EDR vs MDR vs XDR: What's the Difference?

EDR is a tool that watches your endpoints. XDR is a tool that watches your endpoints plus email, network, cloud, and identity. MDR is a service where security experts run those tools and respond to threats for you, around the clock.

That last distinction is the one most buyers miss. EDR and XDR are things you buy. MDR is people you hire to operate them. You are not choosing between three products. You are choosing how much you watch yourself, and how much you hand off. Get that call wrong and you either overpay for tools nobody operates, or you leave your managed cybersecurity half-built.

Most companies get this backward. They buy an endpoint tool, watch it light up with alerts, and assume they are covered. Then a real intrusion slips through at 2 AM, sits for two weeks, and nobody is watching the screen. According to Mandiant's M-Trends 2026 report, the median attacker now goes 14 days before anyone notices. Two weeks of quiet access. That is the number these three acronyms are all fighting to bring down, and they do it in very different ways.

Here is the whole thing in one screen before we go deep on each.

EDR, MDR, and XDR at a Glance

EDR and XDR are technology. MDR is a service. EDR watches endpoints only. XDR watches endpoints plus everything around them. MDR puts a staffed security team behind whichever tool you run.

• EDR. A tool you run yourself. It watches endpoints only, laptops, desktops, and servers, and it is the right pick for teams that already have security staff to read what it flags.
• XDR. Also a tool you run yourself, but with a wider view. Endpoints plus email, network, cloud, and identity, correlated into one picture. Best for complex environments that already run a SOC.
• MDR. Not a tool at all. It is a service, an outside team that operates whatever detection you run and watches it 24/7. Best for any business without round-the-clock security coverage.

Read those three one more time and notice the split. Scope of coverage goes EDR, then XDR. But operation is the axis that actually decides your outcome. A tool that watches everything and alerts nobody is worse than a narrow tool someone actually reads. Keep that in your head as we walk through each one.

What Is EDR (Endpoint Detection and Response)?

EDR is software that installs an agent on every endpoint and records what happens on it. Process execution, file changes, registry edits, network connections. When something looks like an attack, it flags it and, in many cases, can isolate the machine.

Think of it as a security camera on every laptop and server you own. It captures the footage. It even shouts when it sees something odd. What it doesn't do is decide whether the odd thing matters, or call someone to deal with it. That part is on you.

This is where most EDR deployments quietly fail. The tool works. The operating model does not. Here is the pattern we see over and over with mid-sized manufacturers. A shop buys a name-brand EDR agent, rolls it out to every box, and checks the box. Months later the console has logged hundreds of alerts, and nobody has opened one. The camera was rolling. The chair in front of the monitor was empty. That is not a product problem. That is a staffing problem the product can't solve.

EDR earns its keep when you have people who can read what it produces. If you employ security analysts who investigate alerts during business hours and beyond, EDR gives them the raw material to understand exactly what happened on a device before, during, and after an event. If you don't have those people, you've bought a very good camera and pointed it at an empty desk.

What Is XDR (Extended Detection and Response)?

XDR takes the endpoint visibility EDR gives you and extends it across the rest of your environment. Email. Network traffic. Cloud workloads. Identity and access systems. Then it correlates signals from all of them into one view.

Why does correlation matter? Because real attacks don't stay in one lane. A phishing email lands in someone's inbox, they click, a device gets compromised, stolen credentials move laterally into your cloud tenant. EDR sees the endpoint piece. Your email filter sees the email piece. Your identity provider sees the login piece. Nobody connects them. XDR connects them, so instead of three unrelated alerts you get one story that reads like an attack chain. And that email starting point is not a rare case. Verizon's Data Breach Investigations Report keeps finding the majority of breaches involve a human element, someone clicking, someone reusing a password, someone getting phished.

That correlation does two useful things. It catches threats that slip between siloed tools, and it cuts false positives, because a signal that looks scary alone often looks harmless in context. The payoff shows up in the numbers. IBM's Cost of a Data Breach 2025 found that XDR technology shortened the breach lifecycle by 55 days on average. Faster detection, faster containment, smaller bill. A breach contained in under 200 days averaged $3.61M in that same report. One that ran past 200 days averaged $5.49M. The 55 days XDR buys you sits right on that fault line.

The catch is the same one EDR has, only bigger. XDR gives you a single pane of glass across your whole stack. Someone still has to sit at that glass. More sources means more data, and more data with nobody watching is just a more expensive empty desk. XDR fits organizations that already run a security operations center or have the headcount to staff one. It isn't a shortcut around needing people. It is a force multiplier for the people you already have.

What Is MDR (Managed Detection and Response)?

MDR is not a product. It is a service. You are hiring an outside security team that runs detection tooling, watches it around the clock, investigates what fires, and responds when something is real. The technology underneath might be EDR, XDR, or a mix. The point of MDR is not the tool. It is the humans and the hours.

Ask yourself one question. What happens when an alert fires at 2 AM on a Saturday? If the honest answer is that it waits until Monday, you have found the gap MDR fills. Attackers know your team sleeps. They pick nights and holidays on purpose. A tool alerting into an empty office at 2 AM is documentation, not defense.

The economics are where this gets clear for most businesses our size. A single in-house information security analyst runs roughly $120k a year in median pay, per the U.S. Bureau of Labor Statistics, and you need more than one to cover 24 hours, 7 days, 365 days. Three to five analysts, minimum, for real round-the-clock coverage. MDR gives you that coverage as a subscription for a fraction of one salary. That math is why Gartner projected half of all organizations would be using MDR for 24/7 threat monitoring and containment by 2025.

MDR is also how you actually change that dwell-time number. The 14-day median we opened with drops hard when a staffed team is watching. In practice, a good MDR provider is measuring response in hours, not weeks. That's the difference between an attacker who gets stopped at the front door and one who spends a fortnight reading your email. If you want to see how MDR stacks up against the older managed-security models, we broke that down in how MDR compares to MSSP and SIEM.

The Real Difference Nobody Explains

Strip away the acronyms and there are only two questions. What do you want to watch? And who is going to watch it?

Scope is the first axis. EDR watches endpoints. XDR watches endpoints plus email, cloud, network, and identity. That axis is real, but it's the easy one, and it's the one every other article stops at.

Operation is the second axis, and it decides everything. EDR and XDR are both tools you operate yourself. MDR is the operating itself, sold as a service. You can run EDR without MDR, if you have staff. You can buy MDR that runs on XDR under the hood. They aren't three points on one line. They are two different questions wearing similar names.

So the framing EDR vs MDR vs XDR is a little bit of a trap. You don't pick one. You answer both questions. A mid-market company with a sprawling cloud footprint might land on XDR for scope and MDR for operation, and run them together. A 40-person shop with two IT generalists and no night coverage almost always needs the operation half first, whatever tool sits underneath. Deploying a tool is not the same as being covered. The gap between owning EDR and operating it is one of the most expensive disconnects in security, and it is entirely invisible until the day it isn't.

What Does EDR, MDR, and XDR Cost in 2026?

Roughly? EDR is a per-device license. MDR is a per-device service fee that includes the people. XDR is a platform license that runs higher than EDR because it ingests more. Here is the shape of it, based on what we see quoting these for California businesses.

• EDR license. Roughly $5 to $15 per endpoint per month. That buys the tool and nothing else. The staff to run it is the cost nobody puts on the quote.
• XDR platform. Usually $15 to $30 per endpoint per month for a broader tool pulling in far more data. Which means even more people to make sense of it.
• MDR service. Roughly $7 to $30 per endpoint per month, and this one includes the people. Tool plus a 24/7 team, so the analysts are baked into the price instead of hiding behind it.
• In-house SOC. $360,000 or more a year in salaries alone for full control, before you count hiring, training, turnover, and burnout.

Look at the MDR line against the in-house SOC line. That is the comparison that actually matters, and it's the one most vendors won't put in front of you. A bare EDR license looks cheap next to MDR. It isn't, once you price in the analysts you need to make it work. Three to five people at $120k each lands past $360,000 a year before you count recruiting, benefits, or the two months of coverage you lose every time one of them quits.

For any business under about 1,000 employees, the math writes itself. You're almost never better off building a 24/7 security team from scratch than renting one that already exists. I'll disclose the obvious bias here. We sell managed security, so of course I'd say that. But go price three senior analysts in the Los Angeles market and check the number yourself. It holds.

Which One Does Your Business Actually Need?

No single answer fits everyone. It comes down to four things. Whether you have in-house security expertise. Whether you can cover threats 24/7. How complex your environment is. And what compliance you're on the hook for. Here is how it usually shakes out.

• You have a real security team that works nights and weekends. Then EDR, or XDR if your environment sprawls across cloud and identity. You've got the people. Give them good tools.
• No security staff, or IT generalists wearing a security hat part-time. MDR. Full stop. The tool matters less than the fact that a trained human is watching it while your team sleeps.
• Regulated under CMMC, SOC 2, NIST 800-171, or similar. You need documented 24/7 monitoring and demonstrable response, which usually means MDR whether or not you have some internal staff. Assessors want evidence someone is watching, not just that a tool is installed.
• Sprawling hybrid environment, lots of cloud, lots of identity, and a small team. XDR for the visibility, MDR to operate it. This pairing is common in mid-market manufacturing and defense work.

Most of Consilien's clients (California manufacturers, defense suppliers, and mid-sized firms without a night-shift SOC) land in the second or third bucket. That is not us upselling. It's just where the risk sits for a company that has real data to protect and no one watching the board after 6 PM. If you're genuinely not sure which bucket you're in, that's what a cybersecurity risk assessment is for. It tells you where the gaps actually are before you spend a dollar on tooling.

Do You Need All Three?

Often, yes, and they stack cleanly. EDR is the foundation, the endpoint telemetry every modern program needs. XDR extends that view across the rest of your environment. MDR is the team that operates whichever of those you run and responds when it counts. They aren't competitors fighting for the same budget line. They're layers.

The mistake is treating them as an either-or shopping decision. You don't walk in and pick the winner. You figure out your scope, then you figure out your coverage, and the answer is usually some combination. For a company with data worth stealing and no 24/7 team, the combination that drags that 14-day dwell number down toward hours is MDR sitting on top of solid endpoint tooling. Everything else is detail.

The Bottom Line

EDR, XDR, and MDR are not three flavors of the same thing. Two are tools with different reach. One is a service that puts people behind whichever tool you run. Pick your scope, EDR for endpoints or XDR for everything, then answer the harder question of who watches it at 2 AM. For most businesses without a dedicated security team, that answer is MDR, and the breach-cost math backs it up cleanly.

If you're sorting out detection and response for a California business and you want a straight read on what you actually need instead of a product pitch, start with Consilien's managed security services or book a free assessment. We'll tell you which layer you're missing, even if the honest answer is that you don't need everything on this page yet.