EDR vs XDR vs NDR — detection technology comparison (2026)

The cybersecurity market is flooded with acronyms: EDR, XDR, NDR, ITDR, MDR, SIEM, SOAR. Understanding the differences between them determines whether you spend budget on the right tool. In this guide, we compare four key categories — EDR, XDR, NDR, ITDR — from a SOC architect’s perspective.

TL;DR — quick decision

• Up to 100 endpoints, no SOC: EDR + email security separately
• 100-1000 endpoints, own SOC: EDR + NDR (or initial XDR)
• 1000+, MDR/MSSP or 24/7 SOC: XDR (consolidation) + ITDR
• Regulated (NIS2, PCI): XDR + SIEM (XDR for detection, SIEM for 6-12 month log retention)
• Active Directory dominant: dedicated ITDR (Semperis, Tenable Identity)

Definitions and scope

EDR — Endpoint Detection and Response

Sees: processes, files, registry, API calls, network connections ON HOST. Data source: agent on endpoints. Typical detections: malware, ransomware, fileless attacks, credential dumping, persistence. Action: host isolation, kill process, remediation playbooks. Vendors: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Trellix, Palo Alto Cortex XDR (EDR component).

NDR — Network Detection and Response

Sees: packets, flow (NetFlow, sFlow, IPFIX), DNS, TLS metadata, HTTP headers. Data source: SPAN port, TAP, inline sensors, virtual sensors in cloud. Typical detections: lateral movement, C2 beaconing, data exfiltration, DNS tunneling, reconnaissance scans. Action: alerts to SIEM/XDR, firewall integration (block), session reset. Vendors: ExtraHop, Vectra AI, Darktrace, Cisco Secure Network Analytics (Stealthwatch), Corelight, Gigamon.

XDR — Extended Detection and Response

Sees: all layers — endpoint, network, email, cloud, identity. Data source: EDR + NDR + email gateway + CASB + IAM. Typical detections: multi-stage attacks with correlation (e.g., phishing email → malware on endpoint → lateral movement → cloud exfil). Action: cross-domain response (isolate endpoint + block user + quarantine email). Vendors: CrowdStrike Falcon XDR, Microsoft Defender XDR, SentinelOne Singularity, Palo Alto Cortex XDR, Trellix XDR, Fortinet FortiXDR.

ITDR — Identity Threat Detection and Response

Sees: Active Directory, Azure AD, Okta activity, Kerberos tickets, LDAP queries, service principals. Data source: domain controller logs, Azure AD audit, SIEM feeds. Typical detections: Kerberoasting, Golden/Silver Ticket, DCSync, Pass-the-Ticket/Hash, orphan accounts, privilege escalation. Action: force password reset, disable account, revoke sessions, MFA challenge. Vendors: Semperis DSP, Tenable Identity Exposure (Alsid), Microsoft Defender for Identity, Silverfort, Quest On Demand Audit.

Comparison table

Dimension	EDR	NDR	XDR	ITDR
Layer	Endpoint	Network	Multi-layer	Identity
Data source	Agent	SPAN/TAP/flow	EDR+NDR+email+cloud+IAM	AD/Azure AD/Okta
Detection type	Host-level threats	Network-level threats	Cross-domain attacks	Identity-based attacks
Action	Isolate host, kill proc	Alert, FW integration	Cross-domain response	Reset, disable, revoke
Deployment	Agent on endpoints	Sensors in network	Platform + agents	DC/IdP integration
Typical detections	Ransomware, malware	Lateral movement, C2	Multi-stage attacks	Kerberoasting, Golden Ticket
Price (per endpoint/year)	$30-80	Sensor model	$50-150	$15-40
Best for	Any company >10 endpoints	Medium and large	500+ endpoints, SOC	AD-centric enterprises

When EDR is enough, and when you need more?

EDR alone is sufficient when:

• Company <100 endpoints
• No own SOC (MSSP handles EDR)
• Infrastructure mainly endpoint-centric (laptops, small office)
• Cyber budget <$50k/year

Add NDR when:

• Environment >100 endpoints with lateral movement risk
• You have network segmentation and want to enforce it
• Suspect insider threats or APT
• Significant OT infrastructure (manufacturing, energy)

Choose XDR when:

• Environment >500 endpoints
• You have SOC (in-house or MDR) handling alerts
• Want consolidation (fewer consoles, fewer vendors)
• Using cloud (cloud workloads, SaaS)
• Budget $125-750k/year

Add ITDR when:

• Active Directory is critical (finance, admin access)
• History of identity attacks (Kerberoasting in pentest)
• Ready for Zero Trust and hybrid AD/Azure AD
• Enterprise with 10k+ accounts

Vendors 2026 — Magic Quadrant leaders

EDR — Gartner MQ 2024 Leaders

1. CrowdStrike Falcon — cloud-native, best detection
2. Microsoft Defender for Endpoint — value if you have E5
3. SentinelOne Singularity — AI-native, good autoresponse
4. Trellix (McAfee+FireEye) — enterprise incumbent
5. Palo Alto Cortex XDR (EDR component)

XDR — key players

1. CrowdStrike Falcon XDR
2. Microsoft Defender XDR (E5 license)
3. SentinelOne Singularity XDR
4. Palo Alto Cortex XDR
5. Fortinet FortiXDR (for Fortinet ecosystem clients)

NDR — Gartner Voice of Customer

1. ExtraHop Reveal(x) — best packet analysis
2. Vectra AI Cognito — AI-driven
3. Darktrace — Enterprise Immune System
4. Cisco Secure Network Analytics (Stealthwatch)
5. Corelight — Zeek-based, forensic depth

ITDR — leading

1. Semperis DSP — AD recovery + ITDR
2. Tenable Identity Exposure (Alsid)
3. Microsoft Defender for Identity
4. Silverfort — MFA everywhere + ITDR
5. Quest On Demand Audit

Architecture: how to connect it all

[Endpoints] → EDR (CrowdStrike)
                 ↓
[Network traffic] → NDR (Darktrace)
                 ↓
[Email] → Email Security (Proofpoint, Abnormal)   → XDR platform → SOC analyst
                 ↓
[Cloud] → CASB + CSPM (Netskope, Wiz)             → SIEM (long-term) → compliance
                 ↓
[AD / Azure AD] → ITDR (Semperis)
                 ↓
[Orchestration] → SOAR (XSOAR, Splunk SOAR) — automated response

Key principle: XDR = detection and response, SIEM = log storage for compliance and forensics (6-12 months retention required by NIS2, PCI).

Explore our services

• SOC as a service
• Security audits
• Penetration testing
• Virtual CISO

---

Related topics

See also:

• NIS2 for hospitals — implementation and funding
• Security Audit Pricing Calculator