Antivirus has been around long enough that it feels like a solved problem: install it, see the green tick, move on. And for the threats of fifteen years ago it was. The trouble is that the people writing malware read the same reviews you do, and they build for the world where everyone has antivirus.
How antivirus works, and where it stops
Classic antivirus is a bouncer with a photo album. If the file at the door matches a known bad photo, it is refused. Excellent against yesterday's malware. Useless against a file created this morning, and irrelevant when the attacker never brings a file at all — they simply log in with a password they stole and use the tools already on your computer. No malware, no photo, no alarm.
What "endpoint detection and response" adds
EDR — the thing insurers now ask for by name — watches behaviour rather than photos. A word processor suddenly encrypting three thousand files is not normal, whoever started it. EDR notices, stops the process, isolates the machine from the network and raises the alarm. The photo album is still there; it just is not the only guard.
The layers, in plain terms
- Identity: multi-factor authentication, so a stolen password alone opens nothing.
- Email: filtering that strips malicious links and attachments before anyone can be curious about them.
- Endpoint: behaviour-based protection on every workstation and server.
- Network: a managed firewall and segmentation so one infected laptop cannot wander.
- Backup: isolated, tested copies — the layer that turns a disaster into an inconvenience.
- People: a team watching the alerts around the clock, because an alarm with nobody listening is just a noise.
The smoke-detector rule
Nobody relies on a smoke detector alone. You also have an extinguisher, an exit plan and, ideally, someone who does not store fireworks next to the stove. Security is the same: assume something will get past the first layer, and make sure the next layer catches it. When our engineers set up an environment, the question is never "is antivirus installed?" but "if this laptop is compromised at 2 a.m., what happens next?" — and the answer has to be "we already know, and it's handled".
