Antivirus vs EDR with MDR: Why Antivirus Alone Is No Longer Enough for Alberta Businesses

For twenty years, “we have antivirus” was a reasonable answer to the question “are your computers protected?”

It isn't anymore.

The attacks hitting Alberta businesses today don't look like the viruses antivirus was built to stop. They look like a legitimate sign-in from a stolen password, a built-in Windows tool being used in a way it was never meant to be used, or a quiet week of reconnaissance before ransomware is launched at 2 a.m. on a long weekend.

This post explains the difference between traditional antivirus, Endpoint Detection and Response (EDR), and Managed Detection and Response (MDR), and why the combination of the last two has become the baseline for any organization that can't afford a week of downtime.

What antivirus actually does

Traditional antivirus works mostly by recognition. It keeps a list of known malicious files and patterns, scans what lands on the computer, and blocks anything on the list. Better products add some behaviour checks, but the core idea is the same: stop known bad things from running.

That still has value. Plenty of commodity malware is caught this way every day, and no one should run a business computer without it.

The problem is what antivirus doesn't see:

• Attacks with no malware at all. An attacker who signs in with a phished password isn't running a virus. They're running Outlook.
• Legitimate tools used maliciously. PowerShell, remote management tools, scheduled tasks and built-in Windows utilities are trusted by design. Attackers lean on them precisely because antivirus does too.
• Brand-new threats. A file that has never been seen before has no signature to match.
• What happened next. Antivirus can tell you a file was blocked. It can't tell you how it got there, what else the attacker touched, or whether they're still inside.

Most importantly, antivirus is a product, not a person. When it misses something, nobody is notified, nobody investigates, and the first sign of trouble is often the ransom note.

What EDR adds

Endpoint Detection and Response is the next generation of endpoint security. Instead of only asking “is this file known to be bad?”, an EDR agent continuously records what is happening on each computer and server: which processes start, what they connect to, what they change, and how they relate to each other.

That changes what's possible:

• Behaviour-based detection. A Word document that spawns PowerShell, which downloads a file, which starts encrypting folders, is a chain of behaviour EDR recognizes even if every individual piece is new.
• Visibility and investigation. When something is flagged, there is a full timeline to look at. Which user, which machine, what ran first, where it tried to spread.
• Response actions. A compromised computer can be isolated from the network in seconds, with the attacker cut off while the machine is still reachable for investigation and cleanup.
• Centralized management. Every endpoint reports to one console, so a threat on one machine can be checked against every other machine in minutes.

Microsoft describes EDR capabilities as providing near real-time, actionable detections so security teams can prioritize and respond to threats effectively. That word, teams, matters. EDR generates detailed, sometimes constant, alerts. Somebody has to read them.

What MDR adds

Managed Detection and Response is the service wrapped around the tooling. It is the people and process that make EDR useful for an organization that doesn't have its own security analysts.

With MDR:

• Detections are watched around the clock, not just during office hours. Attackers favour evenings, weekends and holidays for exactly that reason.
• Alerts are triaged by people who know the difference between a noisy false positive and the early stage of a real intrusion.
• When something is real, response happens immediately: isolating the device, disabling the account, blocking the sender, and starting the clean-up before the attack spreads.
• You get a plain-language explanation of what happened and what was done, instead of a dashboard full of red.

Put simply: EDR is the smoke detector and the sprinklers. MDR is the fire department that actually shows up.

Antivirus vs EDR vs MDR at a glance

Why this matters for businesses in Alberta and across Canada

Ransomware is the top cybercrime threat to Canadian organizations

The Canadian Centre for Cyber Security's National Cyber Threat Assessment names ransomware as the most disruptive form of cybercrime facing Canadian organizations, and notes that cybercriminals increasingly target small and medium organizations that lack the resources to defend themselves. Those are exactly the businesses that make up most of Alberta's economy: the family-run manufacturer, the clinic, the town office, the agricultural supplier, the engineering firm with thirty staff and no IT department.

Small teams can't watch a console all day

Even organizations that invest in EDR often discover that the alerts go unread. A one-person IT department, or an office manager who “does the computers,” can't review detections at midnight. Without a response service, EDR becomes an expensive logging tool that explains the breach after it happens.

Privacy law expects you to notice

Alberta's Personal Information Protection Act requires organizations to notify the Information and Privacy Commissioner when a breach of personal information creates a real risk of significant harm, and the federal Personal Information Protection and Electronic Documents Act carries similar obligations. You can't report what you never detected, and “we didn't know for three months” is not a position any business wants to be in. Canada's proposed privacy reforms, which we covered in our post on Bill C-36, raise those expectations further.

Your cyber insurance application already asks

Insurers have learned the hard way that antivirus alone doesn't prevent claims. Renewal questionnaires now routinely ask whether you run EDR on all endpoints, whether it is monitored 24/7, and whether you use multi-factor authentication. The answers affect your premium, your coverage limits, and in some cases whether you can get a policy at all.

The attacks are already here

None of this is theoretical. Alberta municipalities, health organizations, school divisions and private businesses have all publicly reported ransomware incidents in recent years. Being in a smaller centre is not a defence. Attackers find targets by scanning the internet, not by looking at a map.

“We have Windows Defender. Isn't that enough?”

The antivirus built into Windows is genuinely good at what it does, and it should stay turned on. But on its own it is still antivirus: it protects one computer at a time, nobody is watching it, and there is no response when it misses. Microsoft's own business-grade endpoint security is a separate, licensed EDR product precisely because the free protection is not designed to be a complete business defence.

What a modern endpoint defence looks like

For most Alberta businesses, the practical combination is:

1. Business-grade EDR on every computer and server, including laptops that leave the office and any remaining on-site servers.
2. 24/7 monitoring and response by a team that is alerted the moment a detection fires and can isolate a device or disable an account immediately.
3. Identity protection, because many attacks never involve malware. Multi-factor authentication and Conditional Access stop the stolen-password sign-in before EDR ever has to.
4. Patching that prioritizes known-exploited flaws, so the vulnerabilities attackers are actively using are closed first.
5. Tested, isolated backups, so that if the worst happens, recovery is a plan rather than a negotiation.
6. Security awareness training, so that the person who receives the phishing email is the first line of defence instead of the weakest one.

This is the layered approach we described in our earlier post on why endpoint protection matters, and it is the approach the Canadian Centre for Cyber Security recommends in its baseline controls for small and medium organizations.

How Reality Bytes approaches it

Our managed cybersecurity clients get managed business-grade endpoint protection on every computer and server, with detections reaching our team the moment they happen and watched around the clock. That sits alongside Microsoft 365 identity protection, prioritized patching, monitored backups and security awareness training, so the layers above aren't a shopping list you have to assemble yourself. If you're not sure where your organization stands today, our free Cybersecurity Health Assessment is the place to start.

The bottom line

Antivirus answers one question: “is this file known to be bad?” Modern attacks are built to make the answer “no.”

EDR answers a better question: “is this behaviour suspicious?” MDR makes sure someone acts on the answer, at any hour, before a single compromised laptop becomes an organization-wide outage.

For a business in Alberta or anywhere in Canada, that combination is no longer an upgrade for the security-conscious. It is the minimum that regulators, insurers and your own customers now expect.

Sources

• National Cyber Threat Assessment 2025-2026 | Canadian Centre for Cyber Security
• Baseline cyber security controls for small and medium organizations | Canadian Centre for Cyber Security
• Overview of endpoint detection and response | Microsoft Learn
• Personal Information Protection Act | Government of Alberta