EDR vs XDR vs MDR - what's the difference?

These three acronyms appear constantly in security vendor marketing - sometimes interchangeably, sometimes in the same sentence to mean “we added a feature”. Here’s a clear breakdown of what each actually means and how to decide which approach fits your team.

What EDR actually is

Endpoint Detection and Response (EDR) is software that runs a lightweight agent on each endpoint - workstations, servers, containers - and continuously collects telemetry: process events, file operations, network connections, registry changes, and more. It detects threats behaviourally - watching what a process does rather than checking it against a hash list - and gives analysts the tools to respond: isolate a host, kill a process, collect a memory dump.

You operate it yourself. Your analysts receive alerts, investigate, and decide how to respond.

Modern EDR platforms map detections to MITRE ATT&CK, giving each alert a tactic and technique reference. When a rule fires on T1055 (Process Injection) on a Linux host, you have the surrounding telemetry - parent process, child spawns, file writes, outbound connections - to understand what happened before and after.

Key vendors: CrowdStrike Falcon, SentinelOne Singularity, Microsoft Defender for Endpoint, Elastic Security, LightEDR.

What XDR adds

Extended Detection and Response (XDR) expands the data sources beyond endpoints. A true XDR platform ingests telemetry from email security gateways, network sensors, cloud workloads, and identity providers - not just endpoints - and correlates signals across all of them into unified incidents.

The promised value: a phishing email arrives → user clicks → credential theft on the endpoint → lateral movement to a server → data exfiltration via a cloud API. An EDR sees the endpoint portion of this chain. An XDR sees all of it, stitched together into a single incident.

There are two XDR models:

• Native XDR - the vendor supplies all the sensors. CrowdStrike XDR, Microsoft Defender XDR, Palo Alto Cortex XDR. Correlation quality is excellent, but you’re buying the whole ecosystem from one vendor.
• Open XDR - the platform ingests from third-party tools. Easier to fit into an existing stack, but correlation quality depends heavily on the depth of each integration.

XDR is genuinely powerful for large environments with multiple security layers to stitch together. For a 200-seat company with one EDR deployment and a managed firewall, it often adds complexity without proportional value.

What MDR is (and what it isn’t)

Managed Detection and Response (MDR) is a service, not a product category. An MDR provider operates the detection tooling for you - typically EDR or XDR - and supplies the analyst layer on top. You get alert triage, investigation summaries, and often active response: the MDR team isolates hosts, contacts you about confirmed incidents, and updates firewall rules on your behalf.

MDR makes sense when you don’t want to operate security tooling in-house, or when you don’t have the analyst hours to work through the alert queue. The trade-off is cost - MDR typically runs 3-5x the price of the underlying software - and control. You’re delegating incident response decisions to a third party. For compliance-heavy environments that need 24/7 coverage without staffing a shift rota, that trade-off is often worth it.

Some vendors blur the line deliberately. “CrowdStrike Falcon Complete” is MDR. “CrowdStrike Falcon Go” is EDR-as-SaaS. The distinction matters significantly when comparing quotes.

A practical comparison

	EDR	XDR	MDR
What it covers	Endpoints only	Endpoints + network, email, cloud, identity	Depends on the provider’s tooling
Who operates it	Your team	Your team	The MDR vendor
Cross-source correlation	No	Yes	Varies
Relative cost	Low - mid	Mid - high	Highest
Best fit	Teams wanting visibility and control	Larger orgs with multiple security products	Teams outsourcing operations

The honest conclusion

Vendors love relabelling their EDR as XDR because it’s a stronger marketing term. If a vendor claims XDR but only deploys an endpoint agent, ask: what non-endpoint data sources does it actually ingest and correlate in real time? If the answer is vague, it’s EDR with a new label.

For most lean SOC teams and MSSPs, a well-configured EDR with strong behavioural detection, 90-day telemetry, and solid multi-tenant tooling delivers more operational value than an over-engineered XDR stack you don’t have the data sources to feed. The right starting point is endpoint visibility - once you have that data and the processes to act on it, the decision to extend into XDR territory or contract an MDR provider becomes much clearer.

If you’re evaluating EDR platforms for a lean SOC or managed service practice, get in touch - we’re happy to walk through what LightEDR covers and where the edges are.