Antivirus still matters. It is also wildly over-credited.
When a business owner says "we're fine, we've got antivirus," they usually mean a green icon on a laptop. Modern attacks don't always look like a sketchy download from 2009. They look like a stolen session token, a mailbox rule forwarding invoices, a remote tool abused after hours, or ransomware that waited quietly until backups were worthless.
Managed Detection and Response (MDR) is how many Australian SMBs close the gap between having a security tool and having someone who acts when it fires—especially at 2am, when your internal IT person is asleep and your national helpdesk is reading from a script.
This guide explains MDR in plain English, contrasts it with antivirus and EDR, and maps it to a practical three-layer stack SMBs can fund without building a Security Operations Centre (SOC) in-house.
Antivirus vs EDR vs MDR (stop mixing the labels)
| What it is | What it does well | What it doesn't do | |
|---|---|---|---|
| Antivirus (AV) | Software on a device | Blocks many known malware families | Weak on novel attacks; little investigation; no human response |
| EDR | Endpoint Detection & Response tool | Behaviour-based detection, richer telemetry, isolate device capability | Alerts still need skilled humans and process |
| MDR | Managed service wrapped around detection tech | 24/7 triage, investigation, guided or hands-on response | Not a substitute for MFA, backups, or patching |
| MSSP (legacy style) | Monitoring service | May watch logs and email you | Often "alert forwarding" without containment authority |
| In-house SOC | Your people + tooling | Full context if well staffed | Expensive; unrealistic for most SMBs |
One-line version:
AV/EDR are tools. MDR is people + process + authority to act, usually 24/7, using those tools.
If someone sells "MDR" but only emails you a PDF of alerts, you bought a notification subscription.
What you actually get with MDR
A credible MDR service for SMBs typically includes:
1. Continuous monitoring
Telemetry from endpoints (and sometimes identity, email, or cloud signals) is watched around the clock—not only during business hours.
2. Triage and investigation
Analysts separate noise from real incidents. This is the part SMBs never staff well. A raw EDR console without triage becomes alert fatigue, then ignored alerts.
3. Response actions
Depending on the contract, the provider can:
- Isolate a host
- Kill malicious processes
- Disable a compromised account
- Block indicators
- Guide your IT/MSP through containment steps
- Escalate to a full incident response engagement when needed
Ask explicitly: what can they do without waiting for you to wake up?
4. Threat hunting (in better offerings)
Proactive searches for stealthy activity that didn't trip a simple alarm—credential misuse, odd remote access patterns, living-off-the-land techniques.
5. Reporting you can show a board or insurer
Monthly meaningful summaries: incidents handled, noisy software, patch/coverage gaps, recommended next controls—not vanity "millions of blocks" charts.
6. Clear onboarding and coverage metrics
Which devices are protected? Which are missing agents? What's the response SLA?
Why Australian SMBs are moving beyond antivirus
The economics changed
ASD's Annual Cyber Threat Report 2024–25 reported average self-reported cybercrime costs of about $56,600 for small businesses and $97,200 for medium businesses, with business costs up sharply year on year. You don't need to be "interesting" to be ransomed or business-email-compromised—you need to be reachable and unpaid-attention-rich.
Attackers automate; defenders can't be part-time
Phishing kits, initial access brokers, and ransomware affiliates run like businesses. A part-time admin checking Defender on Monday mornings is not a symmetric contest.
Insurers and partners ask better questions
Cyber proposals and customer questionnaires increasingly ask about EDR coverage, 24/7 monitoring, MFA, and incident response—not "do you have antivirus?"
Essential Eight expects detection and response maturity
The Essential Eight is broader than MDR, but "detect and respond" capabilities are part of a serious Australian baseline conversation. MDR is often how SMBs operationalise monitoring without hiring a night shift.
The practical 3-layer security stack (Vyntech-aligned)
Think in layers. MDR is powerful in layer two—not a magic cape over chaos.
Layer 1 — Prevent (reduce how often you need heroes)
- MFA everywhere that matters
- Hardened Microsoft 365 / email security
- Patching and least privilege
- Security awareness in short, regular doses
- Network basics (including segregating risky IoT/CCTV)
Layer 2 — Detect & respond (this is where MDR lives)
- EDR on endpoints as the technical base
- MDR / SOC-style monitoring with human triage
- Vulnerability management so you're not detecting the same preventable holes forever
- Incident response plan so everyone knows who calls whom
Layer 3 — Recover (assume something still gets through)
- Independent backups (including cloud email/files)
- Immutable/offline options where appropriate
- Tested restores
- Business continuity for critical workflows
Vyntech's cybersecurity positioning matches this stack: MDR with human-led 24/7 detection and response, advanced email security, vulnerability management, threat hunting, incident readiness, and Essential Eight-informed hardening—alongside managed IT and advanced backup/DR so detection isn't stranded without recovery.
MDR does not replace these controls
Be suspicious of any pitch that says MDR means you can skip:
- MFA
- Backups
- Patching
- Email authentication and anti-phishing
- Joiner/mover/leaver discipline
MDR shortens attacker dwell time. It does not make stolen admin passwords a lifestyle choice.
Antivirus alone: the false comfort checklist
If most of these are true, antivirus-only is a gamble:
- Partners use email to approve payments
- Staff work from home on laptops
- You host client or customer personal data
- Nobody triages security alerts daily
- Backups have not been restore-tested this year
- Local admin rights are common
- Shared passwords exist "just for the team"
- You would not know about a mailbox forward rule until a client called
Three or more checks: prioritise identity hardening + EDR + monitored response + backup proof.
Buyer questions before you sign MDR
- What telemetry do you monitor (endpoint only, or identity/email/cloud too)?
- Who triages—humans or only automation?
- What response actions are authorised in the first hour?
- What is the notification and escalation path to our MSP/IT lead?
- What are coverage requirements (all devices, servers, cloud workloads)?
- How do you measure dwell time / mean time to respond?
- Is after-hours response included or "best effort"?
- What happens in a major incident— is IR included, capped, or a separate retainer?
- How do you avoid alert spam to our inbox?
- Can you support Essential Eight / cyber insurance evidence packs?
- Data residency and privacy: where is telemetry processed/stored?
- Exit plan: how do we export configs and turn off agents cleanly?
Red flags
- "AI SOC" with no human escalation path
- No isolation authority and no after-hours phone
- Pricing that ignores uncovered endpoints
- Reports full of blocked ads, empty of decisions
How MDR works day-to-day with a managed IT provider
Best pattern for SMBs:
- Managed IT keeps systems patched, identities clean, and backups honest.
- EDR agents stay healthy (deployment is half the battle).
- MDR watches and acts on real threats.
- Your leadership gets a short monthly readout and a prioritised fix list.
- Major incidents follow a written plan (insurer, customers, regulators as applicable).
If IT and MDR providers don't talk, you'll lose hours to "we thought you owned that."
How Vyntech approaches this
Vyntech positions cybersecurity as advanced protection beyond the baseline for Australian SMBs:
- 24/7/365 MDR — human-led monitoring, investigation, and response
- SOC-style coverage without you hiring a SOC
- Advanced email security against phishing and BEC
- Vulnerability management with prioritised remediation
- Threat hunting and incident readiness planning
- Essential Eight-informed hardening guidance
- Integration with managed IT and advanced backup & DR so prevent, detect, and recover stay in one operating rhythm
Book a free cybersecurity consultation to map whether you need EDR-only uplift, full MDR, or a sequenced plan.
- Call 02 7250 7638
- Vyntech
- Cybersecurity services
FAQ
Is Microsoft Defender enough?
Defender (especially in stronger Microsoft 365 security bundles) can be a solid detection engine. Most SMBs still lack 24/7 triage and response discipline. MDR is often paired with Defender or other EDR—not always a rip-and-replace.
Do we need MDR if we already have an MSP?
MSPs keep you running. Few run true 24/7 threat operations at SOC depth. MDR complements managed IT; it doesn't automatically come with every helpdesk plan.
Will MDR stop all ransomware?
No honest provider promises that. MDR improves odds of early containment. Backups and identity controls decide how painful a bad day becomes.
How is MDR different from "we get firewall alerts"?
Firewall logs without skilled response are storage. MDR is judged on investigation quality and containment speed.
What's a sensible first step on a tight budget?
Enforce MFA, deploy EDR everywhere, verify backups, fix email security basics—then add MDR so the EDR isn't an unwatched camera.
Next step: book a free cybersecurity consultation
If your current protection is a green antivirus icon and a hope that attacks clock off at 5pm, you don't have detection and response—you have optimism.
Book a free cybersecurity consultation with Vyntech. We'll review coverage gaps, whether MDR fits now, and how it layers with managed IT and backup.
02 7250 7638 · vyntech.com.au
Sources
- Vyntech — Cybersecurity / MDR positioning. Cybersecurity services
- Vyntech — Managed IT and broader security stack. Vyntech
- ASD/ACSC — Annual Cyber Threat Report 2024–2025. cyber.gov.au report
- ASD — Essential Eight. cyber.gov.au essential-eight
- Industry MDR buyer guidance (AU SMB market context, 2025–2026).
