EDR vs MDR vs XDR vs SIEM vs SOC: what each one is, and which your business needs
EDR vs MDR vs XDR vs SIEM vs SOC in one table: what each one is, who watches it, and which a 10, 30 or 80-person Melbourne business actually needs.
EDR vs MDR vs XDR in brief: EDR watches each laptop and server for attacker behaviour, and XDR extends that to email, identity, cloud and network. MDR is a service: analysts who watch those tools 24/7 and act. A SIEM collects and correlates logs, SOAR automates responses, and a SOC is the team doing the watching. Most 10 to 80-person businesses need EDR plus MDR, not their own SIEM.
EDR vs MDR vs XDR vs SIEM vs SOC: what's the difference, in one table?
Three are tools, one is a service and one is a team. The costly mistake is assuming the watching came with the tools, so ask of each: who looks at it at 2am on a Sunday?
| Term | What it is | Tool or service? | Who watches it? | What it catches | What it misses |
|---|---|---|---|---|---|
| EDR | Endpoint detection and response: records behaviour on each laptop and server, and can isolate a device | Tool | Whoever gets its alerts, if anyone | Ransomware behaviour, malicious scripts, intruders on a device | Anything off the device, like mailbox rules and cloud sign-ins |
| XDR | Extended detection and response: the EDR approach applied across email, identity, cloud and network | Tool | Same as EDR | Attacks that hop between layers | Unconnected systems; overnight alerts still need a person |
| SIEM | Security information and event management: central log collection, correlation and retention | Tool | Analysts, usually in a SOC | Patterns across many log sources | Anything not sent to it; it alerts but doesn't act |
| MDR | Managed detection and response: analysts who monitor, investigate and respond using EDR or XDR | Service | The provider's analysts, 24/7 | Threats that slip past prevention | Unconnected systems; it doesn't patch or fix your IT |
| SOC | Security operations centre: the team that monitors, analyses and responds | A team (people, process and tools) | It is the watcher | Whatever its signals cover | Anything outside its contracted scope |
Every tool row hands the watching to someone else. For other acronyms, see our cyber security glossary.
Is EDR just antivirus?
No, though modern products bundle the two. Microsoft notes that antivirus tools "primarily focus on detecting and blocking known threats using signature-based detection", while EDR watches endpoint activity for unusual behaviour and helps a team investigate and contain it.
The difference shows in attacks with no malicious file, such as an intruder using a phished admin password and built-in Windows tools to switch off your backups. No signature matches, but EDR can flag the behaviour, record the sequence and cut the device off the network. On EDR vs antivirus, then: antivirus is the lock, EDR is the camera with an alarm attached, and the alarm only helps if somebody hears it.
What does XDR add?
In cyber security, XDR (extended detection and response) applies the EDR approach to more of your environment. Microsoft's EDR vs XDR explainer puts it neatly: "EDR gives your security team deep visibility into one critical layer of your environment. XDR gives them broad visibility across many." Those layers include email, identity, cloud workloads and network, and XDR builds on EDR rather than replacing it.
The gain is correlation. A phishing email, an overseas sign-in, a new inbox rule and an odd script on a laptop become one incident with one timeline, not four alerts in four consoles. For Microsoft 365 businesses that matters, because what attackers want (mailboxes, SharePoint files, the next invoice run) isn't on the laptop.
Is MDR a product or a service?
A service. Microsoft calls MDR "a human-led service that manages these cybersecurity tools and the data they provide", and says plainly that XDR "isn't a managed service that includes a team of human analysts like MDR."
The provider's analysts watch alerts around the clock, investigate the credible ones, contain confirmed threats by isolating a laptop or disabling an account, and hand over the clean-up. Containment isn't recovery, so ask who finishes the job.
What are SIEM and SOAR?
A SIEM (security information and event management) platform is the central log store and correlation engine. NIST defines a SIEM tool as an application that gathers security data from information system components and presents it as actionable information via a single interface. SOAR (security orchestration, automation and response) acts on what's found: Microsoft says it helps security teams investigate and remediate threats at scale, using playbooks, predefined workflows that can, say, disable a compromised account, with human approval for the riskier steps. SIEM mostly detects; SOAR mostly responds.
ASD's ACSC, CISA and partner agencies released joint guidance on implementing SIEM and SOAR platforms in May 2025, and as Infosecurity Magazine reported, the agencies warn that running one yourself "will involve significant costs", from licences to specialist staff. A companion paper on priority logs lists EDR tools among the key log sources: EDR feeds the SIEM, and the SIEM feeds the analysts. At 10 to 80 staff, the better question is whether the SOC watching you uses one.
What is a SOC, and how is it different from MDR?
A SOC (security operations centre) is the team. Microsoft's MDR explainer notes that a SOC "can be an internal team or outsourced"; either way it monitors, analyses and responds, supplying the judgement the tools lack.
On MDR vs SOC: the SOC does the work, and MDR is how a smaller business buys that work, by subscription. One seat staffed around the clock is 168 hours a week, which means several full-time people before anyone takes leave or calls in sick. For a 30-person firm, building your own rarely adds up.
Where does the tool end and the people begin?
Some tools now act on their own. Microsoft's automatic attack disruption contains compromised devices and accounts mid-attack, yet Microsoft's documentation says it "leaves security operations teams in complete control of investigating, remediating, and bringing assets back online". The tool buys time; people spend it.
- Tools are good at spotting known-bad behaviour, recording what happened, and isolating a device or blocking a sign-in at 3am.
- People are needed to decide whether the finance manager really is signing in from Bali, whether to isolate the only server mid-payroll, what data was touched and whether it's a notifiable breach, then reset, rebuild and close the hole.
Which do you need at 10, 30 or 80 staff?
Headcount isn't the real trigger; how much there is to watch is.
| Size | Example business | Must have | Worth adding | Usually not needed yet |
|---|---|---|---|---|
| Around 10 staff | A physio clinic or design studio running on Microsoft 365 | EDR on every device (Defender for Business, in Business Premium, covers it), MFA, tested backups | MDR, so alerts are watched after hours | Your own SIEM, SOAR or XDR licence |
| 15 to 30 staff | A 15-person accounting firm holding client tax and payment details | EDR on devices and servers; MDR or 24/7 SOC monitoring covering Microsoft 365 sign-ins and email | Joined-up email, identity and device alerts; regular vulnerability scanning | A standalone SIEM, unless a contract or insurer demands log retention |
| 60 to 80 staff | A 60-person manufacturer with a factory floor and a second site | EDR on PCs and servers; 24/7 MDR; firewall and network signals feeding the SOC | A managed SIEM where factory machines can't run EDR; co-managed IT alongside internal staff | Building your own SOC, or running SOAR yourself |
Does Microsoft 365 Business Premium already give us EDR?
Yes. Business Premium includes Microsoft Defender for Business, designed for businesses with up to 300 users. It's also sold standalone, for example to Business Basic or Standard customers. Its features include EDR, automated investigation and remediation, automatic attack disruption, next-generation protection and core vulnerability management. What it leaves out:
Expert hunting and long retention.
Microsoft Threat Experts, 30 days of advanced hunting and six months of data retention are listed under Defender for Endpoint Plan 2.
Servers.
Windows and Linux servers need extra licences, such as the Defender for Business servers add-on.
People.
It raises alerts and can contain some attacks itself, but nobody reads those alerts unless you arrange it.
More in is Microsoft Defender enough for business? and our Business Basic vs Standard vs Premium comparison.
Where does Key IT's 24/7 SOC service fit?
Every device Key IT manages runs EDR, as listed in our security stack. The MDR layer is Key IT's 24/7 SOC service, which is part of the same managed service as your day-to-day IT. It watches endpoints, Microsoft 365 sign-ins, email and network signals around the clock.
Escalations go to Key IT's security-certified engineers, who already know your environment and carry out the remediation and follow-up. Our helpdesk hours are Monday to Friday, 8am to 5pm; for managed clients, urgent after-hours problems go to on-call engineers on a rotating roster. Plans are month to month. Read more about 24/7 SOC monitoring, our wider managed cybersecurity service, or cyber security services in Melbourne.
Frequently asked questions
Do small businesses need MDR?
If you have EDR, someone needs to watch it, and MDR is usually the affordable way to arrange that. Attackers don't keep office hours, so an alert raised at 11pm on a Friday can sit unread until Monday. MDR puts analysts on those alerts around the clock, without you hiring a security team.
Is XDR worth it for a small business?
Usually, as a feature rather than a separate purchase. XDR's value is joining email, identity, device and cloud alerts into one incident, which matters most for Microsoft 365 businesses. Before buying a standalone XDR product someone would have to run, ask whether your platform or MDR provider already correlates those signals.
What is the difference between MDR and an MSSP?
An MSSP (managed security service provider) is a company selling security services; MDR is one specific service built on detection and response. Microsoft's MDR explainer says MSSPs generally don't actively respond to threats, but the labels overlap, so ask what happens after an alert. Our MSP vs MSSP guide covers the wider choice.
XDR vs SIEM: do we need both?
Most smaller businesses don't need both of their own. XDR brings ready-made correlation across one vendor's security products with little set-up. A SIEM takes logs from almost anything but needs rules, tuning and analysts before it's useful. A SOC may well use both behind the scenes.
Is a SIEM the same as a SOC?
No. A SIEM is software that collects and correlates logs; a SOC is the team that reviews what it surfaces, decides what's real and responds. A SIEM without analysts produces alerts nobody acts on. SIEM vs SOC is really tool versus people, and you need the people either way.
What should we ask a provider who says they include MDR?
Ask which signals are connected beyond endpoints, who watches overnight and on weekends, what analysts may do without calling you, and who carries out the fix. If your insurer has asked about EDR, our cyber insurance controls checklist lists the evidence to request.
More insights
Small business websites hacked: ASD 2026 warnings
Small business website hacked in Australia? ASD's 2026 alerts flag webshells planted via plugins…
Read article →CybersecurityIs Microsoft Defender enough?
Is Microsoft Defender enough for business? Compare Defender for Business vs Defender for Endpoint…
Read article →Microsoft 365Secure Boot certificate expiry
Secure Boot certificate expiry 2026: Windows Production PCA 2011 lapses on 19 October. What it…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.