Antivirus Software Advantages and Limitations

Antivirus used to be sold as the whole answer to cyber security. It’s a good tool, and a narrow one.

The short answer: antivirus spots and blocks known malicious files, and Windows already includes a good one in Microsoft Defender Antivirus. What it can’t stop is someone signing in with a stolen password, or an attacker who uses the tools already on your computers. For a business, antivirus is the floor; multi-factor authentication and endpoint detection and response (EDR) build on it.

What antivirus does well

Antivirus checks files and programs as they arrive and run, and blocks the ones it recognises as malicious. Modern antivirus doesn’t only compare files against a list of known threats: Microsoft Defender Antivirus uses machine learning and cloud lookups, and can stop some threats by their behaviour once they’ve started.

When it finds something, it quarantines the file so it can’t run, and tells you. That’s worth having on every device, and it’s why Cyber Essentials lists malware protection as one of its five controls.

Is the antivirus in Windows enough?

For the antivirus part, usually yes. Microsoft Defender Antivirus is built into Windows 10 and Windows 11, and it updates through Windows. If you install another antivirus product, it normally takes over from Defender; running two side by side rarely adds protection.

So the first job isn’t buying something. It’s making sure Defender is switched on and up to date on every device, and hasn’t been left switched off by an old product.

What antivirus can’t do

This is where the old “install antivirus and you’re covered” advice falls down:

• Stolen passwords. If someone has a password, they don’t need malware. They sign in. Antivirus never sees it.
• Attacks that use your own tools. Some attacks run through legitimate software already on the device (so-called fileless attacks), so there’s no malicious file to catch.
• Unpatched software. A known weakness in an out-of-date app or operating system is an open door, whatever is scanning files.
• Seeing the whole business. Antivirus looks after one device at a time. It won’t tell you that the same odd thing is happening on five laptops at once.

What a business adds on top

Four things, in rough order of value:

1. Multi-factor authentication on email and remote access, so a stolen password alone doesn’t get anyone in. The NCSC recommends it for exactly this reason.
2. Automatic updates everywhere they’re offered, with someone checking they’ve actually installed.
3. Endpoint detection and response (EDR), which watches behaviour across all your devices and can isolate one mid-attack. Microsoft 365 Business Premium includes Defender for Business, which has it.
4. Someone watching the alerts, including at night. EDR that raises an alarm nobody reads is a smoke detector with the battery out.

Our guide to endpoint security goes further into EDR and managed detection, and 5 ways to prevent malware covers the everyday habits.

How Jera can help

For the businesses we look after, we keep Defender and its detection running on every device, with security monitoring around the clock by an external security operations centre. Book a call and we’ll look at what’s protecting your devices today.