MDR vs. Antivirus: What Your Cyber Insurance Application Actually Asks For

"We have antivirus, we should be fine" was a defensible answer to a cyber insurance question in 2018.

In 2026, the application no longer stops at "do you have antivirus." It asks:

• Whether every endpoint — including servers, not just laptops — runs endpoint detection and response
• Whether a real security team watches those endpoints around the clock
• Who handles incident response when something fires

If you are the owner of a small business filling out a renewal for the first time and the question makes no sense, you are not behind. The vocabulary changed. This page explains the three terms carriers now use — antivirus, EDR, and MDR — in the exact frame the application uses, so you can answer accurately without overcommitting.

The direct answer

Antivirus is still useful. It is not what carriers are asking about when they ask about endpoint detection and response. If your only endpoint control is signature-based antivirus, the application scores that as a gap — and misstating it is the mistake that voids the policy at claim time.

What the application actually asks about endpoint protection

Nearly every 2026 SMB cyber-insurance application in circulation has a version of the same question, phrased slightly differently by each carrier:

Do you have endpoint detection and response (EDR) or managed detection and response (MDR) deployed on every workstation and server? Is there a 24/7 security operations center behind it?

That is the pivot question. It is question two on the ten-control table already published on the Cyber Insurance Readiness Sprint page — among the controls carriers weight most heavily, alongside MFA, because human-operated ransomware in 2026 dwells on an endpoint long enough for a real analyst to catch it, if there is one watching.

Two things about how the question is scored:

1. "On every endpoint" includes servers. The common failure mode is a practice running an EDR agent on the laptops and leaving the practice-management server or the file server on legacy antivirus. Carriers ask specifically. The single-line answer "yes, on workstations" is scored as partial.
2. "24/7" means a real security team. Software running unattended is not what the question is asking about, even if the marketing says "24/7 protection."

Antivirus, EDR, MDR — in one to two sentences each

Antivirus. Signature-based scanning that blocks known malware files. The oldest layer in the stack, still useful, but it stops at "have I seen this specific file before?" — which is not the frame ransomware crews operate in anymore. Deeper reading: Is antivirus enough for my small business? Why ransomware walks past it.

EDR (endpoint detection and response). Software that records what happens on an endpoint — process trees, network connections, file changes, persistence attempts — and alerts on behavior that looks like an attack rather than on a specific file signature.

It sees the human-operated part of ransomware that antivirus misses. What it does not do on its own is decide what to do about the alert.

MDR (managed detection and response). EDR plus a real security operations team watching the alerts around the clock, triaging, and responding. The application asks for MDR (or EDR with 24/7 monitoring) because the alert without a human on the other end is a log, not a response. Deeper reading on the buyer lens: EDR vs MDR vs XDR: a 2026 buyer's guide.

How each one reads on a carrier application

When antivirus is genuinely enough (honest read)

Not everyone needs MDR. This is the section most articles skip because it does not sell.

Antivirus is a reasonable primary control if all of these are true:

• You are a single user, running your own hardware, not handling regulated data — no ePHI, no client trust funds, no client financial data, no attorney-client privileged files.
• You are not applying for or renewing a cyber insurance policy that asks about endpoint detection.
• You are not contractually required to demonstrate endpoint monitoring to a customer or a regulator.
• You have another layer of protection carrying the alerting weight — identity monitoring on your accounts, tested backups, and no exposed remote-access services.

The moment any of those change — the application form arrives, a client contract adds a security requirement, you take on regulated data — the AV-only answer stops being defensible. Not because antivirus became worse, but because the threat model the answer is scored against changed.

How to answer the question truthfully

Three practical rules for the endpoint section of the application:

1. Answer for what you actually operate, not what you own. Owning EDR software does not equal running it. If nobody is reviewing alerts, the honest answer to "is there a SOC behind it" is "no, we run it ourselves during business hours."
2. Do not conflate antivirus with EDR. Some entry-level bundles market signature scanning as EDR. The underwriter distinguishes on functional criteria — behavioral detection, response actions, telemetry retention — not on the marketing name.
3. Server coverage counts. If the answer is "EDR on laptops, antivirus on the server," write that. Carriers ask for server-coverage specifically and will find out later either way.

If the answers you write down do not match the environment when a forensics firm shows up post-incident, the policy is at risk. Truthful "no" on a control is survivable. Overstated "yes" on a control is the material misstatement that voids the claim.

What we do

Obsidian Ridge operates managed endpoint detection and response — the EDR-plus-a-real-team version — on every workstation and server, watched around the clock. If you need the pillar-page detail, see managed detection and response.

If you are inside a 30- or 60-day application or renewal window and need the evidence packet built — the answers, the exports, the proof — that work is a fixed-scope engagement: the Cyber Insurance Readiness Sprint, from $1,500, delivered in 7 business days.

The Sprint produces the answer to the endpoint question, and the other nine, with the underlying evidence attached.

If you want to score yourself first, before talking to anyone, the free cyber insurance questionnaire walks the same ten controls in the carriers' own words.

Next step

If the application question was the prompt for this reading and you want to close the gap it exposed, start with the free carrier questionnaire — score yourself in your own words first. If you already know the gap and need the evidence packet built, that is the Cyber Insurance Readiness Sprint, from $1,500, delivered in 7 business days.