Antivirus isn't enough: EDR for SMEs — what to buy and how not to overpay

Classic antivirus was a great 2010 solution. Ransomware, lateral movement and PowerShell-based attacks aren't new either — but a typical antivirus doesn't see them. What does see them is called EDR. And these days it doesn't cost a fortune.

The repeating pattern looks like this. A small company buys a multi-year licence of a popular antivirus, installs it on every machine, and considers "endpoint security" done. Three years later, an incident hits — ransomware, data theft, or just servers slowing to a crawl. The antivirus "didn't show anything". Because it only looks at files: it compares a hash against its signature database and checks whether it sits in the catalogue of known threats. Modern attacks don't use files that way — they use legitimate Windows tools (PowerShell, WMI, scheduled tasks) for illegitimate purposes. The antivirus sees "PowerShell is running a script" and shrugs.

How EDR differs from antivirus

EDR stands for Endpoint Detection and Response. In short: instead of comparing files to a list of threats, EDR watches what is happening on the endpoint in real time and catches behavioural patterns. A coinminer hiding under the name svchost.exe is detected by its CPU usage and network pattern. PowerShell launched by Office is flagged because it's anomalous. An attempt to encrypt 5,000 files within a minute is caught because that's ransomware, regardless of which executable started it.

The second thing: response. EDR can cut the endpoint off the network, freeze the process, roll back changes. Antivirus, in the best case, deletes the detected file. It's the difference between a smoke alarm and a smoke alarm plus the location of the fire plus automatic fire-door closure.

For an SME, the point is not to have an "enterprise-grade SOC". The point is that someone (or something) sees that something is off — before a customer rings asking why the website is down.

What EDR catches that antivirus doesn't

• Fileless attacks. A script executed in memory, with nothing written to disk. Antivirus can't see it; EDR can.
• Lateral movement. Machine A logs into machine B, then C, then jumps to the server. Every step is "legitimate" but the pattern is suspicious.
• Living-off-the-land. The attacker uses built-in Windows tooling (PowerShell, certutil, bitsadmin). Antivirus doesn't block these because they're normal system programs.
• Ransomware mid-encryption. EDR notices mass file operations and can interrupt them after the first few hundred files. Antivirus sees this only after the fact — too late.
• Account compromise. A login to the same workstation from two geolocations within 5 minutes. EDR raises an alert.

What to buy — without the bloat

For a 10–50 person company you do NOT need an enterprise SOC or an expensive SIEM platform. You need an EDR with a console that one competent person — internal or external — can look at.

The practical options we most often see at SME clients:

• Microsoft Defender for Business — if you already have Microsoft 365 Business Premium, it's included. It integrates with the rest of the M365 stack and is usually enough for a typical office-based SME.
• Bitdefender GravityZone Business Security Premium — works well when M365 isn't your "source of truth" and the fleet is mixed (Windows + macOS + Linux servers).
• ESET PROTECT Entry / Advanced — a natural continuation for companies that have been using ESET for years, now with EDR features in the higher tiers.
• SentinelOne or CrowdStrike Falcon Go — more premium, makes sense once the company has its own IT person and wants stronger automation.

The price? Realistically 6–20 EUR per endpoint per month depending on tier. So for 30 endpoints, roughly 250–600 EUR per month. Less than a single day of ransomware downtime.

A concrete example from our practice

One of our clients — a 32-person distribution company in industrial parts, with 35 endpoints and a Comarch Optima ERP server in the office — before the rollout had a classic signature-based antivirus at 89 PLN per endpoint per year. Everything "worked", the admin panel showed all green icons.

As part of an IT audit we proposed a migration to Microsoft Defender for Business (they already had M365 Business Standard; moving to Business Premium cost an additional ~22 PLN per user per month). Total extra cost: about 700 PLN per month over what they were paying before.

What happened in the first 4 months after rollout:

• Twice, PowerShell scripts launched by macros in Excel attachments were detected and automatically blocked (the classic opening move of a phishing attack). The old antivirus had let them through because the .xlsm file itself was "clean".
• Once, an attempted coinminer installation was caught on the laptop of a salesperson who had installed a "free PDF converter". Without EDR, they would have noticed the laptop slowing down a fortnight later — or possibly never.
• Five times, the system flagged sign-ins from unusual locations (mostly travelling staff — false positives, but they required a 2-minute confirmation).

The value hardest to quantify: had the first incident succeeded, ransomware could have encrypted the Comarch Optima data and the commercial document store. Estimated cost of a 5-day outage plus data recovery for this firm: 80,000–150,000 PLN. Annual cost of EDR: 8,400 PLN.

What not to do

• Don't buy EDR and leave it unattended. EDR generates alerts. If no one reads them, they are useless. Either your internal IT person spends 20–30 minutes a day on the console, or you also buy MDR (Managed Detection and Response) — typically +50–70% on top of the licence price.
• Don't believe the "self-healing AI" slide copy. Yes, EDR recognises patterns. No, it won't stop 100% of attacks. Real detection rates are 90–98% — much better than antivirus, but no excuse to drop other layers (backup, MFA, network segmentation).
• Don't buy "free" solutions with strange licensing. If a company sells EDR for 50 PLN per endpoint per year, it makes its money somewhere else — usually on your staff's telemetry data.
• Don't leave the old antivirus running "alongside" EDR. Two solutions on one machine conflict, slow the system down and blind each other's telemetry.

How to start

1. Check what you have today — if it's a classic signature antivirus, it isn't ready for 2026.
2. Check what you already have in Microsoft 365 — Defender for Business in Business Premium is often enough, and you've been paying for it for a while.
3. Run a quick endpoint inventory — how many machines you have, whose, what's on them.
4. Decide who will read the alerts. Without that, points 1–3 are wasted effort.

If you don't know where to start, or you have a suspicion that your current antivirus is suspiciously cheap — let's talk. The first conversation is free and takes half an hour.

EDR isn't "next-generation antivirus". It's a different tool — and if you fear ransomware, it's now the minimum, not a luxury.

← Back to blog