Antimalware and antivirus get used as if they were different things, and twenty years ago they were. Today they name the same product, and the distinction that does matter is a different one: the one between blocking what is already known and detecting somebody who is inside using legitimate tools.
An antimalware is the program that tries to stop malicious software from running on a machine, and to remove it if it is already running. Malware is the umbrella term: it takes in ransomware, trojans, rootkits, infostealers, spyware and also computer viruses, which are just one more category.
From there comes the answer to the question that almost everybody asks. Antivirus was born when the virus was the dominant problem, and the name stuck. When the problem widened, the same products widened their coverage and some vendors started calling themselves "antimalware" to say precisely that. Today, in any current commercial product, antivirus and antimalware name the same tool. You do not need to buy both, and buying two usually makes them get in each other’s way.
It is worth saying it that plainly, because the comparison that goes around ("antivirus for viruses, antimalware for everything else") describes the market of two decades ago and leads to the wrong decisions today.
Signatures. This is the original mechanism: the file gets compared against a catalogue of known samples. It is fast, cheap and produces almost no false positives. Its limit is structural: it only recognises what somebody has already seen and catalogued, and changing a file enough for its signature not to match is trivial.
Heuristics and static analysis. Instead of the exact file, it looks for suspicious traits: how it is packed, which functions it imports, which strings it contains. It reaches new variants of known families, and in exchange it starts getting uncommon legitimate software wrong.
Behaviour. The program is allowed to run, under watch, and it gets judged on what it does: whether it starts encrypting files in bulk, reading the memory of other processes or writing where it should not. It is the most powerful of the three because it does not depend on knowing the file, and it is also the one that arrives latest, because to judge behaviour you have to let something start behaving.
The limit of an antimalware is not that a new sample slips past it. It is that a good part of the attacks we see in a test do not include a malicious file to analyse at all.
The most common case is the use of tools that are already on the system and are legitimate: command interpreters, remote administration utilities, package managers. It is called living off the land, and the whole point of it is that there is nothing to put in quarantine, because the binary belongs to the operating system itself and is signed.
The second case is fileless malware, which lives in memory or in the system configuration and never gets written to disk, which is where classic analysis looks.
And the third one, which explains the most incidents, is not malware at all: it is an authenticated attacker with a valid credential. Nothing they do is technically anomalous. They connect, they read, they copy. An antimalware is not designed to have an opinion about that.
Out of that gap come the three acronyms that are actually bought in a business today, and it is worth knowing what each one is before somebody sells them to you.
EDR (endpoint detection and response) keeps the blocking of an antimalware and adds what it lacks: it records continuously what happens on the machine, it lets you reconstruct the sequence afterwards, and it isolates the machine from the network. The practical difference is that an antimalware tells you that it blocked something, and an EDR lets you ask what happened before.
XDR extends that same idea beyond the endpoint, correlating what happens there with identity, email, network and cloud, so that one and the same attack is not seen as four separate alerts in four consoles.
MDR is not a different technology: it is somebody actually looking at it. It is the service of people who watch and respond using those tools, and it is usually the piece that decides the outcome, because an alert at three in the morning in a console that nobody opens is not a detection.
Put without dressing it up: most companies do not need a better antimalware, they need somebody to look at the one they already have.
Keep an up-to-date antimalware on every workstation and every server: it still stops an enormous amount of noise and it is cheap. Do not buy two. And do not treat it as the defence, because it covers one layer of an attack that has several.
If your company has something to lose, the step that matters is not changing vendor: it is going from blocking to being able to investigate, and having somebody on duty. And the way to find out what you would need is not to read a comparison chart: it is to check what gets detected when somebody actually tries, which is what an internal penetration test measures.
Asperis does not sell antimalware, or EDR, or any endpoint product. What we do is check whether the one you already have notices.
What the secure development lifecycle is, what happens in each phase, what SAST, DAST and SCA add, and where to start if you have nothing in place today.
What risks generative AI brings into a company, why prompt injection is not the real problem, and what an AI pentest actually tests.
What a penetration test is, what phases it has, what you get at the end, how long it takes and how it differs from a vulnerability scan.
If any of this looks like a problem you are carrying, half an hour on a call scoping it with a senior pentester is worth more than reading another article.
Talk to a senior pentesterPick a time that suits you. You tell us what you need and where you are, and we explain how we work and how we can help.
