EDR vs. SOC vs. SIEM. What each one does (and whether your business needs all three)

EDR vs SIEM. SOC vs MDR. Security proposals use many acronyms. Buyers can mistake partial coverage for a complete security operation and discover the gap when an alert arrives at 2 a.m.

Here's the plain-English version. Think of your business as a building. EDR is the lock and alarm on each door, the SIEM is the security camera recording everything, and the SOC is the people watching the screens and acting.

Below you'll get a clear definition of each one, how the three work together, what breaks when one is missing, and an honest answer on what a small business actually needs.

EDR, endpoint detection and response

Endpoint detection and response (EDR) is software installed on every laptop, desktop, and server that watches how programs behave, not just whether they match a list of known viruses. When something acts like an attack, EDR can automatically isolate the device and remove the threat. It's the next step up from traditional antivirus.

An endpoint is any device that connects to your network, including laptops, desktops, and servers. EDR sits on each one and watches what happens.

Here's behavioral detection in one example. A Word document opens, then suddenly starts encrypting every file on the drive. Antivirus may not recognize the file, but EDR recognizes the behavior, stops it, and isolates the device before the ransomware spreads.

Platforms like CrowdStrike Falcon are built on this approach. In our analogy, EDR is the lock and alarm on every door.

There is still a gap. EDR alerts still need someone to act on them. EDR without a SOC is an alarm nobody answers.

SOC, security operations center

A security operations center (SOC) is a staffed team that monitors security alerts 24x7, investigates which ones are real, and takes action to stop them. For most small and mid-sized businesses, a SOC is provided as a service rather than built in-house, because staffing one around the clock is out of reach.

What a SOC does in a day

• Triage. Sorts incoming alerts and separates real threats from noise.
• Investigation. Digs into the alerts that matter to figure out what happened and how far it went.
• Containment. Isolates devices, disables accounts, and cuts off the attacker.
• Remediation. Removes the threat and closes the hole it came through.
• Reporting. Documents what happened and what was done about it.

A SOC analyst is the person doing that work. In the analogy, they're the guards watching the screens and acting on what they see.

24x7x365 coverage matters because attacks often happen at night and on weekends, when nobody's in the office. An alert that sits until Monday morning gives an attacker a two-day head start.

That's where mean time to respond (MTTR), the average time between an alert and action, becomes the number that counts.

Building a SOC in-house isn't realistic for most small businesses. Covering every shift, weekend, holiday, and sick day takes multiple full-time analysts, plus the tools they need, and that costs more than most entire IT budgets.

That's why managed detection and response (MDR), effectively EDR plus a SOC delivered as a service, has become the standard for smaller organizations.

SIEM, security information and event management

A security information and event management (SIEM) system collects activity logs from your devices, cloud apps, identity systems, and network in one place. It connects related events to spot attacks no single system would catch, and keeps the history so you can investigate incidents and prove compliance.

Common log sources a SIEM pulls from

• Microsoft 365 and Entra ID (Microsoft's identity and sign-in service)
• Okta
• Google Workspace
• Firewalls, such as Cisco
• Microsoft Azure
• Amazon Web Services (AWS)
• Endpoints (laptops, desktops, and servers)

The SIEM handles log ingestion, meaning it pulls in every event from those sources. Then it does the part that matters most, correlation.

Here's correlation in one example. On its own, each of these might look harmless.

1. A user signs in from Ohio, then from another country 20 minutes later (an "impossible travel" login).
2. A new rule forwards that user's email to an outside address.
3. Hundreds of files get downloaded from SharePoint.

Put together, that's a compromised account. The SIEM connects those dots across identity, email, and file activity, which is something EDR on a laptop can't see.

In the analogy, the SIEM is the security camera recording every hallway. It's also your evidence locker, the audit trail that shows exactly what happened, when, and who did it.

How EDR, SOC, and SIEM work together

EDR detects and blocks threats on each device. The SIEM adds context from every other system, including identity, email, cloud, and network. The SOC uses both to decide what's real and act on it. Together they cover the full cycle, detection, investigation, and response. Remove one, and the cycle breaks.

Here's how an attack might play out with all three in place. This is an illustrative timeline, not a real client incident.

1. 9.02 p.m. An employee's Microsoft 365 password is used to sign in from another country. The SIEM records the sign-in from Entra ID.
2. 9.04 p.m. A new forwarding rule appears on that mailbox. The SIEM correlates it with the unusual sign-in and raises an alert.
3. 9.05 p.m. A SOC analyst triages the alert, confirms the account is compromised, disables it, and signs the attacker out of every session.
4. 9.11 p.m. The attacker tries to run a malicious script on the employee's laptop. EDR blocks it and isolates the device.
5. 9.30 p.m. The SOC uses the SIEM's history to confirm what the attacker touched, and the incident is contained before anyone gets to work the next morning.

Locks stopped the break-in at the door. Cameras showed where the intruder went. Guards made the call.

Coverage gaps when a security layer is missing

Without EDR, threats run on devices unchecked. Without a SIEM, you can't see identity or cloud attacks, or prove what happened. Without a SOC, alerts pile up unanswered overnight. Each gap is a common way small businesses get breached, and attackers are good at finding whichever one you have.

The three scenarios below are illustrative examples, not client stories.

Missing EDR

A business relies on traditional antivirus. A new ransomware strain arrives that isn't on any signature list yet.

Antivirus doesn't recognize it, so it runs. By morning, the file server is encrypted and operations are at a standstill. The building had cameras and guards, but no locks on the doors.

Missing SIEM

An employee's Microsoft 365 account is compromised. The attacker sets up a quiet forwarding rule and starts reading invoice emails.

For weeks, vendor invoices are copied and altered to point payments at the attacker's bank account. When someone finally notices, there are no centralized logs to trace when it started, what was read, or what else was touched. No camera footage means no evidence.

Missing SOC

EDR and a SIEM are in place and working. At 2.13 a.m. on a Saturday, an alert fires.

It lands in an inbox nobody checks over the weekend. Someone reads it Monday morning, about 54 hours too late. The alarm worked perfectly. Nobody answered it.

This is the most common gap we see. Confirm who monitors alerts and responds when reviewing the coverage behind the software.

Log retention for investigations and audits

Attackers can sit inside a network undetected for weeks, and sometimes for months. Investigations need history to reconstruct what happened, and some frameworks require about a year of logs, while insurance requirements vary by carrier. With 365 days of retention, the evidence is already there when an auditor, insurer, or investigator asks for it.

Log retention matters because of dwell time, the gap between when an attacker gets in and when they're discovered. Mandiant's M-Trends 2026 report found the global median dwell time rose to 14 days in 2025, and for espionage-style intrusions it was 122 days.

If your logs only go back 30 or 90 days, the beginning of the story may already be gone by the time you start looking. Forensics and incident response depend on that history.

That's why frameworks like CMMC treat logging as its own control family, the audit and accountability (AU) family. In the analogy, it's the difference between a camera that records and a camera that keeps the footage.

For more on logging best practices, see CISA's joint guidance on event logging and threat detection and the Detect and Respond functions of the NIST Cybersecurity Framework 2.0.

Security coverage for a small business

Yes, if you handle customer data, regulated data, or money, and that's nearly every business. Size changes the scale, not the need. The real question isn't whether you need EDR, a SIEM, and a SOC. It's whether you get all three as a service or try to assemble the pieces yourself.

You need all three if you

• Store or process customer personal information
• Send, receive, or approve payments, wires, or invoices
• Handle regulated data, such as financial records, health information, or controlled unclassified information (CUI)
• Run your business on Microsoft 365, Google Workspace, or other cloud apps
• Have cyber insurance, compliance requirements, or customer contracts that ask how you detect and respond to threats

Attackers don't scale down their methods for small companies. A five-person firm with a compromised email account loses money the same way a 500-person firm does.

Where small businesses go wrong is buying one piece and assuming it's the whole system. Review each layer of the service so that separate line items do not leave an unintended coverage gap.

At Headway, every client gets CrowdStrike Complete Defend EDR, a 24x7 SOC averaging under one second to respond, and CrowdStrike Next-Gen SIEM with 365-day retention. Our SIEM pulls from sources including Microsoft, Okta, Cisco, Google, Azure, and AWS. Every client gets the same tools, whatever their size. See how our cybersecurity works.

Frequently asked questions

Review the security coverage you have

The quick recap. EDR is the lock and alarm on every door. The SIEM is the camera that records and keeps the footage. The SOC is the people watching the screens and acting, at 2 a.m. on a Saturday too.

Miss one, and you've got a building that only looks secure.

At Headway, you don't have to piece it together or pay extra for it. EDR, a 24x7 SOC, and SIEM come standard for every client.

If you can't name who's watching your alerts at 2 a.m., you don't have all three.