Blog · 6 min read
You bought EDR. You don't have MDR.
Why deployed tooling without 24/7 eyes on glass leaves the riskiest hours of the week uncovered, and what closing that gap requires.
By One Circle Solutions · Published
EDR (endpoint detection and response) is software: an agent that watches endpoints and raises alerts. MDR (managed detection and response) is an operation: people who investigate those alerts, decide what's real, and act — at 3 a.m. on a holiday weekend, not just during business hours.
The confusion matters because attackers know the difference. Ransomware crews deliberately detonate on Friday nights and holidays, precisely when a deployed-but-unwatched EDR console fills with alerts nobody reads until Monday.
What EDR alone gives you
- Telemetry and detections on covered endpoints
- Alerts — often hundreds per week, most benign
- Response capability that sits unused unless someone drives it
- A false sense of coverage that shows up in incident post-mortems
What turns EDR into MDR
- 24/7 human triage of every credible alert, with real accountability for time-to-triage
- Pre-agreed response authority: isolate the host, disable the account, revoke the session — without a phone tree
- Tuning, so detections improve instead of drowning the console
- Coverage beyond the endpoint: identity, email, and cloud signals correlated together
The honest self-test
Ask one question: if a credible alert fired at 2 a.m. Saturday, who would look at it, and when? If the answer is 'Monday' or 'whoever checks the console first,' you have EDR — and an uncovered window that includes the hours attackers prefer most.
Closing the gap means either staffing an around-the-clock rotation (typically five-plus analysts to cover 24/7/365 sustainably) or putting a managed operation on top of the tooling you already own. Either answer is respectable. Assuming the software covers the night shift is not.