Antivirus alone is not enough for endpoint security. It is a useful layer against known malicious files, but it does little against stolen credentials, unpatched software, misused built in tools or an employee who approves a fraudulent request. Treat it as one control among patching, privilege limits, backups and logging.
What does antivirus do well?
Antivirus compares files and behavior against known signatures and heuristics, then blocks or quarantines matches. NIST SP 800-83 Rev. 1, the guide to malware incident prevention and handling, lists antivirus software as a core technical control, alongside patching, firewalls and limiting user privileges. It remains cheap protection against the huge volume of commodity malware.
If a user downloads a known trojan, a current engine will usually catch it. That is real value and worth keeping.
What does it miss?
Attackers know the product category exists and plan around it.
Valid logins. If someone phishes a password and signs in to a web mail account or a remote desktop, no malicious file ever lands on disk.
Living off the land. Built in tools such as scripting engines and administrative utilities can do the attacker's work. MITRE ATT&CK documents many techniques that abuse legitimate system features, which makes them hard to separate from normal administration.
Unpatched software. An exploit against a browser or document reader runs inside a trusted program. Scanning files helps little if the flaw is in the program itself.
New or modified malware. Signatures lag behind fresh samples. Behavior based detection narrows the gap but does not close it.
Human decisions. A convincing invoice scam asks a person to move money. The endpoint is clean.
Constructed example: the clean laptop
An accounts employee receives a message that mimics a supplier portal and enters their password. The attacker signs in from another country and sets a mailbox rule forwarding invoices. The laptop never ran anything suspicious. Antivirus reports a clean machine, and it is clean. The incident is in the identity system and the mail rules.
Two inexpensive controls would have changed the outcome: multi factor authentication on the account, and an alert on new forwarding rules.
What belongs next to antivirus?
Start with patching. NIST SP 800-40 Rev. 4 treats patching as routine maintenance and offers a planning model for it. Close the browser, operating system and document software gaps first, since they are the most targeted.
Next, limit privilege. Day to day accounts should not be local administrators. Malware that runs as a standard user has a much smaller blast radius.
Then application control, where practical, so only approved programs run. Add full disk encryption for lost devices, tested backups kept offline, and central logging.
Detection tools that watch endpoint behavior can add visibility, but they need people or a service to act on alerts. Buying one without an owner is the same mistake as installing antivirus and never checking the console.
Developer machines deserve special thought. Packages pulled during a build run code on the machine, so a malicious dependency bypasses the file scan model entirely. Safeguard's dependency scanning is aimed at that gap, checking packages before they reach a build.
How to check or apply this
- Confirm antivirus is installed, updating and reporting on every endpoint. Investigate any silent device.
- Enforce multi factor authentication on email and remote access.
- Remove local admin rights from daily accounts.
- Patch operating systems and browsers on a fixed schedule, with a faster path for exploited flaws.
- Keep offline or immutable backups and run a restore test each quarter.
- Alert on new mailbox rules, new admin accounts and disabled security tools.
- Write down who responds when a laptop is flagged, and how it is isolated.
Quick check
Can I drop antivirus if I have other controls?
It is not wise. Antivirus is inexpensive protection against common malware, and NIST lists it among core controls. Keep it and add the others.
Why did my attack happen with a clean antivirus report?
Many attacks use stolen passwords or legitimate tools, which leave no malicious file for antivirus to find.
Sources
- NIST SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling
- NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning
- MITRE ATT&CK
- CISA Cyber Essentials
Last reviewed: 18 October 2026.
