Most small businesses probably have antivirus, even if it’s just Windows Defender that comes preinstalled.
Having antivirus is a good thing, but it can also create a false sense of security. It is an important layer, but it is not the same as having someone watching for suspicious behaviour, checking alerts, investigating threats and helping stop an attack before it turns into a full-blown incident.
That is where MDR, MXDR, EDR and ITDR come in.
Yes, the cyber industry does love an acronym, but behind the jargon is a simple idea:
It is no longer enough to hope a tool blocks every threat. You need to know when something suspicious is happening and have someone ready to respond.
For many small UK businesses, schools, charities and care providers, that is the missing piece.
The problem with “we’ve got antivirus”
Traditional antivirus is designed to spot known bad files. That’s still important – if a malicious file has been seen before, antivirus may be able to detect it, block it and remove it. Many modern attacks do not start with an obvious virus, they start with a stolen password. A fake Microsoft 365 login page. A phishing email that looks convincing. A staff member approving an MFA prompt they did not request. A remote access tool being installed under false pretences. A malicious inbox rule quietly forwarding emails. An attacker logging in as a real user.
In those cases, there may be no obvious virus for traditional antivirus to catch.
The 2025/26 UK Government Cyber Security Breaches Survey found that phishing remained the most common type of breach or attack, affecting 38% of businesses and 25% of charities. It was also the most disruptive type of breach or attack for 69% of affected organisations.
That matters because phishing is often not about “infecting a computer” in the old-fashioned sense.
It is about stealing access.
Once an attacker has access, they may not rush.
They may sit quietly.
They may read emails.
They may look for invoices.
They may create forwarding rules.
They may try to access files.
They may wait for the right payment conversation.
They may move from one system to another.
Antivirus is not designed to understand all of that context on its own.
What MDR actually means
MDR stands for Managed Detection and Response.
In plain English, it means: security software plus people watching it.
A tool may detect suspicious behaviour, but someone still needs to look at the alert, decide whether it is genuine, understand the risk and take action.
For a small business, that is difficult.
You probably do not have a security operations centre.
You probably do not have someone watching alerts at 2am.
You probably do not have an in-house cyber analyst who can tell the difference between normal admin activity and an attacker preparing for ransomware.
MDR helps close that gap. It gives small organisations access to security monitoring and response without having to build an internal cyber team.
Why MXDR is worth considering
MXDR stands for Managed Extended Detection and Response.
That sounds more complicated than it needs to.
The simple version is this: MXDR looks beyond a single device and gives broader managed detection and response across more of your environment.
That may include endpoints, servers, identity, email, network activity and other security signals, depending on the service.
Heimdal MXDR is a good example of this approach – it’s a 24×7 fully managed service with SOC event monitoring, threat investigation, threat hunting, forensics and incident response to help contain and neutralise attacks.
For a small business, that broader view can be valuable, because attacks rarely stay in one place.
A phishing email may lead to a stolen Microsoft 365 login.
That may lead to mailbox access.
That may lead to invoice fraud.
That may lead to further password resets.
That may lead to files being accessed.
That may lead to ransomware.
If each system is looked at in isolation, important clues can be missed.
MXDR helps join the dots.
Where Huntress EDR fits
EDR stands for Endpoint Detection and Response.
An endpoint is usually a laptop, desktop or server.
Huntress Managed EDR is designed to detect, investigate and respond to threats that get past automated defences such as antivirus. Huntress describes its Managed EDR as including endpoint telemetry, threat expertise, continuous detection, response and remediation backed by a 24/7 SOC.
That makes it useful for small businesses that want more than basic antivirus but do not have the time, knowledge or staff to monitor an EDR platform themselves.
This is the key point: EDR without monitoring can become another dashboard nobody has time to check.
Huntress EDR helps because the monitoring is managed.
The aim is not to drown you in alerts.
The aim is to find the things that matter and respond when something looks genuinely suspicious.
For small organisations, that matters.
Because you do not need more noise.
You need clarity.
Why identity protection matters just as much
Many attacks now target identity rather than devices. That means user accounts.
Microsoft 365 accounts. Google Workspace accounts. Admin accounts. Email accounts. Cloud accounts.
This is why ITDR matters. ITDR stands for Identity Threat Detection and Response.
Again, the plain English version is better: ITDR watches for suspicious behaviour around user accounts.
Huntress Managed ITDR provides 24/7 identity monitoring and response, including coverage for platforms such as Microsoft 365. Huntress says it helps detect and respond to identity threats such as account takeovers, business email compromise and unauthorised logins.
This is especially relevant for small UK businesses because email is often the centre of everything.
Quotes. Invoices. Supplier conversations. Customer information. Password resets. File sharing. Bank details.
If an attacker gets into a mailbox, they may not need malware at all.
They can cause damage just by reading, forwarding, replying and impersonating.
That is why endpoint security alone is not enough.
You need to protect the device and the identity.
Business email compromise is the quiet risk
Business email compromise does not always look dramatic.
There may be no ransom note.
No flashing warning.
No encrypted files.
No obvious malware.
Instead, someone gets into an email account and waits.
They watch how you speak to customers.
They learn who pays invoices.
They spot when money is due.
Then they send a convincing message at the right time.
By the time anyone notices, the money may already have moved.
That is why relying only on antivirus is risky.
Antivirus may be doing its job perfectly.
But there may be no virus to find.
This is where Huntress ITDR, better Microsoft 365 security settings, stronger MFA, email protection, DMARC and staff awareness all work together.
No single layer solves the problem.
But each layer reduces the chance of a bad day.
What about Cyber Essentials?
Cyber Essentials is still a strong starting point.
The NCSC describes Cyber Essentials as the minimum cyber security standard recommended by the UK Government, built around five technical controls designed to prevent the most common internet-based cyber threats.
We support Cyber Essentials.
We recommend it.
But it is a baseline.
It is not the finish line.
Cyber Essentials helps you put the locks on the doors.
MDR, MXDR, EDR and ITDR help you spot signs that someone is trying to get in, or may already be inside.
That is the difference.
Why this matters for GDPR and insurance
If personal data is involved in a breach, the clock can start ticking quickly.
The ICO provides guidance for small organisations on responding in the first 72 hours after discovering a personal data breach, and UK organisations may need to report notifiable breaches without undue delay.
That is difficult if you do not know something has happened.
Detection matters.
Logging matters.
Response matters.
The same applies to cyber insurance.
Insurers increasingly want to know whether you have proper controls in place.
That may include MFA, endpoint protection, patching, backups, monitoring and incident response.
Having MDR or MXDR in place can help show that you are taking reasonable, practical steps to reduce risk.
It does not guarantee a claim will be paid.
Nothing does.
But it gives you better evidence than “we had antivirus installed and hoped for the best.”
So what should a small business actually do?
You do not need to buy every cyber security product under the sun.
That is not realistic.
It is not proportionate.
And for most small businesses, it is not affordable.
A sensible approach usually looks like this:
Start with the basics.
Make sure MFA is in place.
Patch your devices.
Back up your Microsoft 365 data.
Use proper email security.
Protect your endpoints.
Check your Microsoft 365 settings.
Train your staff without blaming them.
Then add managed detection and response where the risk justifies it.
For some organisations, Heimdal MXDR may be the right fit because they want broader managed protection across more of their environment.
For others, Huntress Managed EDR may be the right next step because they want strong endpoint detection and response without building an internal cyber team.
For many Microsoft 365 users, Huntress ITDR is a sensible addition because account takeover and email compromise are such common routes into a business.
The right answer depends on how you work, what data you hold, how many devices and users you have, and how quickly you would need to recover if something went wrong.
Our view
Antivirus still has a place.
But it should not be the whole plan.
Modern cyber security is not just about blocking known malware.
It is about spotting suspicious behaviour.
It is about protecting identities.
It is about responding quickly.
It is about reducing the chance that a small problem becomes a business-stopping incident.
That is why we recommend managed detection and response for small organisations that rely heavily on email, Microsoft 365, cloud systems and mobile working.
Not because every small business needs an enterprise-sized cyber security stack.
But because small businesses still face real-world attacks.
And when something goes wrong, you need more than a silent icon in the corner of the screen.
You need someone watching.
Need help choosing the right level of protection?
Black Swan Cyber Security Solutions helps small UK businesses, schools, charities and care providers make sense of cyber security without the scare tactics.
We can help you understand whether your current antivirus is enough, whether Heimdal MXDR makes sense, whether Huntress Managed EDR would be a better fit, and whether Huntress ITDR should be added to protect your Microsoft 365 accounts.
We will keep it plain English. We will keep it proportionate and we will help you focus on the risks most likely to hurt your organisation.
Book a free cyber security review and we will help you work out what protection makes sense now, what can wait, and what should not be ignored.
