Antivirus blocks threats it already recognises. EDR watches for suspicious behaviour it has never seen before and responds to it in real time.
