thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Security Operations

EDR vs XDR vs MDR: What's the Difference?

EDR is a technology that monitors and responds to threats on endpoints, XDR extends detection and response across endpoints, network, email, identity, and cloud in one correlated platform, and MDR is a managed service where an outside team runs detection and response for you.

EDRXDRMDR
What it isTechnology (endpoint agent)Technology (integrated platform)Service
CoverageEndpoints onlyEndpoints, network, email, identity, cloudWhatever tools the provider operates
Who operates itYour teamYour teamThird-party analysts, 24x7
Key strengthDeep endpoint telemetry, isolation, rollbackCross-domain correlation, fewer silosExpertise without building a SOC
ExamplesCrowdStrike Falcon Insight, Defender for EndpointCortex XDR, Microsoft Defender XDRCrowdStrike Falcon Complete, Arctic Wolf
Remember it

EDR watches endpoints, XDR watches everything, MDR is people watching for you.

Exam tip

A small organization with no SOC staff that needs 24x7 monitoring should choose MDR. If the question emphasizes correlating telemetry across multiple security layers, choose XDR.

Tested on

More Security Operations look-alikes