GuideSecurity · 6 min
XDR, MDR, EDR: what's the difference, and which do we buy?
EDR is software on each device, XDR stretches it across identity, email and cloud, and MDR is the people who watch it all. You can buy a tool, a team or both.
The Clectiv team ·
Two of the three are software, and one is people. Mix them up and you pay for a tool nobody watches. Here's what each one does, and where a SIEM fits.
What does each one actually do?#
EDR is software on each device, XDR widens it, and MDR adds people. An endpoint is any device that connects to your systems, like a laptop, a server or a phone.
| Term | Stands for | What it is |
|---|---|---|
| EDR | Endpoint detection and response | Software on each device that spots an attack and can isolate the device. |
| XDR | Extended detection and response | EDR plus signals from identity, email and cloud in one view, so connected alerts read as one story. |
| MDR | Managed detection and response | A provider's people who watch, investigate and respond, using the software. |
EDR keeps a record. It logs which programs ran on a device and what they touched, so a person can trace an attack after the fact.
XDR joins the dots. A phishing email, a stolen login and an odd laptop are three alerts in three tools. XDR shows them as one attack.
The "response" in all three means taking action. That could be isolating a laptop, locking an account or blocking an address. Ask who does it, and who allows it.
Palo Alto Networks, Fortinet and Cato Networks sell XDR. LevelBlue, BlueVoyant and AgileBlue sell MDR. That's a sample of the security providers we work with, and Clectiv AI runs the process for you: start a project.
Providers use these terms loosely. Ask what a proposal covers, not just what it's called.
Before you call anyone#
Don't sit through a demo until Clectiv AI has what you run and who watches it. After that, Clectiv AI runs the process, bids it out to the providers that fit, has them compete, and lets you choose. Start with a tool vendor and the answer is a tool. Start with an MDR provider and you get the tool it runs on.
Do we need the tool, the team, or both?#
A tool alone raises alarms, and somebody has to answer them. If nobody's reading at 2 a.m., the alarm rings in an empty room. A team alone needs something to watch, and some MDR providers bring their own tools.
MDR isn't only for companies without a security team. Some teams hand the nights and weekends to a provider and keep the daytime in-house.
Your plan decides, from three facts: the hours your own people can cover, the tools you already own, and who has to act when something fires. Write them down with Clectiv AI, and the providers that fit bid on whatever's missing.
Check these in any proposal:
- Whose tool is it, and what happens to your data and coverage if you leave?
- Can the team act on its own, or only alert you?
- Does it work with the tools you already own?
Where does a SIEM fit?#
A SIEM collects logs from all your tools in one place. It isn't one of the three, but it gets mixed up with them. SIEM stands for security information and event management. It lets you search what happened across everything, and it keeps the record an auditor or insurer may ask for.
Think of XDR as a view of attacks, and a SIEM as a record of everything. XDR connects signals from its own tools and its partners'. A SIEM takes in logs from nearly anything, including older systems.
A SIEM needs people too. Someone has to tune it and read it, and some providers run one for you. LevelBlue and AgileBlue sell managed SIEM, and Fortinet and Palo Alto Networks sell SIEM tools.
Those are some of our security providers for this, and Clectiv AI runs the process with them for you: start a project.
You don't start from scratch. Clectiv AI runs the process we ran for companies in your position, so you start where they left off. It carries the plan straight to these providers, after the best pricing, terms and contract we can get.
Whether you need both is a question for the plan. Clectiv AI's plan asks what you must log, for how long, and who reads it.
Common questions#
What's the difference between EDR and antivirus?#
Is XDR better than EDR?#
Can an MDR provider use the tools we already have?#
Do we need a SIEM if we have XDR?#
Who responds when an alert fires?#
How does Clectiv AI get this done?#
Put it in Clectiv AI. Tell it what devices, accounts and clouds you run, and who watches them. It scopes the coverage with you and writes your plan: what's watched today, what isn't, and who responds.
Then the Clectiv team takes your plan to the detection and response providers that fit, all at once, through our partner network of 620+ providers. Each one bids, they compete on the same plan, the team pushes on terms, and you choose.
You inherit what others learned. Clectiv AI runs the process that got them there, so you start where they left off. It takes the plan straight to the providers that fit, for the best pricing, terms and contract we can get.
It's free to you, and it gets moving in days, not months. The rest of what we source in security is on the security page.
Weighing the price of the team? Read what 24/7 MDR costs.
Sources and method. No prices appear in this guide. The definitions describe how the terms are commonly used, and providers sometimes use them differently. Provider names are examples of who sells these tools and services, from Clectiv's provider directory, not a ranking.