Antivirus is one of those things most practices set up once and never think about again. But the technology has moved on a lot, and if your protection is still just plain antivirus, there is now a meaningfully better option worth aiming for. This is a plain-English guide to the ladder from the free built-in tool up to EDR and MDR, and where we think most practices should be standing on it.
None of this is about frightening anyone. Your current antivirus is probably doing a decent job. The point is that "decent" is no longer the top of the range, and the step up is more affordable and more reassuring than people expect.
The bottom rung: free built-in Defender
Every Windows machine comes with Microsoft Defender built in, for free, and honestly it is a competent antivirus engine. It catches a lot. So why do we not just leave practices on it?
Because for a business, catching things quietly on each machine is only half the job. The problem with the free version is that there is no cloud management and no central alerting. Each machine deals with whatever lands on it in isolation, and nobody is watching across the whole practice. If a threat is caught on one reception PC, we do not hear about it. If the same nasty thing turns up on three machines in a week, we cannot see the pattern. We are, in effect, clueless about what is actually happening on your estate.
That visibility is the whole point of managed antivirus, and it is why any managed product is a real step up from the free tool, regardless of the clever features layered on top.
The solid baseline: managed antivirus (ESC)
The sensible baseline is a proper managed, commercial antivirus on every machine, which for us is ESC. Under the bonnet it works mainly by signature matching: it holds a constantly updated list of known bad files and blocks anything that matches. That sounds old-fashioned, and people sometimes dismiss it, but it genuinely still works for the large majority of real-world threats, because most of what actually arrives is known malware that has been seen before.
The difference from the free tool is not just the engine, it is the management. It is centrally controlled, always on, always updated, and it reports back, so we can see detections across every site, spot patterns, and act. That central view is exactly what produces the kind of live picture we shared in our piece on the threats hitting practices every single day.
For many practices, well-managed signature-based antivirus is a perfectly respectable place to be. But it has one blind spot, and that is where the next step comes in.
The step up: EDR
The weakness of pure signature matching is that it recognises known bad files. It is less good at brand-new threats it has never seen, or at attacks that do not look like a "file" at all.
EDR, which stands for endpoint detection and response, fills that gap. Instead of only asking "is this a known bad file?", it watches how the machine actually behaves. A normal-looking process that suddenly starts encrypting hundreds of files, or trying to spread across the network, or quietly disabling defences, gets caught on its behaviour even if the file itself has never been seen before. That is exactly the profile of a modern ransomware attack, and it is the sort of thing signatures alone can miss.
So EDR does not replace the baseline, it strengthens it. You keep the fast, reliable blocking of known threats, and you add a layer that can spot the unknown ones by what they do. For a practice holding sensitive data, that extra reassurance is well worth having, and it is why EDR is increasingly the level we suggest people aim for rather than stopping at basic antivirus. It sits naturally alongside the other layers we recommend, like locking down local admin rights.
The top rung: MDR
EDR is powerful, but it still raises alerts that somebody needs to read, understand, and act on. On a busy practice, an alert that fires at two in the morning is not much use if nobody sees it until Monday.
That is what MDR, managed detection and response, adds. It puts a real, staffed security team behind the software, watching those signals around the clock, somewhere in the world, every hour of every day. When something genuinely suspicious happens, trained people investigate it, decide whether it is real, and respond, isolating a machine or shutting an attack down, rather than leaving a warning blinking on a screen nobody is looking at.
For most small businesses, having your own 24/7 security operations team would be unthinkable. MDR is how you effectively rent one, shared across many organisations, at a cost that makes sense. It is the strongest tier, and for practices that take this seriously, it is the one we would point you towards.
Where should your practice aim?
Here is the honest summary. Free Defender is better than nothing but leaves you blind. Managed antivirus fixes the visibility and handles most real threats. EDR adds behaviour-based detection for the newer, sneakier attacks. MDR puts human specialists on watch around the clock.
A few years ago, solid managed antivirus was the sensible target for a dental practice. Today, with attacks more automated and ransomware the real fear, we think most practices should be aiming for EDR as the standard, and seriously considering MDR. The cost gap is smaller than people imagine, and it buys a genuinely different level of reassurance. It is one layer of the wider approach we set out in our guide to cybersecurity for smaller businesses.
If you are not sure what you are actually running right now, whether it is the free tool, unmanaged, or something properly managed, that alone is worth finding out. Get in touch and we will tell you plainly where you stand and what the step up would look like for your practice. No jargon, no scare tactics.