Antivirus

Antivirus software detects, blocks and removes malicious software on a device, deciding whether a file is dangerous and stopping it before it runs.

The name is older than the job it now does. It was written for viruses, and it long ago grew to cover the rest of malware: worms, trojans, ransomware, and whatever else arrives as a file.

It remains the baseline control on an endpoint, and understanding what it can and cannot answer is more useful than arguing about whether it is obsolete.

How it decides

Signatures. A database of patterns matching known malicious code. Fast, precise, and worth exactly as much as the freshness of the database. See antivirus signature.

Heuristics and behaviour. Rules about what a file does rather than what it is, so that a variant nobody has catalogued can still be caught. This is where false positives come from, and where genuinely new samples get stopped.

Real-time protection. Watching file operations as they happen and intervening before execution, rather than finding the problem during a scan afterwards.

Scheduled and on-demand scanning. The sweep across what is already on disk, which catches what arrived while a definition was missing.

Updates. The whole model depends on them. An antivirus that has not updated is not a weaker control, it is a control for last month’s threats.

A worked example

Somebody receives a plausible-looking email with an attachment.

Before opening it, they scan the file. The scan identifies a trojan: software that would have given somebody else access to the machine.

The product quarantines it, removes it, and reports what it found.

That is the case antivirus is built for, and it handles it well. The interesting question is what happens in the case it is not built for.

Antivirus, EDR and XDR

These get sold as generations of the same thing, and they are not. The glossary entry for EDR answers the question directly: it is not a better antivirus.

Antivirus decides whether a file is bad and blocks it. Its strength is the signature, and its limit is that it needs to have seen the threat before, or something enough like it.

EDR records first and blocks second. It logs what processes do, with their command lines and their parent chains, and keeps that record so somebody can ask what this machine was doing forty minutes before the alert. An antivirus cannot answer that question, because it kept nothing. EDR also adds the other half, response: isolating a machine from the network without losing the agent, and acting on it remotely.

XDR is correlation. It joins what happened on the endpoint with what happened in identity, mail and cloud, so that a sequence of events that means nothing separately is recognised as one intrusion.

And here is what none of the three changes. Against somebody who arrives with valid credentials and uses the administration tools already installed on the machine, there is no bad file to detect, because nothing anomalous was executed. What separates the administrator from the intruder at that point is knowing what normal looks like on that machine, which is detection by baseline rather than by rule, and it is a different discipline from any of these three products.