MDR vs EDR vs XDR: the differences explained

EDR, MDR and XDR get used almost interchangeably in vendor decks, but they answer three different questions. EDR is what you deploy, MDR is who operates it, and XDR is how wide the detection reaches. Get the distinction right and the buying decision — and the budget line — gets much simpler.

Below is a plain-English breakdown of each acronym, the one distinction that actually matters, and how to decide which you need.

What is EDR?

EDR (Endpoint Detection and Response) is a tool. It puts a software agent on each endpoint — laptops, servers, VMs, sometimes mobile — to record activity, detect malicious behaviour, and let your team isolate or remediate a compromised device. Think CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint.

EDR is something you run. It generates the alerts; your staff (or a service) triage and respond to them. Typical list pricing is around $3–$20 per user/endpoint per month, roughly $8 at the mid-tier.

What is MDR?

MDR (Managed Detection and Response) is a service. A provider takes an EDR-class telemetry feed (often their own tooling) and adds a 24/7 human team that triages alerts, investigates, and responds on your behalf. Think Huntress, Arctic Wolf, CrowdStrike Falcon Complete, Red Canary.

MDR is what you buy when you don’t want to staff a round-the-clock SOC. You’re paying for people and coverage, not just software — which is why it’s priced per endpoint per month (roughly $3–$45, ~$6 typical mid-market) and sits higher than raw EDR.

What is XDR?

XDR (Extended Detection and Response) is a platform capability. It extends detection beyond the endpoint — correlating signals across endpoint, cloud, identity, email and network so a single incident is stitched together instead of appearing as disconnected alerts. It’s usually sold as a premium tier of an endpoint/platform suite rather than a separate SKU.

The “extended” in XDR is about breadth of telemetry and correlation, not about who operates it. You can run XDR yourself or have an MDR provider run it for you.

MDR vs EDR vs XDR: the key difference

The cleanest way to hold all three in your head:

	EDR	MDR	XDR
What it is	A tool	A service	A platform capability
Who operates it	Your team	The provider’s 24/7 team	Either
Scope	Endpoints	Endpoints (+ what the service covers)	Endpoint + cloud + identity + email + network
You’re paying for	Software	People + coverage	Correlation across data sources
Typical cost	~$3–$20 / user / mo	~$3–$45 / endpoint / mo	Premium tier / bundle add-on

They aren’t rungs on a single ladder where XDR replaces MDR replaces EDR. A common real-world stack is EDR as the sensor, XDR as the correlation layer, and MDR as the humans running both.

When to choose each

• Choose EDR if you have a security team that can watch and respond to alerts during your risk window. You want strong endpoint coverage and you have the staff to operate it.
• Choose MDR if you don’t have 24/7 coverage — which is most small and mid-market organisations. Attackers don’t keep business hours; stolen credentials and endpoint intrusions are leading breach vectors in the Verizon DBIR, and they often play out overnight. MDR buys you the humans without an 8–12-person SOC.
• Add XDR when endpoint-only detection is missing things — attacks that move between cloud, identity and email. XDR’s value is correlation, so it pays off once you have meaningful cloud and identity footprints to connect.

For most mid-market teams the honest answer is “MDR, on top of EDR, with XDR-class correlation where the vendor bundles it” — not a single product choice.

What it costs in a real budget

These three are usually separate line items, and they’re rarely the biggest one — in-house staffing typically dominates a security budget. If you want to see how endpoint detection sits alongside identity, SIEM, cloud, and the rest for an organisation your size, our EDR vs MDR vs XDR pricing breakdown covers the numbers, and the cybersecurity budget calculator models the whole program from your own inputs.