EDR vs Antivirus for Dental Offices: Which One Do You Need in 2026?

The renewal form asks whether every computer runs EDR. Your IT proposal has a line called "endpoint detection and response" at a few dollars a device, and the antivirus you already pay for is listed right above it. One commenter on a dentists' forum put the worry plainly in December 2025: "Ransomware will encrypt any files it can on any drive it can see." So which of these two tools actually stops that, and are you being sold the same thing twice?

This guide compares the two for a single office or small group: what each sees and does, which situation calls for which, what the HIPAA Security Rule text actually names, what vendors publish on price, and the part only your IT provider deals with: exclusions for Dentrix and Open Dental, Microsoft Defender's passive mode, the server, and what happens when EDR isolates a computer with a patient in the chair. Every regulation, vendor and government page quoted here was read on 6 November 2026.

EDR vs antivirus: the comparison at a glance

The quickest way to see the difference is to follow an attack through its stages and ask what each tool is doing at that moment. Antivirus is strongest at the first stage, when a known malicious file lands. EDR earns its keep in every stage after that, when an attacker is already using legitimate tools on your network.

Antivirus answers "is this file bad?". EDR answers "what is happening on this computer, and is it normal?". The rest of this guide explains why that second question matters more on a dental network than in an ordinary office.

What does antivirus actually do on a dental workstation?

Antivirus scans files and running programs, compares them with a database of known malware and behavior rules, and blocks, quarantines or removes what it recognizes. It is the baseline control every computer should have, and it is already built into Windows as Microsoft Defender Antivirus. Its weakness is anything it has never seen before.

NIST's malware guide calls antivirus "the most commonly used technical control for malware threat mitigation", and that is still true. Modern products are better than the signature scanners of ten years ago: they use cloud look-ups, reputation scores and some behavior rules, which is why vendors now sell them as "next-generation antivirus". But the model is the same. Something has to be recognized as bad before it is stopped.

Three things about antivirus matter specifically in a dental office:

• • It is already there. Microsoft's documentation states that "Microsoft Defender Antivirus is built into Windows" and that it is available in Windows 10, Windows 11 and versions of Windows Server. A workstation with no third-party product is not unprotected; the question is who manages it and who sees its alerts.
• • It needs exclusions, and exclusions are holes. Dentrix's own System Requirements 2026 say antivirus "is recommended on all computers" and then ask you to "consider the needs of your office and the inherent risks in excluding certain items from the protection afforded by antivirus software", pointing to the Dentrix Resource Center for how to exclude the Dentrix program directory. Open Dental's manual lists products "verified to cause slowness" and says the MySQL data directory on replication servers "should not be included in real time scans". Every excluded folder is a place antivirus is not looking, and attackers know which folders dental software uses.
• • It stops at the file. NIST describes today's malware as "specifically designed to quietly, slowly spread to other hosts, gathering information over extended periods of time". An attacker who signs in with a stolen password and uses Windows' own tools gives antivirus nothing to match.

Open Dental's manual is blunt about the floor: "Every computer in the office absolutely must run real-time antivirus protection", and in the same breath, "No antivirus software is perfect however, so make quality Backups." That is the honest summary of antivirus: necessary, not sufficient.

What does EDR do that antivirus does not?

EDR records activity on each computer (which programs start, what they open, where they connect, which accounts they use), analyzes that stream for attack patterns, raises an alert, and lets a responder act: isolate the machine, kill a process, pull the timeline. It is a detection and response tool, not only a prevention tool.

Microsoft's own one-line definition on its Defender for Business page is useful because it is plain: "Endpoint detection and response (EDR) is the part that spots an attack and responds." Breaking that into the four jobs an EDR agent does:

Two consequences follow for a dental office. First, EDR gives you a record. The Security Rule's technical safeguards include "Audit controls": mechanisms that "record and examine activity in information systems that contain or use electronic protected health information" (45 CFR 164.312(b)). EDR telemetry is one kind of record that covers a workstation and a server alike without anyone remembering to look; whether it is the right one for your practice is a question for your risk analysis, not for this article. Second, EDR can act at 2 a.m. The response step is the part that separates a product from a managed service, and it is the first thing to ask about (see the checklist below).

CISA's ransomware guide puts EDR in the prevention list, alongside application allowlisting: use "endpoint detection and response (EDR) solutions on all assets to ensure that only authorized software is executable and all unauthorized software is blocked." Note the phrase "all assets". An EDR agent on the front-desk PCs but not on the server, or not on the imaging workstation because "it slows the sensor", leaves the two machines that matter most unwatched.

Which one does a dental office need?

Both, as one agent, managed by someone who answers alerts. Antivirus alone leaves the practice server, the single machine that holds every chart and image, without anyone watching what happens on it. EDR without working antivirus means more alerts to triage. The real decision is not EDR or antivirus; it is unmanaged versus managed.

The Windows row deserves one more sentence. The best EDR agent on an operating system that no longer receives security updates is still watching a machine that attackers can enter through known, unpatched holes. If any computer in the office is still on Windows 10, read our guide to the Windows 10 end of life risks first, and if the server is on 2016, the Windows Server 2016 end of support dates set your timeline.

Why does the difference matter more on a dental network than in a typical office?

A dental network concentrates everything an attacker wants in one place, the practice server, and surrounds it with machines that are hard to protect: imaging workstations that cannot be rebooted mid-procedure, shared front-desk logins, and vendors that remote in. Antivirus protects each file; EDR is the only tool that watches the pattern across those machines.

Put the pieces side by side with what the public record says attackers do:

• • Healthcare is in the top three. The FBI's 2025 report says the top ten reported ransomware variants "most impacted the following Critical Sectors: Critical Manufacturing, Healthcare and Public Health, and Government Facilities", and lists Akira, Qilin, INC/Lynx/Sinobi, BianLian, Play and others. In 2025 the IC3 "received more than 3,600 complaints reporting ransomware, with losses exceeding $32 million". A dental office is a healthcare entity to an attacker, not a small business.
• • The server is the prize. Open Dental's manual describes the outcome: "Ransomware encrypts your database so that it cannot be accessed." Its best-practice page tells offices to "Turn off mapped drives" because "This can prevent ransomware from jumping computers", and to "Never surf the internet from a computer acting as your server." Each of those is a behavior EDR can see (a workstation account enumerating shares, a browser running on the server) and antivirus cannot.
• • Shared logins hide the attacker. One owner on a forum in October 2026 said they could "access any dental office computers within 5 password attempts". When six people share FRONTDESK, antivirus has no reason to care which human is at the keyboard; EDR at least sees that FRONTDESK started doing something FRONTDESK has never done. Fixing the sharing itself is covered in our guide to password management for dental offices.
• • Imaging workstations get exclusions. Sensor drivers, CBCT reconstruction and imaging bridges are exactly the software that gets excluded from scanning so the capture does not stutter. An attacker who lands in an excluded folder is invisible to antivirus; EDR still records what the process does.
• • The clock runs during clinic hours. NIST's description of malware that spreads "quietly, slowly" means the first click is often days before the encryption. The practice that finds out at 7:30 a.m. on a Monday, with a full schedule, is the one that had nothing watching over the weekend.

For the human side of the same attacks, the phishing emails and the vendor-impersonation calls, see how dental practices get hit by ransomware and phishing.

What do EDR and antivirus cost for a small practice?

Published list prices for endpoint protection run from about three dollars per user to about fifteen dollars per device per month, before management. Antivirus is often already paid for inside Windows or a Microsoft 365 license. The larger cost in a managed arrangement is the person or team who responds to alerts, which is why providers price it per endpoint.

The prices below are what each vendor publishes on its own page. They are list prices for the software only, not what any IT provider charges to manage it.

Vendor pages read 6 November 2026. Prices and plan contents change; confirm in writing before you buy.

Three cost points the price pages do not show:

1. 1. Per user versus per device. Microsoft prices Defender for Business per user, and its page says each user license covers "up to five devices per user"; CrowdStrike prices per device. A practice with a dozen user accounts, 18 computers, a server and two laptops will pay differently under each model. Count both before comparing.
2. 1. The server is extra or separate. Workstation bundles often exclude servers, and the server is the machine you most want watched. Ask for the server line explicitly.
3. 1. Management is the real line item. Software that nobody watches is the "expensive antivirus" problem. When an IT provider quotes EDR per endpoint, the price should include who responds, how they reach you, and what they will do without calling you first. If the quote is part of a monthly plan, our page on managed IT services for dental practices describes what a plan normally covers.

If you want to compare the spend against what a day without the server costs, our guide to dental data backup and restore times is the other half of the arithmetic.

EDR, MDR and XDR: what do the letters mean for a dental office?

EDR is the software on the computer. MDR (managed detection and response) is EDR plus a team that watches it and responds, around the clock. XDR (extended detection and response) adds signals from email, identity and cloud services to the same console. For most dental offices the practical choice is between EDR you manage and EDR someone manages for you.

Two cautions when reading proposals. "Includes EDR" tells you a product class, not a service; ask who responds. And "24/7 SOC" (security operations center) is a vendor's claim about the vendor; ask how an alert on your server at night reaches a person who can isolate it, and what the written procedure is.

Does HIPAA require EDR?

The HIPAA Security Rule names no product, so its text does not mention EDR or any particular antivirus. It does list "protection from malicious software" as an addressable implementation specification: "Procedures for guarding against, detecting, and reporting malicious software" (45 CFR 164.308(a)(5)(ii)(B)). How a practice meets and documents that is for the practice and its compliance advisor.

That one sentence of regulation is worth reading slowly, because the three verbs map onto the two tools:

The same section also lists "Log-in monitoring": "Procedures for monitoring log-in attempts and reporting discrepancies" (164.308(a)(5)(ii)(C)). Sign-in events are part of what an EDR agent records, which is one reason providers reach for it when a practice asks how to show monitoring is happening.

Two things this section is not. It is not a reading of what the rule requires of your practice; "addressable" means the practice assesses the specification and documents what it implements, and that assessment belongs with whoever runs your risk analysis. And it is not an insurance opinion. If your renewal asks about EDR, the only reliable answer is on your own application form; pull the latest one and read the endpoint or security-controls section. Our guide to dental cyber insurance requirements lists the controls that commonly appear on those forms and how to evidence each one.

The IT side: how EDR and antivirus are set up in a dental office

The product matters less than the setup. The usual failures in dental offices are two antivirus engines fighting, exclusions wide enough to hide an attacker, a server with no agent, imaging workstations nobody onboarded, and a console whose alerts go to an inbox nobody reads. Each has a specific fix, and each is a question for your provider.

One agent, not two. Installing a third-party product next to Microsoft Defender Antivirus does not double the protection. Microsoft's documentation explains that when another antivirus is present, Defender Antivirus may run in "passive mode", in which it "isn't used as the primary antivirus app on the device. Files are scanned, and detected threats are reported, but threats aren't remediated". Two active engines on one PC is the classic cause of slow imaging capture and random lock-ups. The right state is one active engine, one EDR agent, and the passive one reporting into the same console or removed.

Exclusions are a decision, not a default. Dentrix asks offices to weigh "the inherent risks in excluding certain items" and to follow the Resource Center's configuration for the Dentrix program directory. Open Dental says the MySQL data directory on replication servers "should not be included in real time scans" and "should be included separately in a periodic (daily) scheduled scan during non-operating hours because it will interfere with operations by locking the mysql tables". Good practice is the same for both: exclude the narrowest path the vendor names, scan it on a schedule after hours, keep EDR behavior monitoring on for those folders (in many EDR products a scan exclusion does not switch off behavior monitoring; ask your provider to confirm it for yours), and write the list down so the next technician does not widen it.

The server gets the agent first. The practice server holds the database, the images folder and the backup jobs. Workstation-only bundles leave it out, and some providers skip it because "nobody browses on the server". Open Dental's own advice is to "Never surf the internet from a computer acting as your server", which is a reason to watch it, not to skip it. Confirm the server is onboarded and that the agent is supported on its Windows Server version.

Imaging workstations are onboarded, with the vendor's requirements in hand. Sensor and CBCT software is sensitive to anything that touches its folders during capture. The fix is the vendor's published exclusion list plus a test capture after onboarding, not leaving the room's PC off the console.

Isolation has a procedure. EDR's strongest response, network isolation, cuts a machine off from everything except the console. On the operatory PC at 10:15 with a patient waiting, that is a visible event: the sensor software may lose its connection to the server. Agree in advance who may isolate what, whether automatic isolation is allowed on the server during clinic hours, and how the front desk is told. A provider who cannot answer this has not thought about dentistry.

Alerts reach a person. An alert that lands in a shared mailbox is an audit trail, not a response. Ask where alerts go at 2 a.m. and on Saturday, how quickly a human looks, and what they are authorised to do. This is the difference between EDR and MDR in practice, and the reason monitoring, not software, is the line to pay attention to.

Remote tools are watched too. Vendor and IT remote-support tools are legitimate programs, which is why attackers use them; a 2025 breach at a dental group, discussed on an MSP forum, began, in the words of one post, with "the execution of a malicious version" of a trusted tool. EDR can alert when a remote tool runs outside its normal hours or from a new account. Your provider should be able to show you that rule.

Patching comes first. Microsoft states Windows 10 "will reach end of support on October 14, 2025". A machine on an unsupported operating system cannot be made safe by an agent, and each EDR vendor publishes its own list of supported Windows versions, which old releases fall off. If your office is in North Texas and wants the operating-system inventory done alongside the endpoint review, our dental IT support in Dallas–Fort Worth team covers both.

Microsoft 365 is part of the picture. Because Defender for Business is included in Microsoft 365 Business Premium and priced per user, an office that already pays for Premium may own the EDR license and simply never have onboarded devices. Our guide to Microsoft 365 for dental offices covers what each plan includes and how to tell.

How do you move from antivirus to EDR without breaking the practice software?

Move in stages, server last. Inventory every machine and its operating system, deploy the EDR agent with the practice-software vendors' exclusion lists already loaded, run a week in detect-only mode, test a capture in every operatory, then switch on blocking and isolation with a written clinic-hours rule. Remove the old antivirus only after the new agent is confirmed active.

1. 1. Inventory. List every workstation, laptop, server and imaging PC with its Windows version, the antivirus currently installed, and whether anyone watches its alerts. Anything on Windows 10 or Server 2016 goes on a replacement list before the agent list.
2. 1. Decide the model. Per user (Microsoft) or per device (most others); workstations and server; who responds and when. Get the response procedure in writing before buying software.
3. 1. Load the exclusions first. Collect the current exclusion lists from your practice-software and imaging vendors (Dentrix's Resource Center, Open Dental's manual, your sensor and CBCT vendors). Put them into the EDR policy before the first install, so nothing stutters on day one.
4. 1. Deploy in detect-only mode. Start with two or three workstations, then the rest, then the server, over a week. Read every alert. Most early alerts are the practice software doing something unusual but legitimate; tune those as exceptions, not blanket exclusions.
5. 1. Check the engine state. On each machine confirm one active antivirus engine, Defender in passive mode or removed, and the EDR agent reporting to the console.
6. 1. Test the clinic. Take a test X-ray in every operatory, run an imaging export, print a claim, open the practice software from the server and a workstation. Note anything slower than before and fix the specific path, not the whole folder.
7. 1. Switch on response. Enable blocking, then isolation, with the written rule for clinic hours and the server. Run a tabletop: "the operatory 3 PC is isolated at 10:15, what happens?"
8. 1. Remove the old product. Open Dental's manual notes that for some products "turning off is not sufficient; must be uninstalled". Uninstall cleanly, reboot, re-check the engine state.
9. 1. Document. The exclusion list, the response procedure, who gets alerts, and the date each machine was onboarded. That document is what you hand an auditor or an insurer; it is also what tells the next technician why the list looks the way it does.

If an incident has already happened, this is not the moment for a migration; our dental ransomware recovery playbook covers that order of work.

What to ask your IT provider about EDR and antivirus

Take these twelve questions to whoever runs your computers today, and ask for the console on screen rather than a yes. A provider doing this well answers each one in a minute; a provider selling an invoice word stalls on the response and setup questions. Write the answers down; they become your record for the renewal form.

How Legend Networking can help

Legend Networking is a dental IT company based in Dallas, Texas, with 22+ years in dental IT. It has served over 3,500 practices since 2004 and supports the IT environment for the practice software Dentrix, Eaglesoft, Open Dental and Archy, and for the imaging systems DEXIS, Vatech, Carestream, Planmeca/Romexis and Dolphin Imaging, which is where antivirus exclusions and imaging-room onboarding are decided.

Legend provides 24/7 monitoring with in-house engineers (no outsourced first-level triage), and onsite dispatch by appointment across served dental markets, remote-first nationwide. The author, Ian Lynch, has 22 years in dental IT and oversees the NOC, onsite dispatch and client technology roadmaps. Legend holds a 4.8 rating from 173 Google reviews. For the shape of an endpoint and network review at onboarding, see a managed IT onboarding for a Texas practice that covered network and server review, security, backups, software and user access, and for the wider set of safeguards, our dental cybersecurity services page describes how the layers fit together. The full list of controls a small practice should have is in our dental cybersecurity checklist.