Firewall vs. Antivirus vs. EDR: What Is the Difference, and What Does a Small Business Need?
Businesses used to be told to buy two things: a firewall for the network and antivirus for the computers. Both are still necessary and neither is sufficient, because the attacks that actually hit small businesses now do not look like the viruses those products were built for. They look like a legitimate login from a stolen password, an invoice attachment that runs a script, or a program that is perfectly normal until it starts encrypting the file server. This article explains what a firewall, antivirus and endpoint detection and response (EDR) each do, what each one misses, and what a small business actually needs in 2026. We have folded in an older article about cloud-managed antivirus, because every serious product is cloud-managed now and the distinction no longer means anything.
The three layers, side by side
| Firewall | Antivirus | EDR | |
|---|---|---|---|
| Where it sits | At the edge of the network (and a software firewall on each computer) | On each computer and server | On each computer and server |
| What it looks at | Traffic in and out: addresses, ports, applications, known-bad sites and, if configured, the content of encrypted connections | Files and programs, compared against known malware and suspicious patterns | Everything a program does: processes, memory, files, network connections, credentials |
| What it stops | Unwanted inbound connections, access to malicious sites, traffic between network segments, attackers reaching servers from a compromised device | Known malware and much of the obvious variants before they run | Attacks in progress: ransomware encryption, credential theft, misuse of built-in tools, fileless attacks; can isolate the machine and roll back changes |
| What it misses | Anything that arrives through legitimate channels: email, a stolen password, a laptop infected at home | New or disguised malware, fileless attacks, misuse of legitimate tools, anything that is not a file | Nothing on its own is perfect; it misses what nobody responds to |
| Who watches it | Its logs, if they go anywhere | Nobody, usually | Should be a 24/7 managed detection service |
Firewalls: the moat
A firewall controls what crosses the boundary between your network and the internet, and between parts of your own network. A modern business firewall inspects the content of traffic, identifies applications, blocks known-bad destinations, runs intrusion prevention and separates staff, guests, cameras and equipment from one another. Every computer also has a software firewall, in Windows and macOS, which matters for laptops off the network. What a firewall cannot see is an attack that arrives as legitimate traffic: the phishing email, the stolen password used to log in normally, the laptop that was infected at a coffee shop and brought back inside. It also stops protecting anything when it is old or unpatched, which is the subject of our article on the dangers of an outdated firewall.
Antivirus: the guard who checks faces against a list
Antivirus compares files and programs against a list of known malware and a set of suspicious patterns, and blocks matches. It is still worth having, and Microsoft Defender Antivirus, built into Windows, does the job well for what it is. The limitation is structural: attackers test their tools against the same antivirus products before using them, and much of what they do now involves no malicious file at all. A phishing victim types their password into a fake page; the attacker logs in; PowerShell, a legitimate Windows tool, does the rest. Antivirus has nothing to match. Our guide to choosing antivirus for a business goes into the products.
EDR: watching behaviour, not files
Endpoint detection and response watches what programs do rather than what they are. A process that starts reading and rewriting thousands of files, a script that disables backups or shadow copies, a tool that pulls passwords out of memory, a login followed by unusual lateral movement: EDR recognises the behaviour, stops the process, can cut the computer off from the network in seconds, and on the better products rolls back the files that were changed. It also records the whole sequence, which is how anyone knows afterwards what happened and what to fix. We run SentinelOne on every client computer and server for this, per device, and our article on how to buy SentinelOne explains the tiers. Microsoft Defender for Business, included in Microsoft 365 Business Premium, is a genuine EDR product too, and our guide to what Business Premium includes covers it.
The fourth layer: a person
EDR generates alerts, and alerts at 3 a.m. that nobody reads are the same as no alerts. Managed detection and response (MDR) is a team watching around the clock, investigating what the software flags and taking action: isolating a machine, killing a session, calling you. For a small business with no security staff, this is the layer that turns the others into protection rather than evidence. We use Huntress behind SentinelOne for exactly this; the Huntress managed security page describes the arrangement, and our endpoint security guide shows the whole stack.
What a small business needs in 2026
- A supported business firewall with active subscriptions, separate networks for guests and equipment, and a VPN with multi-factor authentication or a zero-trust replacement.
- EDR on every computer and server, including the Macs, with antivirus as part of it.
- 24/7 managed detection behind the EDR.
- Multi-factor authentication on every account and Conditional Access on Microsoft 365, because the most common attack is a valid login with a stolen password; our MFA setup guide covers it.
- Email filtering that checks links and attachments, since that is where most attacks begin; see how to stop spam email.
- Backups that an attacker cannot reach, tested regularly.
Cyber-insurance applications now ask for each of these by name, which is a reasonable way to check your own list; the cyber insurance readiness check walks through the questions. All of it is part of our managed cybersecurity services, priced per device and per user in the pricing calculator.
Free tools from OAC Technology
- Cyber insurance readiness check: fourteen questions insurers ask, scored in a minute
- Phishing quiz: ten realistic emails, one at a time, with the tells explained
- Managed services pricing calculator: a monthly figure for managed IT, in about a minute
Common questions
Is Windows Defender enough?
The built-in Microsoft Defender Antivirus is a capable antivirus and far better than the free products of ten years ago. It is not endpoint detection and response, and nobody is watching it. For a business, either upgrade to Defender for Business, which is EDR, or run a product such as SentinelOne, and put a 24/7 managed detection service behind whichever you choose.
Do I need both a firewall and antivirus?
Yes. They protect different things. The firewall controls what enters and leaves the network; endpoint protection guards each computer, including the laptop at home and the phishing attachment that arrived through legitimate email. Neither covers the other’s job.
What is EDR?
Endpoint detection and response. Where antivirus asks whether a file matches known malware, EDR watches what programs actually do, such as encrypting files in bulk, disabling backups or dumping passwords from memory, and can stop the process, isolate the computer from the network and roll back the damage. It also records what happened, which is how an incident is understood afterwards.
What is the difference between EDR and MDR?
EDR is the software on the computer. MDR, managed detection and response, is people watching it around the clock and acting on what it finds. A small business without a security team needs both; EDR alerts that nobody reads at 3 a.m. are the same as no alerts.
Does a firewall stop ransomware?
Rarely on its own. Most ransomware arrives through email or a stolen password, both of which pass through the firewall as legitimate traffic. The firewall matters for blocking the attacker’s later connections and for separating parts of the network; EDR is what stops the encryption itself.
Do Macs need this?
Yes. Macs get malware and, more importantly, Macs get phishing and stolen passwords like anything else. Every EDR product we use supports macOS, and our article on whether Macs get viruses covers the details.
Talk to us
If you are not sure what is actually protecting your computers today, we will check every one of them and tell you, with a monthly price for putting the missing layers in place. Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.
