Ask ten practice administrators whether their computers are protected and ten will say yes, we have antivirus. Ask what kind, and the answer is usually whichever product came with the computers or whatever the last IT company installed. That answer worked in 2015. It does not describe how practices are actually attacked today, and it is now the wrong answer on your cyber insurance application.
This article explains the difference in plain language: what traditional antivirus does, what EDR does differently, where NGAV and MDR fit, why the distinction matters more in healthcare than almost anywhere else, and what it costs to get right.
What traditional antivirus actually does
Classic antivirus is a bouncer with a photo book. It scans files against a database of known malware signatures, and when a file matches a photo, it blocks it. Vendors push updated photo books daily.
That model catches commodity malware: the mass-mailed trojans and drive-by downloads that have been circulating for years. It fails in three predictable ways.
First, it only recognizes what has already been catalogued. New malware variants are generated constantly, and a signature written tomorrow does not stop an attack today.
Second, it looks at files, not behavior. Modern attacks often use no malicious file at all. An attacker with a stolen password logs in through remote access, uses the legitimate tools already on the machine (PowerShell, remote management software, built-in Windows utilities), and never triggers a signature because nothing on the photo book list ever touches the disk.
Third, it has no memory. When something does go wrong, antivirus can tell you it blocked or missed a file. It cannot tell you where the attacker came from, what they touched, which accounts they used, or whether they are still inside. After an incident, those are the only questions that matter.
What EDR does differently
EDR stands for endpoint detection and response, and both halves of the name are the point.
Detection. An EDR agent continuously records what happens on the machine: every process that starts, what started it, what it connects to, what it changes. Instead of matching files to photos, it evaluates chains of behavior. A Word document spawning PowerShell, which disables shadow copies, which starts encrypting files at high speed, matches no signature, but it is unmistakably ransomware behavior, and EDR flags or blocks it at step one or two rather than after the encryption finishes.
Response. When something is flagged, EDR gives a responder tools antivirus never had: isolate the machine from the network with one click while leaving it powered on for forensics, kill the process tree, quarantine files, roll back changes on platforms that support it, and search every other endpoint in the practice for the same indicators. The recorded timeline answers the after-incident questions: how they got in, what they touched, and whether patient data left.
That timeline is not a luxury. In a HIPAA breach risk assessment, the difference between "we can show exactly which systems were accessed" and "we have no way to know" is often the difference between a documented, contained incident and a full notification event.
Where NGAV and MDR fit
Two more acronyms show up on quotes and insurance forms, and they are worth thirty seconds each.
NGAV (next-generation antivirus) is the modern prevention layer: instead of signatures alone, it uses machine learning models and behavior rules to block malicious code at the moment it tries to run, including variants nobody has catalogued. Nearly every serious endpoint product today bundles NGAV and EDR in a single agent, so in practice you buy them together. If a vendor is selling you "next-gen antivirus" without the detection and response half, ask why.
MDR (managed detection and response) is people. EDR generates alerts, and alerts at 2 a.m. on a Saturday are only useful if someone qualified sees them and acts within minutes. MDR is a security operations team watching the console around the clock. No independent practice should staff that internally; it is what you get bundled when a healthcare-focused MSP runs your security.
A useful way to hold all four terms: antivirus is the old photo book, NGAV is the smarter bouncer, EDR is the camera system and the ability to lock doors, MDR is the guards watching the cameras.
| Traditional antivirus | NGAV | EDR | EDR + MDR | |
|---|---|---|---|---|
| Blocks known malware | Yes | Yes | Yes | Yes |
| Blocks new, unseen malware | Rarely | Often | Often | Often |
| Detects fileless and stolen-credential attacks | No | Partially | Yes | Yes |
| Records what happened for forensics | No | No | Yes | Yes |
| One-click isolation and rollback | No | No | Yes | Yes |
| Someone watching at 2 a.m. | No | No | Only if you staff it | Yes |
| Satisfies current cyber insurance questions | Increasingly no | Sometimes | Usually | Yes |
Why this matters more in healthcare
Every business faces these attacks. Three things make the stakes higher in a medical practice.
The data is worth more and the downtime hurts more. Patient records sell for multiples of a credit card number, and a practice that cannot reach its EMR cannot see patients. Attackers know both, which is why healthcare consistently ranks as the most targeted sector in ransomware reporting and why ransomware targets medical practices specifically.
HIPAA judges you on your risk analysis. The Security Rule does not name products, but it requires safeguards that address your actual risks. Given how healthcare attacks work in 2026, an antivirus-only defense is hard to defend in a current HIPAA security risk assessment, and after an incident, OCR will read that assessment closely. EDR's recorded timeline is also what lets counsel argue a low probability of compromise instead of guessing.
Your insurer already decided. Cyber insurance applications now ask, by name, whether you run EDR on all endpoints and whether it is monitored 24/7. Answering no means higher premiums, exclusions, or a declined application. Answering yes inaccurately is worse: a claim investigated after an incident that finds the control was not actually in place is a denial. Our article on cyber insurance requirements for healthcare walks through the full questionnaire.
EDR is only as good as who is watching it
The most common EDR failure we see is not the product. It is the deployment. A practice buys a respected EDR platform, the previous IT company installs it on most of the machines, and the alerts go to an inbox nobody reads. Eighteen months later the imaging workstation was never enrolled, the alert that mattered fired on a Friday night, and the response started Monday morning, three days into the encryption.
Deployed correctly, EDR means every endpoint enrolled, including the server, the laptops that travel, and the workstations attached to imaging and lab devices where the vendor permits an agent (and documented compensating controls where they do not); alerts routed to a 24/7 monitored console with an escalation path measured in minutes; isolation authority agreed in advance so a responder can cut off a machine at 2 a.m. without waking the practice owner; and the whole arrangement written into your risk analysis and your insurance application accurately.
What it costs, and what it replaces
EDR software typically runs a few dollars to around fifteen dollars per endpoint per month, with monitoring on top. For a 25-endpoint practice, that is a rounding error against one day of EMR downtime, which we price out in what IT downtime costs a medical practice, and it is usually less than the premium increase carriers apply to antivirus-only practices.
In a managed arrangement like Galleon's, EDR and the 24/7 monitoring are part of the flat monthly rate, not an add-on. That is worth checking in any quote you compare: a low per-user price that lists "antivirus" in the stack is not the same service as one that includes monitored EDR, and the gap shows up exactly once, on the worst day.
Questions to ask your current IT provider
- Is EDR deployed on every endpoint, including servers, laptops, and device workstations? Can I see the enrollment count against our asset list?
- Who watches the alerts, at what hours, and what is the escalation time in minutes?
- Has isolation authority been agreed in writing, so a compromised machine can be cut off immediately?
- When was the last EDR alert, and what happened next?
- Does what we tell our cyber insurer match what is actually deployed?
If those answers come fast and specific, you are in good shape. If they come with a pause, that pause is the finding.
Frequently asked questions
Antivirus scans files against a list of known malware signatures and blocks matches. EDR (endpoint detection and response) continuously records what is happening on the machine, processes, connections, and changes, detects suspicious behavior even from never-before-seen tools, and lets a responder isolate the machine and roll back damage.
NGAV (next-generation antivirus) is the prevention layer: it uses machine learning and behavior rules to block malware, including new variants, at the moment of execution. EDR is the detection and response layer: it records activity, surfaces suspicious chains of behavior, and gives a responder the tools to investigate and contain. Modern products bundle both in one agent.
Yes. Attackers target small practices precisely because they expect antivirus-only defenses, patient records are valuable, and downtime pressure makes victims pay. HIPAA's risk analysis expects safeguards proportional to that risk, and most cyber insurance carriers now ask for EDR by name on the application.
HIPAA does not name products. It requires safeguards that address the risks you identified in your security risk analysis. Given how ransomware actually operates in healthcare, it is difficult to defend an antivirus-only posture in a current risk analysis, and OCR investigators and cyber insurers evaluate it that way.
Typically a few dollars to around fifteen dollars per endpoint per month for the software, more with 24/7 monitoring (MDR) included. In a managed IT agreement like Galleon's, EDR and the monitoring are part of the flat monthly rate rather than a separate line item.
MDR (managed detection and response) is a team of analysts watching the EDR alerts around the clock and acting on them. EDR without someone watching it is a smoke detector with nobody home. Small practices should not staff this themselves; it comes bundled with a healthcare-focused managed IT service.
Where this connects to what we do.
Managed EDR with 24/7 monitoring is part of the standard stack in our managed cybersecurity service for every practice we support across DFW and Houston, and it feeds the evidence file our regulatory compliance work maintains. If you are not sure what is actually running on your endpoints today, the free IT risk assessment is a three-minute place to start.
Ready for a straight answer about your IT? Call (972) 776-6366 or contact us.