Traditional antivirus asks one question: does this file match something known to be bad. That question was sufficient when malware arrived as files and attackers reused their tools. It is much less sufficient now.
What changed
A great deal of intrusion activity no longer involves malicious files at all. Attackers use the tools already present on the machine — scripting engines, remote management utilities, legitimate administrative binaries. Nothing is downloaded, so nothing is scanned, and nothing matches a signature.
Endpoint detection and response watches behaviour instead: what ran, what it spawned, what it touched, where it tried to connect. The signal is the sequence, not the file.
The 'managed' half matters more than the 'EDR' half
An EDR product generates alerts. Alerts at three in the morning on a Sunday are only useful if somebody sees them and acts. For most organisations of the size we work with, nobody is rostered at three on a Sunday, and the alert waits until Monday.
Detection without response is a very detailed record of how you were compromised.
We standardised on one managed EDR platform across every environment we look after for a practical reason as much as a technical one: our engineers see the same console, the same alert format and the same response playbook at every client. Familiarity is worth a great deal at two in the morning.
What it does not do
EDR does not replace patching, backups, MFA or access control. It is one layer. We deploy it alongside the others, never instead of them.