Most small businesses have antivirus. It came with the laptop, or the IT person installed it years ago, and it shows a green check mark. It is better than nothing. It is also not what stops the attacks that actually hurt businesses today. Here is why, what the replacement looks like, and how to check what you have.

What antivirus does

Antivirus checks files against a list of known bad ones. A file matches, it gets blocked. That works for the viruses of ten years ago. It does not work for an attack that arrives as a normal-looking document, opens a script, and uses the tools already built into Windows to encrypt your files. Nothing on that path is on the list.

Security agencies call this living off the land. A joint guide published in February 2024 by CISA, the NSA, the FBI and other US and allied agencies describes attackers abusing tools already installed and trusted on a computer, on Windows, macOS and Linux alike, so that their activity blends in with normal system behavior. It names PowerShell and cmd.exe among the Windows tools involved.

Those tools are exactly what a list cannot handle. Because IT administrators use them legitimately, they carry trusted attributes such as digital signatures, and the guide notes that attackers can easily change file names, command-line arguments or file contents to get past detections that look for known indicators. CISA's StopRansomware Guide adds that threat actors use PowerShell to deploy ransomware and hide their malicious activity.

What EDR does instead

Endpoint detection and response watches behavior. A script launched from an email attachment that starts encrypting files in Documents. A program that tries to read passwords out of memory. A sign-in from a place nobody at the company has ever been. Those are caught by what they do, not by what they are called, including attacks nobody has seen before.

A small program, called a sensor or agent, runs on each computer and records what happens on it. Microsoft's documentation for Defender for Endpoint lists what that record covers: running processes, network activity, user sign-ins, registry and file changes, and deeper detail from the kernel and memory. When a threat is detected, an alert is created for an analyst to investigate.

Two features set this apart from antivirus. Microsoft combines alerts that share attack techniques or an attacker into a single incident, so one bad attachment reads as one story rather than a pile of warnings. And the record looks backward: in Defender for Endpoint Plan 2 it is kept for six months, so an analyst can trace an attack to where it started.

In practice, the living off the land guide tells defenders to watch for Office applications such as Word or Excel launching cmd.exe, PowerShell, wscript.exe or cscript.exe, because it is uncommon for those applications to start scripting tools. A file scanner sees a Word document and a copy of PowerShell, both harmless on their own. A behavior sensor sees Word starting PowerShell, PowerShell downloading a program, and that program rewriting file after file in Documents.

Then it acts. A device that trips a serious alert is cut off from the network automatically, usually within a second, so one laptop does not become the whole office. And it tells someone.

That matches the first steps of the ransomware response checklist in CISA's StopRansomware Guide: determine which systems were impacted and immediately isolate them, and power devices down if you are unable to disconnect them. EDR can make the isolation step automatic.

What isolation looks like at the desk

Isolation is more precise than pulling a cable. In Microsoft's version, an isolated computer is cut off from the network but stays connected to the Defender service, which keeps monitoring it, so an engineer can investigate while the machine cannot reach the file server or the rest of the office. On Windows, the user sees a notification that the device is being isolated, and selective isolation can leave Outlook and Microsoft Teams working so the engineer and the user can still talk. Once a device is isolated, the button on its device page changes to Release from isolation, which reconnects it when the work is done.

Servers need a decision in advance. Microsoft notes that isolating a server running Hyper-V blocks network traffic to all of its virtual machines, which in a small office can mean everything at once, and it lets administrators exclude business-critical devices from automatic isolation. Agree ahead of time which machines may be isolated automatically and which need a person to decide.

Isolation is one of several responses. Depending on the product and license, an engineer can also quarantine a file, block it on every device in the organization, collect an investigation package that captures the machine's current state, or open a remote session on it. In Microsoft's lineup the full set needs Defender for Endpoint Plan 2, while Defender for Business has a shorter list of manual actions plus automated investigation and remediation.

Managed means a person reads the alert

An EDR tool on its own is a dashboard. A dashboard nobody opens is as good as no tool at all. Managed EDR means every alert goes to an engineer who works out whether it is real, what it touched and how it got in, then tells you what happened in plain language.

For a serious alert, the work looks like this:

  • Confirm it is real. Legitimate software trips alerts too, and Microsoft notes that some line-of-business apps start a command prompt or PowerShell for ordinary reasons.
  • Contain it. Isolate the device if automation has not, and stop anything still running.
  • Scope it. Check what it touched, whether the same file or email reached other machines, and whether the account was used anywhere else.
  • Clean it. Remove the files and anything set to run again later, and reset passwords and sessions if credentials may have been exposed.
  • Recover. Restore changed files from backup, then release the device.
  • Write it up. Record what happened, what was done and what changes as a result.

That last part matters more than it sounds. "An alert fired" is noise. "A phishing attachment ran a script on the front desk laptop at 2:14, the device was isolated one second later, nothing spread, three files were restored from backup, the mailbox rule it created was removed, and the device is back online" is an answer you can act on and give to your insurer.

The clock that matters is not when the alert fires but when someone who can act reads it. An alert at 2 a.m. on a Saturday that waits until Monday gives an attacker the weekend, so ask any provider who reads alerts overnight and on holidays, and what they may do without reaching you.

A worked example

Imagine a ten-person accounting office in tax season. Late on a Thursday afternoon, a bookkeeper opens an email that appears to come from a client, with a ZIP file named like a tax form. Inside is what looks like a PDF but is actually a JavaScript file, and Microsoft's documentation notes that malware written in JavaScript or VBScript often acts as a downloader, fetching other malware from the internet.

With antivirus only, the bookkeeper double-clicks and the script downloads a program and runs it. The script is new and the tools it leans on are part of Windows, so the list has nothing to match. The program tries to pull passwords out of memory, then encrypts the bookkeeper's Documents folder and the shared client folder on the file server. The office finds out the next morning, and nobody can say how it got in, whether passwords were taken or whether other machines are affected.

With managed EDR, the same email arrives. Two of Microsoft's attack surface reduction rules are aimed at exactly this: one blocks scripts and ZIP files that arrive by email, and another blocks JavaScript or VBScript from launching programs they download. Suppose neither is turned on. The sensor records the chain from the email to the script to PowerShell reaching out to the internet, and when the downloaded program reaches for passwords in memory, the laptop is cut off from the network automatically and an engineer is paged.

The engineer reviews the incident timeline, confirms it is malicious, and checks whether anyone else received or opened the same message. Because the program went after credentials, the bookkeeper's password is reset and their sessions are signed out. The engineer removes the downloaded files and anything set to run at startup, restores the files that changed, and releases the laptop. That evening, the office manager gets a written account of what arrived, what ran, what was stopped, what was restored and what to tell the insurer.

Nothing about the attack changed between the two versions. In the second one it was loud, it stayed on one laptop, and it reached a person who turned the noise into an answer.

Why it matters now

Cyber insurers increasingly ask whether you have EDR before they write a policy, and ransomware crews target small businesses precisely because the defenses are usually a free antivirus and a hope. The attacks are automated. The response has to be too, with a person behind it.

Government guidance points the same way. CISA's StopRansomware Guide recommends application allowlisting, EDR or both on all assets, alongside a centrally managed antivirus solution. Antivirus stays, as one layer rather than the whole plan.

What a good EDR setup includes

  • Every managed computer, Windows and Mac. Not just the server, not just the office machines. The laptop at home is the one that gets the attachment.
  • Automatic isolation for serious alerts, with a person deciding when the device comes back.
  • Patching and hardening alongside it, with operating system and application updates on a schedule and the risky settings closed. Macros, old protocols, local admin rights.
  • Tamper protection turned on, so the agent and its settings cannot simply be switched off.
  • Exclusions kept narrow, each one written down with a full path and a reason.
  • A locked-down console, with two-step sign-in and as few administrators as possible.
  • A recovery path. If something does get through, the backups and the plan already exist. Restore, clean, write up what changed.
  • A plain-English record of every incident, and the evidence an insurer or auditor asks for.

The Mac line is not a formality. The living off the land guide observes that IT and security teams tend to pay less attention to macOS where there are fewer Macs, including when budgeting for measures like EDR.

The console line matters too. The same guide lists EDR among the tools attackers abuse for their remote-shell capabilities, and CISA's StopRansomware Guide calls for phishing-resistant multifactor authentication for all services, particularly accounts that access critical systems. An administrator account on a console that can run commands on every computer is one of those.

The hardening line has specifics as well. The StopRansomware Guide says to disable macro scripts in Microsoft Office files sent by email, control and limit local administration, and keep administrator accounts separate from everyday user accounts.

If you already pay for Microsoft 365

If your business has Microsoft 365 Business Premium, you are already paying for an EDR product. Microsoft Defender for Business is built on Defender for Endpoint, designed for organizations with up to 300 users and included in Business Premium, and organizations on plans such as Business Basic or Business Standard can buy it on its own. It covers Windows and has apps for Mac, iOS and Android, while servers need extra licenses.

Check the plan name, not just the brand. In Microsoft's comparison table, Defender for Business and Defender for Endpoint Plan 2 include endpoint detection and response, and Defender for Endpoint Plan 1 does not. Defender for Business also includes a monthly security summary report and automatic attack disruption, which Microsoft describes as automatically containing attacks in progress, such as ransomware, by disabling compromised user accounts and isolating affected devices.

A license protects nothing until every device is onboarded and someone reads what it reports. If you use Microsoft's tools, ask about these settings by name:

  • Tamper protection, which keeps real-time protection, behavior monitoring and cloud protection on and stops exclusions from being added or changed. Microsoft's management screens now call the setting controlled configuration. On Macs it starts in Audit mode, which logs attempts to remove the agent without blocking them, so ask whether it is set to Block.
  • Block all Office applications from creating child processes, which stops Word, Excel, PowerPoint, OneNote and Access from starting other programs.
  • Block executable content from email client and webmail, which blocks executable files, scripts and archive files such as ZIP files that arrive in email opened in Outlook, Outlook.com or other popular webmail.
  • Block JavaScript or VBScript from launching downloaded executable content, which stops scripts from launching programs they have downloaded.
  • Block credential stealing from the Windows local security authority subsystem, which protects LSASS, the part of Windows that handles sign-ins, against tools that scrape passwords from memory, unless LSA protection already does the same job.
  • Use advanced protection against ransomware, which uses checks on the device and in the cloud to block files that resemble ransomware, and needs cloud-delivered protection turned on.

These rules are a feature of Microsoft Defender Antivirus, and Defender for Endpoint adds central management, reporting and alerts. Rules can run in Audit mode before they block anything, which matters because some business software legitimately does what they block. The credential rule works differently: Microsoft says it produces a large volume of audit events that are almost all safe to ignore, so you can skip the audit stage, and it recommends starting with a small set of devices and expanding gradually. Microsoft groups that rule with Block abuse of exploited vulnerable signed drivers and Block persistence through WMI event subscription as its standard protection rules.

Common mistakes and how to spot them

These problems are easy to check and easy to miss:

  • Devices missing from the console. Check the owner's laptop, any Macs, the old PC that runs one piece of software, and anything bought since the last rollout, then compare the console's device count with your own list.
  • Devices that stopped reporting. A laptop whose agent went quiet weeks ago looks the same on the desk as a protected one, so ask for every device's last-seen date.
  • Exclusions that are too broad. Microsoft's list of exclusions to avoid includes program folders for installed apps, the C:\Users folder, temporary folders, and processes such as powershell.exe, cmd.exe, outlook.exe and winword.exe. Process exclusions also stop attack surface reduction rules from applying to those processes.
  • Blanket exceptions for admin tools. The living off the land guide says CISA's red teams encounter overly broad exceptions for PsExec, a tool that runs commands on other computers remotely, because administrators use it regularly. It also notes that administrators worried about EDR blocking their tools sometimes request standard configurations that allow built-in tools.
  • Tamper protection off on Windows, or left in Audit mode on Macs.
  • Alerts that go to an inbox. If the alert email lands in a mailbox nobody checks at night, the tool is a dashboard again.
  • Everyone is a local administrator. Ask how many people can install software on their own machines, and why.

How to test that it works

You do not need to be technical to check most of this. Ask whoever runs your EDR to walk through these with you now, and again after any big change:

  • Coverage. The console's device count matches your list, including laptops that live at home and every Mac, and every device has reported in recently.
  • Exclusions. Every entry on the exclusion list names a full path and a reason, in line with Microsoft's advice to use fully qualified paths so only the intended file is excluded.
  • Tamper protection. It is on for every Windows device and, where Microsoft's agent runs on Macs, set to Block.
  • A test alert. Ask for a harmless test alert on one machine during working hours, then note how long it takes a person to contact you and whether the incident record shows what happened.
  • An isolation drill. Isolate a spare machine, confirm it cannot reach websites or the file share but still shows in the console, then release it and note how long the round trip took.
  • A restore. Restore a few files from backup to a different folder and open them. The StopRansomware Guide calls for offline, encrypted backups of critical data and regular tests of their availability and integrity.
  • The paper trail. Ask for last month's alerts and incidents in writing, including the ones that were ruled out.

The honest limits

EDR does not make a business unhackable. It makes the common attacks loud and short instead of quiet and long. It works best with the boring basics beside it: two-step sign-in on every account, backups that have been restored, and staff who know to forward a suspicious email rather than open it.

It also has blind spots. It protects only devices with the agent installed, so a personal laptop or unmanaged PC is not watched at all, and Microsoft says its detection is not intended to be an auditing or logging solution that records every operation on a device. The living off the land guide also warns that untuned EDR may not alert on attackers using built-in tools, so tuning by someone who knows what normal looks like in your office is part of what you are paying for.

Attackers know it is there. Microsoft notes that attackers often try to disable security features during attacks and that tampering attempts might indicate a larger attack, so a tampering alert deserves the same attention as a malware alert.

A quick way to tell what you have

Open the security software on a company laptop. If it talks about scans, definitions and quarantine, it is antivirus. If it talks about behavior, isolation and a console someone watches, it is EDR. If nobody can tell you who gets the alert at 2 a.m., the answer is nobody.

What to do this week

  • List every computer that touches company data, including laptops that live at home and any Macs, and who uses each one.
  • Open the security software on two or three of them and note whether it is antivirus or EDR.
  • If you use Microsoft 365, check your plan. Business Premium includes Defender for Business, and on Business Basic or Business Standard it is a separate purchase.
  • Ask whoever manages your security for the console's device count, the exclusion list and the tamper protection status.
  • Ask who receives an alert at 2 a.m. on a holiday, and what they may do without reaching you.
  • Read how your cyber insurance application asks about EDR, so the answer you give is one you can prove.
  • Book a test restore of a few files from backup.

What ALCO does

Every managed Windows and Mac device on the help desk plan runs endpoint detection and response, deployed through our remote management platform with no visit needed, and the service can also be added on its own. Behavior is watched around the clock. An alert isolates the device if needed and pages an ALCO engineer, who investigates, acts and tells you. Exclusions are tuned for the software you actually run, and every incident gets a written account in myALCO.

The ALCO help desk is staffed 24 hours a day, including holidays, and calls are answered by a person. The service page at alcohq.com/services/managed-edr sets out the full scope, and alcohq.com/services/security-and-compliance covers the security work it sits alongside. If your current protection is a green check mark in the corner of the screen, it is worth a conversation before the next attachment arrives.

Sources