For decades, antivirus on every computer was synonymous with "we have protection". The problem is that attackers have since changed the rules of the game, and classic antivirus still plays by the old ones.
Why antivirus no longer catches everything
Traditional antivirus works off a list: it compares files against a database of known threats. That works brilliantly against malware someone has already seen, analysed and catalogued somewhere.
But modern attacks increasingly route around that model. Malicious code is auto-generated in unique variants that exist in no database. More uncomfortable still: a share of attacks uses no "viruses" at all, just legitimate tools already present on every Windows machine: PowerShell, remote-access utilities, system commands. The antivirus stares straight at the attack and sees nothing wrong, because individually, nothing is wrong.
EDR: watches behaviour, not lists
EDR (Endpoint Detection and Response) approaches it the other way around. Instead of asking "is this file on the bad list?", it asks "is this behaviour normal?"
An accounting PC that suddenly runs scripts, touches hundreds of files a minute and phones an unknown address abroad: each step might look innocent, but the pattern screams. EDR recognises the pattern and, crucially, responds: the suspicious process is stopped, the machine is automatically isolated from the network, and a record of the entire event chain is preserved. With ransomware, the difference between a response in minute two and a discovery the next morning is the difference between one isolated computer and an encrypted company.
Honestly: does everyone need it?
EDR has become affordable for small companies, but it's not the first item on the list. If you don't yet have solid backups, MFA and updated systems. Those come first, because EDR doesn't patch missing foundations.
But if the foundations are in place and your business seriously depends on IT, or you handle sensitive data, EDR is the logical next step. One caveat: EDR generates alerts that someone has to understand and act on. That's why a managed variant, the tool plus someone who actually watches it. Tends to work best for smaller companies. Technology with no pair of eyes behind it is just a more expensive antivirus.