Why Antivirus Alone Is No Longer Enough: The Case for EDR in UK SMEs
Most UK SMEs have antivirus installed. Some have moved to next-generation antivirus (NGAV). And most assume that means their endpoints are protected.
They’re not wrong to invest in it. But they may be wrong to rely on it.
The reality is that a growing proportion of today’s attacks don’t involve malware at all. No suspicious file lands on disk. Nothing triggers a virus scan. The attacker uses tools and processes already present on your systems—and walks straight past your antivirus undetected.
This is what we’re seeing directly, through our own red team engagements with UK SMEs. And it changes the conversation around endpoint security significantly.
Why Modern Attacks Are Built to Bypass Antivirus
Traditional antivirus detects known malicious files—it matches what it sees against a database of known threats. NGAV goes further, using behaviour-based analysis and machine learning to catch unknown threats at the point of execution.
Both approaches share a common assumption: that the attacker will introduce something into your environment that looks suspicious.
Increasingly, they don’t.
Attackers now commonly use what security professionals call “living off the land” techniques—abusing legitimate tools already built into Windows and other operating systems. PowerShell, Windows Management Instrumentation (WMI), and remote scripting via cloud platforms are all standard business tools. They’re also powerful attack tools that generate no malware signature and, in many cases, raise no antivirus alert whatsoever.
Add to this the rise of “low and slow” attacks—where an attacker gains initial access, then deliberately moves slowly over days or weeks to avoid triggering behaviour thresholds—and the picture becomes clear. NGAV was built for a different threat landscape than the one UK businesses face today.
What We Found During Red Team Engagements With UK SMEs
A red team engagement is a controlled, authorised simulation of a real-world cyber attack. Unlike a penetration test, which checks for specific vulnerabilities, a red team exercise tests whether your people, processes, and technologies can actually detect and respond to an attacker behaving like a real threat actor.
We run these for UK organisations of various sizes—and what we find consistently surprises the businesses involved.
In a significant number of engagements, we completed full attack chains—from initial access to domain-level control—without a single antivirus or NGAV alert firing. Not because those tools weren’t deployed. They were. But because the techniques we used were specifically designed to operate within the blind spots that signature-based and behaviour-based prevention tools leave open.
For a UK SME, this matters enormously. A real attacker using the same techniques could sit inside your environment for weeks. Exfiltrating data. Mapping your systems. Preparing a ransomware deployment. All while your AV reports clean.
What EDR Is—and Why It’s Different
Endpoint Detection and Response (EDR) is a security technology that continuously collects detailed telemetry from every managed device—laptops, servers, desktops—and uses that data to identify suspicious behaviour, not just suspicious files.
Where antivirus asks “does this file match a known threat?â€, EDR asks a different question: “does this sequence of activity match how a real attacker behaves?â€
That means EDR can detect:
- A legitimate admin tool being used at an unusual time, from an unusual location
- A script quietly collecting credentials in the background
- Lateral movement—an attacker moving from one machine to another—that produces no malware but leaves a clear behavioural trail
- Data being staged and prepared for exfiltration
This is captured through what’s known as TTPs—Tactics, Techniques, and Procedures. Rather than matching signatures, EDR maps observed behaviour against known attacker methodologies, including those catalogued in frameworks like MITRE ATT&CK.
One important point: EDR is not a set-and-forget tool like antivirus. The telemetry it generates is detailed and requires skilled engineers to review, interpret, and act on. A well-configured EDR that nobody watches is still a gap.
That said, AI-assisted triage is changing this significantly. Modern EDR platforms increasingly use AI to prioritise alerts, suppress noise, and surface only the activity that genuinely warrants human attention. This makes EDR more accessible for teams without a dedicated Security Operations Centre—but it doesn’t eliminate the need for human expertise entirely.
Why Most UK SMEs Are Now Using Managed Detection and Response
This is precisely why many UK SMEs are turning to Managed Detection and Response (MDR) services rather than attempting to run EDR in-house.
MDR combines EDR tooling with a team of security analysts who monitor your environment, triage alerts, and respond to confirmed threats on your behalf.
For a UK business without a dedicated security team, this model makes EDR genuinely viable. You get enterprise-grade detection capability without the cost of building an in-house SOC.
At ITB, our MDR Lite service is designed for smaller businesses and SMEs that need meaningful endpoint visibility without the overhead of a full managed security programme. For organisations with more complex requirements—or those wanting broader coverage across endpoints, identity, and cloud environments—our Full MDR service provides 24-hour, 7-day coverage and scales to mid-market and enterprise needs.
EDR Is Part of the Answer—Not All of It
It’s worth being direct about something: EDR alone doesn’t make you secure. No single control does.
Effective security requires overlapping layers of defence—each one limiting what an attacker can do if another layer fails. For UK SMEs, the minimum foundation looks something like this:
- Perimeter controls — Email filtering, web security gateways, and DNS threat intelligence block the majority of attack attempts before they reach your devices
- Endpoint hardening — Restricting what can run on managed devices, applying least-privilege access, and maintaining a disciplined patch cadence reduces the attack surface significantly
- Prevention (AV / NGAV) — Still valuable for catching known threats and commodity malware at the point of execution
- Detection and response (EDR) — Catches what prevention misses; provides the visibility needed to identify and contain post-exploitation activity quickly
- Resilience — Offline, immutable backups and a tested incident response plan ensure that when defences are breached, recovery is fast and ransoms don’t have to be paid
The key shift in thinking is this: prevention controls reduce the likelihood of a successful attack; detection and response controls limit the damage when prevention isn’t enough. For UK organisations under GDPR, that distinction matters—because the ICO will want to understand not just how an incident occurred, but how quickly you detected and contained it.
Where to Start
If your business is currently relying on antivirus or NGAV as its primary endpoint defence, the honest answer is that you have a visibility gap—and you may not know it yet.
The good news is that understanding that gap doesn’t require a significant upfront investment.
ITB offers a free initial security review for UK SMEs who want to understand where their current controls stand and where the real exposure lies. For organisations ready to take the next step, our paid security assessments provide the detailed picture needed to prioritise investment confidently.
Find out more about ITB MDR services