Antivirus blocks known malicious files; endpoint detection and response (EDR) records what happens on an endpoint so attacker behavior can be detected, investigated and contained. Antivirus scans files with signatures and heuristics and quarantines what it recognizes; EDR continuously collects process, network, registry and logon activity, is designed to flag fileless and living-off-the-land (LOTL) behavior, and lets analysts isolate a device. Next-generation antivirus (NGAV) and endpoint protection platforms (EPP) sit between, adding behavioral and machine-learning prevention, exploit protection and device control. In practice they ship together: Microsoft’s EDR agent relies on its antivirus engine to scan files.
Enterprise Techie’s other security analyses are listed in the topic index.
In this guide
Key facts
| Item | What the sources say |
|---|---|
| Antivirus (NIST) | Identifies malware to “prevent or contain malware incidents” |
| EPP (NIST SP 800-128) | Software safeguards for end-user machines: antivirus, firewalls, host intrusion prevention |
| EDR (OMB M-22-01, 2021) | Continuous endpoint monitoring with automated response and analysis |
| Is EDR an antivirus? | No; Microsoft’s EDR agent depends on Defender Antivirus to scan files |
| CISA guidance (2023) | Managed antivirus, plus allowlisting and/or EDR on all assets |
Definitions
Traditional antivirus
NIST’s glossary defines antivirus software as “A program that monitors a computer or network to identify all major types of malware and prevent or contain malware incidents.” NIST SP 800-83 Rev. 1 (July 2013) lists its capabilities: “Scanning critical host components such as startup files and boot records,” real-time “on-access scanning,” on-demand scans and “Disinfecting files” or “quarantining files.” Antivirus detects malware “primarily by looking for certain characteristics of known instances of malware,” which is “highly effective for identifying known malware.” The glossary, citing the same guide, defines malware as a program “covertly inserted into another program” to compromise a system.
NGAV and EPP
NIST’s glossary has no NGAV entry; its EPP entry (from SP 800-128) covers safeguards for “end-user machines such as workstations and laptops,” including antivirus, personal firewalls and host-based intrusion prevention. Gartner’s EPP market definition (features updated October 2025) requires attack surface reduction “such as device control, host based firewall management, exploit protection or application control,” real-time anti-malware scanning, and blocking threats “using behavioral analysis of endpoint, application and end-user activity.” Microsoft’s next-generation protection blocks malware “using local and cloud-based machine learning models, behavior analysis, and heuristics.” The categories overlap: Gartner’s definition also includes detection and response capabilities “to uncover, investigate and respond to endpoint threats that evade security protection.”
EDR
OMB memo M-22-01 says EDR “combines real-time continuous monitoring and collection of endpoint data” with “rules-based automated response and analysis capabilities.” Microsoft’s EDR overview lists what Defender for Endpoint collects: process information, network activities, “user login activities, registry and file system changes,” stored “for six months.” Isolating a device “can help prevent the attacker from controlling the compromised device.” MDR vs EDR covers XDR and MDR too.
EDR vs NGAV vs antivirus: comparison table
| Antivirus | NGAV / EPP | EDR | |
|---|---|---|---|
| Detects | Known malware and attacker tools | Known and unknown malware, file-less attacks, exploit attempts | Attacker behavior across the intrusion, including LOTL and credential theft |
| How | Signatures and heuristics; on-access and on-demand scans | Static and behavioral analysis, machine learning, cloud lookups, attack surface reduction | Continuous recording of endpoint activity; behavioral analytics and investigation |
| Response | Disinfect, quarantine or delete the file | Block execution or behavior; device control and firewall policy | Isolate device, stop and quarantine files, investigate, remediate |
| Operated by | Administrators keeping signatures current | Endpoint or security team tuning policy | Analysts: in-house SOC or MDR |
| Data kept | Detections and quarantined files | Detection and block events in a central console | Telemetry history (six months in Defender for Endpoint) |
What each layer misses
Antivirus. SP 800-83 says antivirus “does not excel at stopping previously unknown threats” and that “largely signature-based security controls, such as antivirus software, cannot keep up” with malware customized per victim. CISA’s #StopRansomware Guide (September 2023) warns that password-protected archives “evade antivirus scanning and email filters.” Microsoft’s fileless threats page notes “there’s no one definition for fileless malware”; the fully fileless kind “never requires writing a file on the disk.”
NGAV and EPP. Prevention engines decide in the moment and keep detection events, not the activity history an investigation needs. LOTL is built to look legitimate: the joint LOTL guidance from CISA, NSA, FBI and partners (February 2024) notes that living-off-the-land binaries “have trusted attributes (such as file hashes or digital signatures).” Microsoft says its attack surface reduction rules target behavior that “legitimate apps might also” exhibit, so rules need testing.
EDR. The same guidance warns against relying on “untuned endpoint detection and response (EDR) systems, which may not alert to LOTL activity,” and notes that threat actors use EDR tools already installed on victim networks “to take advantage of the tools’ remote-shell capabilities.” Microsoft says its detection “is not intended to be an auditing or logging solution that records every operation.” EDR sees only devices running its agent, and every alert needs triage.
All three are targets. ATT&CK’s Disable or Modify Tools covers adversaries who “disable, degrade, or tamper with security tools,” naming EDR and antivirus, and Microsoft’s tamper protection page warns that attackers “often try to disable security features on devices.”
Attack examples: which layer is designed to catch what
Entries come from MITRE ATT&CK v19, where Antivirus/Antimalware (M1049) uses “signatures, heuristics, and behavioral analysis” and Behavior Prevention on Endpoint (M1040) works “Rather than relying solely on known signatures.” The table shows design intent, not test results.
| Technique (ATT&CK ID) | Endpoint mitigations MITRE lists (selected) | Detection strategy MITRE describes |
|---|---|---|
| Spearphishing Attachment (T1566.001) | Antivirus (M1049): quarantine suspicious files | Email delivery, file creation, then Office spawning PowerShell |
| Obfuscated Files or Information (T1027) | Antivirus with AMSI (M1049); behavior rules (M1040) | Script execution tied to encoded or encrypted files |
| PowerShell (T1059.001) | Antivirus (M1049); application control (M1038) | Encoded commands, unusual parent processes |
| Rundll32 (T1218.011) | Exploit protection (M1050) only | Atypical arguments, unexpected DLL loads, outbound connections |
| LSASS Memory (T1003.001) | Behavior rules to secure LSASS (M1040) | Abnormal process opening lsass.exe, then a memory dump |
| Replication Through Removable Media (T1091) | Behavior rules for USB files (M1040); limit USB devices (M1034) | Execution from removable media after mount |
| Data Encrypted for Impact (T1486) | Cloud protection and behavior rules (M1040) | Bursts of file writes, ransom notes, shadow copy deletion |
| Disable or Modify Tools (T1685, formerly T1562.001) | Audit agent check-ins and exclusions (M1047) | Killed security processes, registry changes, missing telemetry |
Antivirus is a listed mitigation in three of the eight rows. Every detection strategy above draws on process activity plus file, registry or network events, the kind of telemetry EDR collects. For identity attacks, see What is ITDR?
How they work together in practice
Vendors bundle the layers: Defender for Endpoint includes EDR and “next-generation protection with ransomware prevention.” CrowdStrike sells Falcon Prevent (“next-gen antivirus”) beside Falcon Insight XDR for EDR and Falcon Device Control. SentinelOne says Singularity Endpoint combines EPP, EDR and automated remediation “in a single unified agent.”
Microsoft also documents running EDR beside another vendor’s antivirus. On devices onboarded to Defender for Endpoint, Defender Antivirus then runs in passive mode: “Microsoft Defender Antivirus isn’t the primary antivirus app. Files are scanned by EDR, and EDR in block mode can remediate threats, but Microsoft Defender Antivirus itself doesn’t remediate.” EDR in block mode “provides added protection from malicious artifacts when Microsoft Defender Antivirus is not the primary antivirus product and is running in passive mode.” It “works behind the scenes to remediate malicious artifacts that were detected by EDR capabilities. Such artifacts might have been missed by the primary, non-Microsoft antivirus product.”
Block mode needs Defender for Endpoint Plan 2, Windows and cloud-delivered protection, and “cannot provide all available protection” in passive mode: real-time protection, network protection, attack surface reduction rules and indicators need active mode. Microsoft’s FAQ recommends disabling block mode where Defender Antivirus is primary.
EDR also changes staffing. Microsoft says alerts “are created in the system for an analyst to investigate.” Someone must work them at any hour, in house or through a provider (MDR vs EDR), and telemetry often feeds a SIEM (SIEM vs XDR).
Deployment considerations
- Agent conflicts: SP 800-83 warns that running multiple antivirus products on one host “is likely to cause conflicts.” Microsoft says two active engines will “impact performance and is not supported,” and asks you to add Defender for Endpoint to the other product’s exclusion list.
- Servers vs workstations: on Windows Server, Defender Antivirus “doesn’t enter passive mode automatically”; set ForceDefenderPassiveMode before onboarding. Automatic exclusions cover built-in server roles only; Exchange, SharePoint and SQL Server need custom ones. Isolating a Hyper-V host “blocks network traffic to all child virtual machines,” and automatic isolation “works only on end-user workstations.”
- Exclusions: Microsoft says an exclusion “creates a protection gap.” Windows antivirus exclusions “don’t apply to EDR, so excluded files can still trigger EDR alerts.” MITRE advises checking EDRs for “unexpected exclusion paths.”
- OS coverage: Defender for Endpoint supports Windows, macOS, Linux, Android and iOS, but features differ; EDR in block mode lists Windows only.
- Offline devices: Defender for Endpoint needs internet access “either directly or through a proxy.” An isolation request to an offline device is retried “for up to three days.” CrowdStrike says Falcon Prevent stops threats “even when you’re offline”; ask each vendor which functions need the cloud.
Evaluation checklist
- Prevention: signatures plus behavioral and machine-learning blocking, exploit protection, device control, and what still works offline.
- Coexistence: whether it runs beside your current antivirus during migration, in which mode, and which features switch off.
- Telemetry: event types recorded, retention period, and export to your SIEM.
- Response: isolation, quarantine, process kill and live response per OS; which run automatically; who may use live response, with MFA and audit logs.
- Coverage: every OS, server role and VDI image you run, and how servers are licensed.
- Tamper resistance: tamper protection, plus console alerts when an agent stops checking in.
- Exclusions: who approves them, how they are scoped and how often they are reviewed.
- Operating model: who triages alerts nights and weekends.
How to decide
- Signature antivirus only: falls short of CISA’s call for allowlisting and/or EDR “on all assets.”
- Replacing antivirus: choose an EPP suite with EDR on one agent and retire the old engine instead of stacking two active scanners.
- Mid-contract on another antivirus: run EDR beside it in a documented coexistence mode, then consolidate.
- No one to watch alerts: pair EDR with MDR.
None of these layers restores encrypted systems; plan that in the ransomware recovery plan.
Frequently asked questions
What is the difference between EDR and antivirus?
Antivirus scans files and blocks or quarantines known malware. EDR continuously records endpoint activity, detects attacker behavior that leaves no known-bad file, and lets analysts respond, for example by isolating the device.
Is antivirus still needed with EDR?
Yes, as the prevention engine, usually in the same agent. Microsoft’s EDR depends on Defender Antivirus to scan files, and CISA still recommends centrally managed antivirus with automatic updates. Only one engine should be active.
Is EDR an antivirus?
No. EDR is a detection, investigation and response layer. Vendors such as Microsoft, CrowdStrike and SentinelOne sell it alongside NGAV, which is why the two get confused.
What is the difference between NGAV or EPP and EDR?
NGAV and EPP aim to stop threats as they execute, using behavioral analysis, machine learning and attack surface reduction. EDR assumes something gets through and records activity so analysts can find and contain it. Gartner’s EPP definition includes both.
Sources
- NIST glossary: antivirus software, malware, EPP
- NIST SP 800-83 Rev. 1
- OMB M-22-01
- CISA: #StopRansomware Guide, LOTL guidance
- MITRE ATT&CK
- Gartner Peer Insights: EPP
- Microsoft Learn: antivirus compatibility, EDR in block mode, EDR overview, exclusions, device response, minimum requirements
- Vendors: CrowdStrike Falcon Prevent, SentinelOne
Last checked: October 2026. Guidance and product features change; check each source before you rely on it.
Buying? Start from RFPhub’s free XDR and EDR Platform RFP template.