TL;DR:

  • Traditional antivirus only catches known malware — modern attacks routinely bypass it
  • EDR (Endpoint Detection and Response) detects suspicious behaviour, not just known signatures
  • Patch management and mobile device coverage are as important as the security software itself

Endpoint security means protecting every device that connects to your business: laptops, desktops, phones, and tablets. Each one is a potential entry point. Traditional antivirus software — which most small businesses still rely on — works by matching files against a database of known threats. The problem is that new malware variants, and attackers using legitimate tools maliciously, don’t appear in those databases. Modern endpoint security has evolved to address this, and affordable options now exist for businesses of any size.

What’s wrong with antivirus alone

Classic antivirus uses signature-based detection — it scans files and compares them to a database of known malicious code. This works fine for threats that have been seen before. It fails in three important scenarios.

Zero-day attacks use vulnerabilities that haven’t been discovered and patched yet. There’s no signature because nobody has catalogued the threat yet.

Fileless malware doesn’t write anything to disk. It runs entirely in memory using legitimate Windows or macOS tools, leaving nothing for a signature scan to find.

Living off the land attacks use tools already installed on your computer — PowerShell, Windows Management Instrumentation, or legitimate remote desktop software — to move through your network. No malicious files are dropped, so antivirus sees nothing unusual.

Attackers know exactly how antivirus works and design their attacks around it. This is why endpoint security has moved toward behavioural detection — watching what software actually does, not just what it looks like.

What EDR does differently

Endpoint Detection and Response (EDR) continuously monitors what’s happening on every device: what processes are running, what network connections are being made, what files are being accessed and modified. When it sees behaviour that matches known attack patterns — even with no malicious file present — it can alert you, quarantine the device, or automatically block the activity.

EDR also records a detailed timeline of activity. If something goes wrong, you can trace exactly what happened, which is critical for incident response and sometimes required by cyber insurance policies.

The practical difference: antivirus might miss the attack entirely. EDR will typically catch the behaviour within minutes, limit the damage, and tell you what happened.

Affordable EDR options for UK small businesses

EDR used to require an enterprise budget and a dedicated security team to manage the alerts. That’s no longer true.

Malwarebytes for Teams and Business starts at around £3–4 per device per month. It’s well-regarded for ransomware detection specifically, with a simple dashboard that non-technical owners can actually use. A sensible starting point.

SentinelOne Singularity is one of the most capable EDR platforms available, now accessible to SMBs. Around £5–7 per endpoint per month for the business tier. Fully autonomous — it can respond to threats without requiring human action, which suits businesses with no in-house IT.

CrowdStrike Falcon Go brings enterprise-grade technology down to SMB pricing. Around £4–6 per device per month. Excellent threat intelligence. Slightly more complex to configure than Malwarebytes.

Huntress is worth mentioning for a different reason. Rather than giving you a dashboard to manage yourself, Huntress employs human security analysts who monitor your endpoints and tell you when action is needed. Around £2.50–4 per endpoint per month — a good choice if you have no in-house IT at all.

Mobile device management basics

Phones and tablets are endpoints too, and they’re often the most overlooked. An employee’s phone connected to your business email or cloud storage is just as much of a risk as a laptop.

Mobile Device Management (MDM) lets you enforce security policies on company-owned or employee-owned devices: requiring a PIN, enabling remote wipe if a phone is lost, preventing certain apps, and ensuring encryption is on.

Apple Business Manager (for iPhone and iPad) and Microsoft Intune are the main platforms. Intune is included in Microsoft 365 Business Premium. For a simpler option, Jamf Now covers Apple devices at around £3–4 per device per month.

At minimum, without a full MDM deployment, make sure all staff phones have a PIN or biometric lock, business email is configured to require device encryption, and remote wipe is enabled through your email platform — both Google Workspace and Microsoft 365 support this.

Patch management: the most overlooked endpoint control

60% of breaches exploit vulnerabilities where a patch was already available at the time of the attack. Keeping software updated isn’t glamorous, but it closes the doors attackers walk through.

Enable automatic updates for operating systems on every device. Chrome, Firefox, Edge, and Safari all auto-update when that option is on. Desktop business software (accounting tools, design apps, CRM) usually needs manual checking under Help → Check for Updates. And router firmware is the most commonly skipped item — log into your router every few months and check for updates there too.

For businesses with more than a handful of devices, a patch management tool like NinjaRMM or Action1 (free up to 100 devices) gives you a central view of which devices are missing critical patches and lets you deploy updates remotely.

Building your endpoint security stack

You don’t need enterprise tools. A solid SMB endpoint setup looks like this:

EDR software on every computer — Malwarebytes Business or SentinelOne. Automatic OS and browser updates enforced. Action1 or a similar tool for broader patch visibility. MDM or at minimum PIN plus remote wipe via your email platform for mobile devices. And Cloudflare Gateway (free) to block malicious websites before they load.

Bottom line

Traditional antivirus is no longer sufficient for business use — modern attacks routinely bypass signature-based detection. EDR software that watches behaviour rather than just scanning files gives you genuine protection at a price that fits a UK small business budget. Add patch management and basic mobile device controls, and you’ve covered the endpoints that attackers target most.