Antivirus

Antivirus (AV) is software that detects and removes malicious programs from computers — historically focused on viruses but today protects against trojans, worms, spyware, ransomware, and other malware. Traditional antivirus uses signature databases (known malware fingerprints) and heuristics. Modern endpoint protection — often called NGAV (Next-Generation Antivirus) or EDR — adds behavioural analysis, machine learning, and cloud threat intelligence to catch attacks that signature-based AV misses (zero-days, fileless malware, polymorphic malware). In 2026, pure signature antivirus is no longer sufficient; modern endpoint protection combines NGAV + EDR for layered defence.

**Antivirus (AV)** uses signatures and basic heuristics to detect known malicious files at the file level — fast, low-overhead, but bypassed by polymorphism, fileless attacks, and zero-days. **EDR (Endpoint Detection and Response)** monitors *behaviour* across the endpoint — process trees, file activity, network connections, registry changes — and detects suspicious patterns regardless of the underlying file. EDR also provides forensic visibility (investigate the last 30-90 days) and response capability (isolate device, kill process, rollback). Modern endpoint protection products (CrowdStrike Falcon, Microsoft Defender, SentinelOne, Sophos Intercept X) combine NGAV + EDR — sometimes called EPP+EDR. For most organisations in 2026, the question is not 'AV or EDR' but 'which combined NGAV+EDR product'.

Five complementary techniques in modern AV: (1) **Signature detection** — matches known malicious file hashes or code patterns (effective against widespread malware, bypassed by polymorphism), (2) **Heuristic analysis** — looks for suspicious code structures or API calls, (3) **Behavioural analysis** — monitors what processes do at runtime (modern primary technique), (4) **Sandbox detonation** — runs suspicious files in isolated environment, (5) **Machine learning models** — trained on millions of samples to spot novel malware. No single technique catches everything; modern endpoint protection combines all five.

Yes — endpoint protection (NGAV + EDR) is mandatory for Windows in 2026. Microsoft Defender Antivirus is built into Windows 10/11 and provides solid baseline protection at no extra cost. For organisations with M365 E5 licences, Microsoft Defender for Endpoint adds full EDR/XDR capability. Third-party alternatives (CrowdStrike, SentinelOne, Sophos, Bitdefender, ESET) often deliver better detection rates and richer EDR features at additional cost. Cyber insurance carriers and regulations (NIS2, DORA, ISO 27001) effectively require endpoint protection. Pure antivirus without behavioural detection is insufficient — choose NGAV+EDR products.

Microsoft Defender Antivirus has improved dramatically since 2018 and now competes with paid AV products in independent tests (AV-Comparatives, AV-Test, MITRE ATT&CK Evaluations). For consumer use and small businesses, it provides solid protection. For enterprise: (1) baseline Defender Antivirus is strong but lacks EDR features, (2) Defender for Endpoint Plan 1 adds basic EDR (also licensed standalone), (3) Defender for Endpoint Plan 2 adds full EDR/XDR with threat hunting (standalone licence or included with M365 E5). Best-in-class third-party EDR (CrowdStrike, SentinelOne) typically beats Defender on macOS and Linux, and offers more mature threat intelligence — but Defender is the easiest path for Windows-heavy estates already on M365.

By tier: (1) **Enterprise leaders** — CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne Singularity, Palo Alto Cortex XDR, Trellix; all combine NGAV + EDR + threat intelligence, (2) **Mid-market** — Sophos Intercept X, Bitdefender GravityZone, Trend Micro Vision One, Cybereason, ESET PROTECT, (3) **Consumer/SOHO** — Bitdefender, Norton, Kaspersky (politically restricted in some countries), ESET, Avast, AVG. Independent testing labs (AV-Comparatives, AV-Test, SE Labs, MITRE ATT&CK Evaluations) publish quarterly reports — selection should weight test results plus integration with existing identity (Entra ID, Okta), MDM, and SIEM.

Modern endpoint protection (NGAV + EDR) is one of the most effective controls against ransomware, but no single tool stops it completely. Layered defence is essential: (1) NGAV/EDR with behavioural detection catches most ransomware before encryption starts, (2) EDR rollback capability undoes file changes if encryption begins (CrowdStrike, SentinelOne), (3) Application allow-listing blocks unauthorised executables, (4) Email security stops the most common entry vector, (5) Patch management closes vulnerable VPN gateways and exposed services that ransomware operators exploit, (6) Immutable backups enable recovery without paying ransom. EDR alone reduces ransomware risk dramatically but doesn't eliminate it — combine with the other layers and 24/7 SOC monitoring.