EDR, XDR and MDR Software Licences | Software Licensing UK

In short: EDR (endpoint detection and response) records activity on devices so threats can be investigated and contained. XDR extends this across email, identity, network and cloud. MDR is a managed service in which the vendor's analysts watch your alerts 24/7 and respond for you. All three are usually licensed per device or per user on top of endpoint protection.

EDR, XDR and MDR explained

Prevention stops most attacks, but not all. Detection and response tools are designed for the ones that get through.

EDR (endpoint detection and response) continuously records what happens on each device: processes, network connections, file and registry changes. When something looks suspicious it raises a detection, shows the chain of events, and lets you isolate the device, kill processes or, with some products, roll changes back.
XDR (extended detection and response) takes the same approach across more data sources: email, identity, firewalls, cloud workloads and third-party tools. Correlating them makes it easier to see a whole attack rather than isolated alerts.
MDR (managed detection and response) is a service rather than software. The vendor's security operations centre monitors your EDR or XDR data around the clock, investigates alerts and takes agreed actions on your behalf, such as isolating a device or disabling an account.

Many UK organisations have no one available to watch alerts at night or at weekends, which is when attackers like to act. That is why MDR has become a common choice for small and mid-sized businesses.

EDR, XDR and MDR: vendors and products we supply

Acronis: Backup, disaster recovery, EDR, email security, RMM and protected servers on one platform.
Acronis EDR and XDR: Endpoint detection and response, extended to email, identity and Microsoft 365.
Acronis MDR: 24/7 monitoring and response on Acronis EDR or XDR, Standard or Advanced.
Bitdefender: GravityZone endpoint protection, EDR, email security, patching and encryption from one console.
Bitdefender GravityZone EDR: Incident correlation, attack visualisation and guided response, with XDR and MDR options.
Blackpoint Cyber: CompassOne platform with 24/7 endpoint MDR and identity ITDR from a human-led SOC.
Blackpoint Cyber CompassOne: Essentials, Core and Standard packages: MDR and ITDR plus posture, vulnerability and SIEM.
Blackpoint Cyber ITDR: 24/7 identity detection and response for Microsoft 365, Google Workspace and Cisco Duo.
Blackpoint Cyber MDR: 24/7 endpoint detection and active response, with Microsoft Defender integration.
Check Point: Endpoint, email, SASE, mobile, browser, WAF and MDR licences in one Check Point Portal tenant.
Check Point Harmony Endpoint: Endpoint protection, anti-ransomware and EDR in one agent, licensed per device.
Check Point MDR: 24/7 managed detection and response by Check Point analysts, per endpoint or user.
CrowdStrike: Falcon endpoint protection, managed threat hunting, Falcon Complete MDR, identity, SIEM and AI security.
CrowdStrike Falcon Complete Defend: Falcon endpoint protection with CrowdStrike's 24/7 managed detection, response and remediation.
CrowdStrike Falcon Defend: Next-gen antivirus, USB control and firewall management, with OverWatch threat hunting in Advanced Defend.
CrowdStrike Falcon Guardian: Shadow AI discovery, AI usage policy and protection for AI agents and prompts.
CrowdStrike Identity Threat Protection: ITDR for Active Directory and cloud identity, with risk-based MFA and a managed option.
CrowdStrike Next-Gen SIEM: AI-native SIEM on the Falcon platform with 365-day retention and a managed option.
Cynet: One-agent security platform with EDR, XDR, deception and 24x7 CyOps MDR, licensed per endpoint.
Cynet All-in-One platform: Protect, Elite and All-in-One packages compared, licensed per endpoint.
Cynet CyOps MDR: Cynet's 24x7 analyst team, included with Elite and All-in-One, plus Platinum Care.
Cynet SIEM: Log collection, search, correlation and long-term retention inside the Cynet console.
Exium: SASE, software firewall, XDR and identity on one platform, licensed per user.
Exium XDR360: SIEM, detection and response with 7 to 365 day retention.
Guardz: Managed identity, email, endpoint and awareness security for small businesses, with 24/7 MDR.
Guardz MDR: 24/7 detection and response for endpoints and identities, on Ultimate and Elite.
Lookout Mobile Endpoint Security: Essentials and Advanced mobile threat defence for iOS and Android, per device.
SentinelOne: Singularity endpoint, cloud and identity security with Purple AI and managed detection and response.
SentinelOne AI SIEM: Ingest and search third-party logs alongside SentinelOne data, per gigabyte.
SentinelOne Cloud Workload Security: Runtime protection for servers, VMs, containers and Kubernetes, per endpoint or host.
SentinelOne Hyperautomation: No-code security workflows that enrich, contain and notify automatically.
SentinelOne Purple AI: Agentic AI security analyst for plain-English investigation and alert triage.
SentinelOne RemoteOps: Remote scripts and automated forensic evidence collection at scale.
SentinelOne Singularity Endpoint: Control and Complete editions: AI prevention, rollback, device control and full EDR.
SentinelOne Singularity Identity: Identity posture, ITDR and deception for Active Directory, Entra ID and Okta.
SentinelOne Vigilance MDR: 24/7 managed detection and response from SentinelOne's own analysts.
SentinelOne Wayfinder Threat Hunting: Intelligence-led managed threat hunting by SentinelOne analysts.
Sophos: Endpoint, EDR, XDR, MDR, firewall, email and mobile security licences, managed in Sophos Central.
Sophos EDR: Endpoint plus detection, investigation and Live Response, without third-party data.
Sophos MDR: 24/7 managed detection and response in MDR and MDR Plus tiers, per user and server.
Sophos NDR: Passive network threat detection for unmanaged, IoT and OT devices, licensed on users and servers.
Sophos XDR: EDR plus third-party data, correlation and an AI Assistant, per user and server.
ThreatDown: Malwarebytes business security: endpoint protection, EDR, MDR, patching and more, billed monthly.
ThreatDown EDR: Detection and response with isolation and ransomware rollback, per endpoint, monthly.
ThreatDown ITDR: Detect and stop identity attacks on Active Directory, Entra ID and Okta, per user.
ThreatDown MDR: 24/7 monitoring and response by ThreatDown analysts, or managed threat hunting, monthly.
Todyl: Modular SASE, EDR, SIEM, 24/7 MXDR and GRC on one agent, billed monthly per device.
Todyl Endpoint Security: EDR and NGAV in one agent, with isolation, quarantine and ATT&CK mapping.
Todyl MXDR: 24/7 managed detection and response across endpoints, network and identities.
Todyl Security Automation: SOAR playbooks for Microsoft 365 and endpoint threats, licensed per tenant.
Todyl SIEM: Cloud-managed SIEM with retention from 7 days to 5 years, licensed per device.
Trend Micro: TrendAI Vision One endpoint, email, XDR and ZTSA, plus Worry-Free for smaller businesses.
Trend Micro Endpoint Security: Core, Essentials and Pro endpoint and server protection, with EDR included from Essentials.
Trend Micro Threat Intelligence: Threat Insights, intelligence feeds and cloud sandbox analysis for Vision One.
Trend Micro Vision One platform: The platform and TrendAI Flex licensing model behind every Vision One solution.
Trend Micro Worry-Free: Per-user endpoint, email and XDR suites for small businesses, up to Co-Managed XDR.
Trend Micro XDR and Security Operations: XDR sensors, Agentic SIEM and SOAR, data ingestion, retention and forensics in Vision One.
WatchGuard: Firebox firewalls, endpoint security, MDR, AuthPoint MFA and FireCloud SASE.
WatchGuard CloudDR: Identity threats, misconfigurations and shadow AI across SaaS apps, per identity.
WatchGuard Endpoint Security: Endpoint protection and EDR per endpoint: Basic, Prime, 360 and Elite.
WatchGuard MDR: 24/7 managed detection and response: Core, Core for Microsoft, Total and Open MDR.
WatchGuard NDR: Network detection and response: NDR for Firebox, WatchGuard NDR and Total NDR.

What to look for

Response options: device isolation, process termination, remediation and rollback
Data retention: how long telemetry is kept for investigation, and whether longer retention costs extra
Integrations for XDR: Microsoft 365, Google Workspace, identity providers, firewalls and cloud platforms
For MDR: whether the service can act on your behalf or only notify you, response times in the service description, how incidents are reported, and whether incident response for a confirmed breach is included or chargeable
Fit with your endpoint protection: most EDR is an upgrade to the same agent, so changing EDR usually means changing endpoint protection too

How detection and response is licensed

EDR and XDR are normally sold as higher editions of an endpoint product, licensed per device or per user, with servers priced separately. MDR is usually a further tier or add-on, again per device or user, sometimes with options for different levels of service (for example, notify-only versus full response). Some vendors charge for extra data retention or for each additional data source connected to XDR.

Because MDR is a commitment, annual terms are common, although some vendors offer monthly billing. We will set out the options side by side when you ask us for a quote.

How to choose

Be honest about resources: if no one can investigate alerts quickly, at any hour, choose MDR or keep to strong prevention.
Decide on scope: endpoints only, or email, identity and cloud too (XDR).
Read the service description for any MDR offer: who acts, how fast, and what counts as an incident.
Check insurance requirements: many UK cyber insurers ask whether you have EDR or MDR in place.
Pilot it: watch what a normal week of detections looks like before rolling out.

Examples include Sophos XDR and Sophos MDR, SentinelOne Singularity with its MDR service, CrowdStrike Falcon Insight and Falcon Complete, Bitdefender GravityZone EDR and MDR, ThreatDown EDR and MDR, and TrendAI Vision One from Trend Micro. See our specialist pages on Sophos MDR and Cisco XDR.

How we help

We help you decide between self-managed EDR and a managed service, compare service descriptions on equal terms, and plan the roll-out so detections are tuned before you rely on them. Contact us and we will put together a quote for the options that fit your team.

How Forever Systems supplies your software licences

Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.

The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
Deployment and support from engineers who run these products every day, not just a reseller account
Consolidated billing and renewal reminders so nothing lapses unexpectedly

We work with businesses, schools, charities and public sector organisations of all sizes.

Need a licence quote or a second opinion on your renewal?

Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.

Frequently asked questions

What is the difference between EDR and MDR?

EDR is software that detects and helps you respond to threats on devices. MDR is a 24/7 service in which a vendor's analysts watch that software for you and respond to incidents.

Is XDR better than EDR?

XDR covers more sources (email, identity, network, cloud) so it can show the full picture of an attack. It is most useful if you have several of those tools and someone, or a managed service, to act on what it finds.

Does MDR replace my IT support company?

No. MDR handles security detection and response. Your IT team or provider still manages devices, users and fixes. The two should agree who does what during an incident.

Do I need EDR for Cyber Essentials?

No. Cyber Essentials requires malware protection, which standard endpoint protection meets. EDR and MDR go beyond the scheme's minimum.

Security softwareEndpoint, email, identity, network and people security subscriptions.Endpoint protectionNext-generation antivirus for laptops, desktops and servers.Anti-ransomwareStop ransomware encrypting files, and recover if it does.Email securityStop phishing, malware and impersonation in Microsoft 365 and Google Workspace.DMARC and email authenticationGet SPF, DKIM and DMARC to enforcement and stop domain spoofing.Email encryptionSend sensitive information securely from Microsoft 365 or Google Workspace.Password managersEncrypted vaults, safe sharing and central control for passwords.Identity, MFA and privileged accessMFA, single sign-on and control of admin rights.SASE, ZTNA and business VPNSecure access to apps and the internet for hybrid teams.

EDR, XDR and MDR