Talk to an IT provider about security and you'll quickly hit a wall of acronyms: AV, EDR, XDR, SIEM, SOC, MDR. Each one comes with a price tag, and each salesperson insists theirs is the one you need.

This guide explains the three you'll hear most often, antivirus, EDR and SIEM, using a comparison anyone who has run a business will recognise: protecting a shop.

The shop analogy

Imagine your business is a shop.

  • Antivirus is the security guard at the door with a list of known shoplifters' photos. If someone on the list walks in, they're stopped. Anyone not on the list walks straight past.
  • EDR is a set of CCTV cameras inside the shop, with someone trained to notice suspicious behaviour, such as a customer lingering by the till, stuffing items into a bag or trying the stockroom door. It doesn't matter whether the person is on a list; it's what they do that raises the alarm.
  • SIEM is the control room that watches every camera, door sensor, till log and alarm panel across all your branches at once, and notices when small things that look innocent on their own add up to something serious.

Each layer catches things the others miss.

Antivirus: the essential baseline

What it does: scans files and programs on a computer and blocks anything that matches known malware. Modern antivirus also uses some behaviour rules, but its strength is stopping known threats.

What it's good at:

  • Catching common, widespread malware automatically.
  • Running quietly with almost no effort from you.
  • Low cost. Windows already includes Microsoft Defender Antivirus, which is a solid baseline when it's switched on and up to date.

Where it falls short:

  • New or customised attacks that aren't on any list yet.
  • Attackers who don't use malware at all, for example someone who logs in with a stolen password and uses normal Windows tools.
  • It works one device at a time, so it can't see the bigger picture.

Verdict: every device should have it. On its own, it isn't enough.

EDR: endpoint detection and response

What it does: EDR software sits on each computer ("endpoint") and records what's happening: which programs start, what they do, which files change and what network connections are made. It looks for suspicious behaviour rather than known file signatures, and it lets you respond, for example by isolating a computer from the network with one click.

What it's good at:

  • Spotting attacks that antivirus misses, such as an Office document that launches PowerShell, a program encrypting hundreds of files in a minute, or a tool used to dump passwords.
  • Showing you what happened after an incident, so you can see how the attacker got in and what they touched.
  • Stopping an attack fast by containing the affected machine.

Where it falls short:

  • It generates alerts, and alerts need someone to look at them. An EDR console nobody checks gives you a false sense of security.
  • It only sees endpoints. It won't notice suspicious sign-ins to your Microsoft 365 account or changes on your firewall.

Verdict: a big step up from antivirus alone, if the alerts are being watched.

SIEM: security information and event management

What it does: a SIEM collects logs and events from everywhere, including computers, servers, firewalls, cloud accounts and applications, and stores them in one place. It correlates them, connecting the dots between events that look harmless on their own.

For example: a failed log-in from overseas, followed by a successful one a minute later, followed by a new email forwarding rule. None of those is alarming alone. Together, they're a textbook account takeover.

What it's good at:

  • Seeing across your whole environment, not just one device.
  • Keeping a history of events, which is invaluable when you need to investigate an incident or show an auditor what you monitor.
  • Supporting compliance: POPIA expects you to verify your safeguards regularly, and a SIEM's records are evidence that you do.

Where it falls short:

  • Traditional SIEMs are complex and expensive to run. They need tuning, and they produce a lot of noise.
  • Like EDR, it needs people watching it. Large companies run a 24/7 security operations centre (SOC) for that. Small businesses can't.

Verdict: the most complete view, but historically out of reach for small businesses because of cost and complexity.

Side by side

Antivirus EDR SIEM
Main job Block known malware Detect and stop suspicious behaviour on devices Collect and correlate events across all systems
Sees Files on one device Activity on each device Devices, servers, cloud, network
Catches new attacks? Rarely Often Often, especially multi-step ones
Helps investigate? Very little Yes, per device Yes, across the business
Needs someone watching? No Yes Yes
Typical fit Everyone Businesses with sensitive data Businesses with compliance needs or several systems

What about XDR, MDR and SOC?

You'll hear these too, so briefly:

  • XDR (extended detection and response) combines EDR-style detection with data from other sources, such as email, cloud and network. Think of it as EDR with some SIEM-style breadth.
  • SOC (security operations centre) is the team of people who watch the alerts.
  • MDR (managed detection and response) is a service where an outside team watches and responds for you.

The pattern is the same: tools produce alerts, and someone has to act on them.

So what does a small business actually need?

For most South African SMEs, a sensible setup looks like this:

  1. Antivirus on every device. Keep Microsoft Defender switched on and updated, or use the product your IT provider recommends.
  2. Behaviour-based monitoring on every device, so attacks that slip past antivirus are spotted.
  3. Central visibility: one place that collects events from all your devices and servers, keeps a history and connects the dots.
  4. Alerts you can understand and act on, without hiring a security analyst.

Points 2 to 4 are where most small businesses have a gap, and where the traditional answer (an enterprise SIEM plus a SOC team) costs far more than a small business can justify.

Where EZ Cyber Guard fits

EZ Cyber Guard was designed to close that gap for small and medium businesses. It runs a lightweight agent on your Windows, macOS and Linux devices and combines:

  • continuous threat detection on your endpoints and servers
  • central log collection, file integrity monitoring and intrusion detection, the core of what a SIEM does
  • vulnerability tracking, so you know which missing patches matter most
  • AI analysis that explains each alert in plain language, with clear next steps
  • automated response that contains common threats without waiting for office hours

It works alongside your antivirus, not instead of it. Keep the guard at the door; EZ Cyber Guard adds the cameras and the control room.