EDR is the sensor, and MDR is the team of people who respond when it fires. XDR extends detection to identity, email and cloud. Compare detection quality in independent tests, whether the MDR team can isolate hosts on your behalf, and how quickly they respond at 3am.
Why it works
Insurers consistently ask whether you run EDR and whether someone monitors it. Ransomware is far less likely to succeed when endpoints are watched and can be isolated quickly.
What to look for
Someone should monitor it around the clock and have the authority to contain threats.
It should cover servers as well as laptops.
It should be able to roll back or remediate ransomware.