EDR, XDR, and MDR sit on different axes of the same market. EDR and XDR are platforms; MDR is a service. EDR is a scope subset of XDR; MDR is an operational layer that wraps around either. Understanding how they relate (rather than treating them as three alternatives) is the first step to getting the stack right.
Side-by-side comparison
| EDR | XDR | MDR | |
|---|---|---|---|
| Category | Platform | Platform | Service |
| Scope | Endpoints only | Endpoint + email + identity + cloud + network + app | Whatever the underlying platform covers |
| Detection approach | Endpoint-only correlation | Cross-layer correlation into incidents | Human analyst review of platform-generated alerts |
| Response capability | Endpoint isolation, remediation | Native response across telemetry sources | Human-led response with delegated authority |
| Typical price range | $3 – $15 / endpoint / mo | $6 – $18 / endpoint / mo | $15 – $35 / endpoint / mo |
| Pricing axis | Per endpoint | Per endpoint + per user + per workload + per GB | Per endpoint (service fee) |
| Best-fit buyer | Small-mid endpoint-centric environments with existing email, identity tooling | Mid-large organisations consolidating four or more overlapping tools | Organisations without 24/7 internal SOC coverage |
The decision tree
The right stack depends on three questions. First, is the organisation’s security scope endpoints-only, or does it extend to cloud, email, and identity? Second, does the organisation already run four or more overlapping tools that could be consolidated? Third, does the organisation operate a twenty-four-seven internal SOC?
- Endpoints-only scope + no 24/7 SOC: EDR + MDR. Typical small-to-mid shop with a focused threat model.
- Endpoints-only scope + 24/7 SOC: EDR only. Rare but valid for mature teams with tight scope.
- Cross-layer scope + no 24/7 SOC + 4+ point tools: XDR + MDR. The most common mid-market pattern.
- Cross-layer scope + 24/7 SOC + 4+ point tools: XDR only. Most enterprises with mature internal SOCs.
- Cross-layer scope + regulated industry: XDR plus SIEM, with or without MDR. Regulated shops almost always keep SIEM for compliance retention alongside XDR.
Worked example: 1,000-endpoint mid-market shop
A hypothetical thousand-endpoint organisation with seven hundred users and eighty cloud workloads, currently running separate EDR, email security, cloud workload protection, and identity threat detection tools. Three scenarios at illustrative market rates:
| EDR licensing | 1,000 × $8 × 12 = $96,000 |
| Internal SOC | 5 FTE × $150K = $750,000 |
| Adjacent tools (email, cloud, identity) | ~$100,000 |
| Annual total | ~$946,000 |
| EDR licensing | 1,000 × $8 × 12 = $96,000 |
| MDR service | 1,000 × $25 × 12 = $300,000 |
| Adjacent tools (email, cloud, identity) | ~$100,000 |
| Annual total | ~$496,000 |
| XDR platform | 1,000 × $12 × 12 = $144,000 |
| Per-workload add-on | 80 × $5 × 12 = $4,800 |
| MDR service | 1,000 × $25 × 12 = $300,000 |
| Ingestion & retention | ~$45,000 |
| Annual total | ~$494,000 |
How the three categories stack together
EDR to XDR is replacement. The XDR platform includes EDR functionality as its endpoint telemetry source; running both adds cost without adding capability. The migration path is retire-EDR-adopt-XDR, sometimes with a transition period where both coexist under contract overlap.
XDR plus MDR is layered. The XDR platform is the telemetry substrate; the MDR service is the analyst layer that operates on it. Many organisations run this stack. Platform choice and service choice are separate decisions, and platform-agnostic MDR preserves flexibility.
EDR plus MDR is also valid, especially for endpoint-focused organisations that do not need cross-layer telemetry. Many MDR providers operate equally well on EDR or XDR; the category they serve is defined by the customer’s scope, not the MDR itself.