Antivirus is the oldest protective layer on an endpoint \u2013 and today only one of several.<\/p>\n
Signatures catch the known reliably and fast. Behavioural analysis catches the unknown, at the price of false positives. Only the two together add up to usable protection.<\/p>\n","protected":false},"featured_media":0,"template":"","glossary_intl_set":[],"glossary_intl_cluster":[392],"glossary_intl_theme":[],"class_list":["post-29155","glossary_intl","type-glossary_intl","status-publish","hentry","glossary_intl_cluster-cybersecurity"],"acf":{"card_description":"Software that detects and removes malicious programs.","nav_theme":"","nav_subtheme":"","dataset_version":"","term_inline":"","term_plural":false,"heading_overrides":null,"synonyms":null,"lead_definition":"Antivirus software detects, blocks and removes malicious programs. Modern products no longer rely on signatures of known threats alone; they also watch how processes behave.","at_a_glance":[{"bullet":"
Signatures catch the known<\/b>; behavioural analysis also catches the unknown.<\/p>\n"},{"bullet":"
Out-of-date antivirus is worse than none \u2013 it fakes safety.<\/p>\n"},{"bullet":"
On an endpoint it is one layer among several, not a substitute for the rest.<\/p>\n"}],"intro_answer":"","steps_answer":"","steps":null,"examples":[{"example":"
Behavioural analysis stops an unknown encryptor because it rewrites hundreds of files in seconds.<\/p>\n"},{"example":"
A false positive blocks an internal tool \u2013 with no exception process, the department stops.<\/p>\n"}],"misconception":[{"myth":"\u201cWith antivirus I am safe.\u201d","reality":"Antivirus mostly catches the known. It does nothing against phishing, misconfiguration or stolen credentials."}],"faq":[{"q":"Is the operating system's built-in protection enough?","a":"For many environments yes, provided it is centrally monitored \u2013 the hardening guidance is in the CIS Benchmarks<\/a>."},{"q":"Why do false positives happen?","a":"Because behavioural analysis reacts to patterns, not certainty. The BSI IT-Grundschutz<\/a> recommends a defined exception process for exactly that."}],"compare_answer":"","compare":null,"variants":null,"signals_answer":"","signals":null,"protect_answer":"","prevent":null,"incident":null,"related_terms":null,"pillar_link":null,"sources":[{"publisher":"","name":"BSI IT-Grundschutz","url":"https:\/\/www.bsi.bund.de\/DE\/Themen\/Unternehmen-und-Organisationen\/Standards-und-Zertifizierung\/IT-Grundschutz\/it-grundschutz_node.html","doc_type":"","group":"used"},{"publisher":"","name":"CIS Benchmarks","url":"https:\/\/www.cisecurity.org\/cis-benchmarks","doc_type":"","group":"used"}],"reviewer":{"name":"Jakub Novak","qualification":"IT security","date":"2026-06-01"},"disclaimer":""},"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t