Antivirus software scans files and watches host activity to find, block and clean up known malware. NIST calls it the most commonly used technical control against malware. It works best kept current and centrally managed, and it is not enough alone, because mostly signature based tools struggle with malware customized for each target.
What does antivirus do?
NIST SP 800-83 Rev. 1, the guide to malware incident prevention and handling, lists the capabilities most products provide:
- Scanning critical host components such as startup files and boot records.
- Watching real time activity, such as scanning email attachments as they are sent and received, and scanning each file as it is downloaded, opened or executed. This is on access scanning.
- Monitoring the behavior of common applications such as email clients, web browsers and instant messaging software.
- Scanning files for known malware, including regular scans of all drives and, optionally, removable media. A user launching a scan manually is on demand scanning.
- Identifying common types of malware and attacker tools.
- Disinfecting files, meaning removing malware from inside a file, or quarantining files that cannot be cleaned.
NIST adds that organizations should use both host based and network based scanning, and deploy antivirus on all hosts for which satisfactory software is available.
Why is it not enough?
The same guide is direct about the limit. It describes malware customization: when attackers can send a unique attack to each potential victim, largely signature based controls such as antivirus software cannot keep up. Its recommended mitigation is defense in depth, using several detection techniques so that at least one is likely to catch the malicious behavior.
Signatures describe what a known threat looks like. A new variant, a tool that is not malware by itself, or an attack that abuses built in system features has no signature to match. Behavior monitoring helps, which is why NIST lists it among the capabilities, but it too has gaps.
NIST also separates attacker tools, such as port scanners and password crackers, from malware. They cannot infect a host on their own, but antivirus often detects and removes them, so a hit on one tells you someone tried to put it there.
How should it be run?
Keep it current: NIST says antivirus is most effective when its signatures are fully up to date, and recommends updating software and signatures soon after installation, then performing a complete scan. Keep the product itself patched too, since flaws in antivirus software are a path for attackers.
Manage it centrally: administrators should control and monitor it, and users should not be able to disable or remove it or change critical settings. Administrators should monitor continuously to confirm hosts use current signatures.
Tie it to response: a detection is the start of work. NIST's guide pairs prevention with incident response, because widespread malware events need a prepared team.
A constructed example
A small firm has antivirus on every laptop with daily signature updates. A staff member opens a document that runs a script, which downloads a tool the vendor has never seen. Nothing alerts. A week later the firm's email filter flags unusual outbound mail volume. The postmortem does not conclude that antivirus failed. It concludes that antivirus is one layer. The firm adds application allow listing on finance machines, restricts script execution from documents, and sends endpoint logs to a central place where a person reviews new executables on those machines.
How to check or apply this
- Confirm antivirus is installed and running on every host where a supported product exists, and list the exceptions with reasons.
- Check update status: signature age and product version, across the fleet, not a sample.
- Lock settings so users cannot disable the agent or change critical options.
- Turn on on access scanning and behavior monitoring features, and schedule full scans.
- Add network layer scanning for mail and web traffic.
- Layer other controls: patching, least privilege, restrictions on running content from email, and logging that a person reviews.
- Rehearse the response to a detection: who investigates, how a host is isolated, and how you check for spread.
Quick check
Is antivirus the same as endpoint detection and response?
No. This article covers antivirus as NIST describes it. Other endpoint tools may add more telemetry and response features, so check what a given product does rather than relying on the label.
If antivirus found nothing, is the machine clean?
Not necessarily. A clean result means no match for what the tool knows. Custom or new malware may not match, so treat it as one input.
Sources
- NIST SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops
- NIST SP 800-83 Rev. 1, full text (PDF)
Last reviewed: 18 October 2026.
