions with immutable copies — a feature that prevents even admins from deleting or encrypting backup data. This includes Cloud backup with version locking, air-gapped backups, or backup to a separate cloud account you control.

5. Test restores quarterly. Pick one file or folder. Restore it. Verify it works. Document the result.

When to hire help

Do it yourself if:

• You're comfortable with Windows Defender and want minimal cost
• Your data isn't highly sensitive
• You can dedicate 30 minutes/month to verify updates and check backup status

Get help if:

• You're in healthcare, finance, or government contracting (compliance requirements)
• You have 20+ employees with diverse device types (Windows, Mac, mobile)
• You want someone watching alerts 24/7
• You've had an incident or near-miss and need confidence your defenses will catch the next one
• Your team can't reliably update devices or test backups