They ran a full antivirus scan when the insurance company asked for proof of endpoint protection. Everything came back clean.

Four months later, during an unrelated IT review, the forensics showed a persistent connection to an external IP that had been running since the previous spring. The attacker had been inside for four months. The antivirus had never flagged it — because the attacker wasn't using malware files. They were using legitimate system tools, running processes in memory rather than on disk, and blending into normal administrative activity.

This isn't an exotic attack technique. It's the default approach for anyone who knows what they're doing.

What antivirus actually does

Traditional antivirus works by matching files against a database of known malicious signatures. When a file on your system matches a known bad signature, it gets flagged and quarantined.

This works well against:

  • Known malware that has been catalogued and added to signature databases
  • Commodity threats that haven't been modified to evade detection
  • Older attack techniques that rely on malicious files on disk

What it doesn't detect:

  • Fileless malware: Code that runs entirely in memory (PowerShell scripts, Windows Management Instrumentation, process injection) leaves no file on disk to scan
  • Zero-day exploits: Vulnerabilities that haven't been catalogued yet have no signature to match against
  • Living-off-the-land attacks: Using legitimate Windows tools (PsExec, WMI, scheduled tasks, RDP) for malicious purposes — the tools themselves are trusted and not flagged
  • Behavioural anomalies: An admin account that suddenly starts accessing files it's never touched before

More than 70% of modern attacks use techniques that traditional signature-based antivirus doesn't detect. The threat landscape has evolved; signature matching alone hasn't kept pace.

What EDR does differently

Endpoint Detection and Response (EDR) is a different approach. Instead of (or in addition to) matching files against signatures, EDR:

Records endpoint behaviour continuously

EDR maintains a telemetry stream of everything that happens on an endpoint: what processes run, what files they access, what network connections they make, what registry keys they modify. This creates a timeline that can be searched and analysed.

Detects behavioural anomalies

Rather than matching against known bad signatures, EDR looks for patterns that indicate malicious intent: a Word document spawning a PowerShell process, a user account accessing an unusual number of files in a short period, a device making outbound connections to an IP with no history in your environment.

Enables forensic investigation

When something is flagged, the telemetry record lets you see exactly what happened, in what order, on which devices. This is what forensics teams use to understand the scope of an incident — and it's what showed the four-month dwell time in the example above.

Can isolate compromised devices

Modern EDR platforms can cut a device off from the network remotely, in seconds, without physically touching it. If a device is compromised, you can contain it immediately while investigation continues.

The cost of EDR for a small business

EDR used to be enterprise-only technology — expensive, complex to operate, requiring a security operations centre to review alerts. That's no longer true.

Microsoft Defender for Business is included in Microsoft 365 Business Premium ($26/user/month). It provides EDR-class endpoint protection, centrally managed from the Microsoft 365 admin centre, with alert responses that are understandable without a security engineering background.

CrowdStrike Falcon Go and SentinelOne Singularity are purpose-built EDR platforms that start in the $5–$8/endpoint/month range for SMB-tier licensing.

For most small businesses already on Microsoft 365 Business Premium, the endpoint protection is already included — it just needs to be enabled and configured.

The question to ask yourself

If an attacker gained access to your network today and spent the next four months moving quietly through your environment — reading emails, accessing shared drives, sitting on financial records — would your current endpoint protection detect it?

If you're running signature-based antivirus only: the honest answer is probably not.