Prevention and detection answer different questions. Antivirus asks whether this file is known to be malicious. Managed detection and response asks whether this behaviour makes sense. Most organisations buy the first, assume it covers the second, and find out otherwise during an incident.
Keep your antivirus. Add detection on top of it. Prevention is the cheaper control and stops most of what arrives; detection is what covers the intrusions that never involve a malicious file at all.
Endpoint protection compares what arrives against what is known to be bad: file signatures, behavioural patterns, reputation data, machine learning models trained on malware.
It is fast, it is cheap per endpoint, it runs without anyone watching, and it stops the overwhelming majority of commodity threats. Nothing here argues against it. Every organisation should run it.
The intrusions that matter most in practice do not involve a malicious file.
Stolen credentials. An attacker signs in with a valid password. There is no payload to inspect. From the endpoint's perspective, an authorised user is working.
Living off the land. PowerShell, Windows Management Instrumentation, PsExec, remote desktop. These are legitimate administrative tools, digitally signed by Microsoft, used by your own IT staff every week. Blocking them outright breaks the environment. The signal is not the tool but the context: which account, at what hour, reaching which systems.
Persistence. A scheduled task, a registry run key, a new local account, a service configured to start at boot. Individually unremarkable. Collectively, someone arranging to keep their access.
Dormancy. Access obtained in March and used in July. Nothing happens for months, so there is no event to correlate with the original compromise.
None of these are failures of your antivirus. They are outside what signature and behaviour-based prevention was designed to answer.
Detection assumes something will get through and asks what it does afterwards.
It watches process lineage, persistence mechanisms, account creation, privilege changes and lateral movement, and it builds a picture of what normal looks like in your environment so that abnormal stands out.
The managed part matters as much as the detection. A tool that generates alerts nobody reads is a tool that generates alerts nobody reads. In a two-person IT team, or a business with no IT team at all, a security console producing forty notifications a week will be ignored inside a month.
Managed detection means a human reviews what the software flags, discards the noise, and contacts you about the small number of things that genuinely need a decision.
Larger enterprises have security operations teams watching consoles. Smaller organisations do not, which is exactly why the tooling has to come with the watching attached.
There is also a targeting argument. Attackers pursue smaller organisations precisely because detection is unlikely. An intrusion that would be caught in a day at a bank can run for months at a fifty-person company, and dwell time is what turns a contained incident into a serious one.
Organisations tend to buy layer two and stop. Layer one is free and usually the weakest. Layer three is what shortens dwell time. Layer four is what determines whether you survive the worst case.
No. Detection is designed to run alongside prevention, not instead of it. Removing your antivirus to add detection would leave the commodity threats unaddressed.
Modern detection agents are lightweight, collecting telemetry rather than scanning files continuously. Users generally do not notice them.
With a managed service, very few — that is the point. The volume of raw signals is high and most of it is noise. You should hear only about what needs a decision from you.
You are notified with a description of what was observed and what is recommended. Some actions can be taken immediately if you have pre-authorised them, which is a decision worth making in advance rather than during an incident.
No. A SIEM aggregates logs from across your estate and needs tuning and staff to be useful. Endpoint detection is narrower and arrives with the monitoring included, which makes it a far better fit for an organisation without a security team.
Onprem2Cloud IT Solutions Co. is a Microsoft Cloud Solution Provider based in Muntinlupa City, serving businesses and government agencies across Metro Manila and beyond. We deploy and manage Huntress for endpoint detection and response, alongside the Microsoft 365 identity controls that determine how far an intrusion can travel.
Before adding detection, it is worth knowing what your identity configuration currently allows. See our cybersecurity services, or get in touch to discuss your environment.
Our latest news and trending topics