Managed IT
Antivirus is not broken. It does exactly what it was designed to do, which is recognize things it has seen before. The problem is that a great deal of what now reaches a laptop has never been seen before, or is not a file at all, or is your own administrative tooling being used against you. None of those look like anything on a list, and a list is what antivirus consults.
To understand what antivirus misses, it helps to know what it does. When a file arrives, antivirus calculates a fingerprint and compares it against a list of fingerprints belonging to known malicious files. If it matches, the file is blocked. If it does not, the file is allowed. That is the whole mechanism, and for a long time it was enough, because malware was files and files could be catalogued.
What antivirus was actually built for
The model has one structural requirement: somebody must have seen the threat before and added it to the list. That is fine for commodity malware circulating widely, which is genuinely most of what arrives, and it is why antivirus remains worth running. It is not fine for anything new, anything altered slightly to change its fingerprint, or anything that never writes a file to disk in the first place.
The Ponemon Institute reports that 60% of modern malware uses fileless or behavioral techniques that signature-based antivirus cannot detect. That is not antivirus performing badly. It is malware built deliberately to sit outside the category antivirus can evaluate.
Ponemon also puts 70% of successful cyberattacks as originating at endpoint devices, the laptops, desktops and servers people use daily. So the place attacks begin is the place the primary control has a known structural blind spot.
And nobody notices for a long time
IBM's Cost of a Data Breach research puts the average time to identify a breach at 194 days. That is not the time to fix it, it is the time before anyone realizes. Attackers use that interval to map the network, escalate privileges and stage data for exfiltration. Ransomware is simply the moment they choose to stop being quiet, and by then they have generally been present for months.
The techniques signatures cannot see
The Blind Spots
Three broad approaches, all common, none of which produce a file that can be matched against a list.
In plain terms
Fileless attacks
Memory-resident · Script-based · No disk artifact · Gone on reboot
Antivirus scans files. A fileless attack never creates one. The malicious instructions arrive through a document macro, a script, or an exploit, and execute directly in the computer's memory. There is nothing on the hard drive to fingerprint, so a scan of the disk finds a clean machine while the attack is running on it. This is also why fileless techniques are awkward to investigate afterwards, since much of the evidence disappears when the machine restarts.
In plain terms
Living off the land
PowerShell · Remote management tools · Built-in utilities · Signed binaries
Rather than bringing their own tools, attackers use the ones already installed. PowerShell, remote management utilities and other legitimate administrative software are present on the machine, digitally signed, and used by your own IT team daily. Antivirus cannot block them without breaking the business. The malicious part is not the tool but the sequence: a script pulling credentials from memory at 3am and connecting outward to an unfamiliar address. Each individual step is permitted. The pattern is the attack.
In plain terms
Never seen before
Novel malware · Automatic repacking · Targeted builds · Zero-day exploits
Signature matching requires the signature to exist, which means somebody had to encounter the threat, analyze it and publish the fingerprint. Attackers automate around this by altering the code slightly for each delivery, producing a different fingerprint every time while the behavior stays identical. A build created specifically for one target has by definition never been catalogued. In each case the file is functionally the same malware and technically a stranger to the list.
Where ransomware fits
Ransomware combines all three. Initial access frequently comes through a fileless technique or stolen credentials, movement across the network uses legitimate administrative tooling, and the encryption payload is often generated fresh for the victim. By the time files start encrypting, the useful moment to intervene passed weeks earlier, during the quiet part that produced no alerts.
How behavioral detection works differently
EDR changes the question. Instead of asking what a file is, it watches what is happening and asks whether the sequence makes sense.
It watches the story, not the file
An agent records process activity, network connections, file changes and credential access continuously. A document opening is normal. A document spawning PowerShell is unusual. PowerShell reaching into memory to read credentials and then opening a connection to an unfamiliar address is an attack, even though every individual step used software that was supposed to be there and nothing malicious was ever written to disk. None of those events is suspicious alone, which is exactly why tools that evaluate events one at a time miss it.
It does not need to have seen it before
Because the detection is about behavior rather than identity, novel malware is not a special case. Something never catalogued still has to do recognizable things to achieve its goal: escalate privileges, move laterally, establish persistence, reach outward. Those actions are the detection surface, and they are much harder for an attacker to avoid than changing a file's fingerprint.
It keeps a record you can work backwards through
Antivirus tells you a file was blocked. EDR tells you which machine, which user, what ran, what it touched and where it tried to connect. When something does get through, that history is the difference between knowing the scope of an incident and guessing at it, and it is what turns a breach investigation into a defined task rather than an archaeology project.
Detection without response is a slower failure
This is the part that gets underweighted when EDR is evaluated as a product rather than as an outcome. A tool that detects an attack at 2am and writes an alert into a queue has not protected anything. It has documented a compromise that continued for another six hours.
What response actually means
Isolating the affected device from the network while leaving it reachable for investigation. Terminating the malicious process. Rolling back changes it made. Doing all of that in the minutes after detection rather than the next business morning. The technical capability to do these things ships with most EDR platforms. What frequently does not exist is somebody watching at the moment it matters.
Who is actually watching
Before buying, the question worth answering is who responds at 3am on a Sunday, and whether they are permitted to isolate a machine without waking somebody for approval. If the honest answer is that alerts wait for business hours, you have bought better forensics rather than faster containment. Both are worth having. Only one of them shortens the 194 days.
Endpoint Security Readiness Checklist
The Checklist
Fifteen questions across coverage, response and evidence. Tick the ones you can answer without going and asking someone, and the score updates as you go. Use it yourself or share it with your team.
Tick what you can answer without checking. The blanks are the gaps.
Coverage Gaps
How many endpoints have no security agent at all?
Every protection percentage is calculated against the devices your console knows about, which is not the same as the devices you own.
Are servers covered, or only workstations?
Servers hold the data worth stealing and are routinely left on antivirus alone because nobody wants to install an agent on production.
Would you know if an agent stopped reporting?
A silent agent looks identical to a healthy one on most dashboards. Disabling it is a standard early move in an attack.
Are Macs, mobile devices and personal laptops in scope?
Coverage tends to mean Windows desktops. Anything reaching company email is an endpoint whether or not it is on the list.
Is anything still running an unsupported operating system?
No amount of endpoint tooling compensates for a machine that stopped receiving security updates.
Response Capability
Who responds to an alert at 3am on a Sunday?
If the answer is that it waits for Monday, you have bought forensics rather than containment.
Can a device be isolated without waiting for approval?
Containment measured in minutes needs the authority pre-agreed, not requested during the incident.
What is your actual time from detection to containment?
Not the vendor's claim about the platform. Your number, from the last time something fired.
Can you roll back what an attack changed?
Terminating a process stops the activity. It does not undo the files already encrypted or the accounts already created.
Has the response process ever been rehearsed?
An untested runbook is a document. The first real test should not be the first time anyone reads it.
Compliance Requirements
How long is endpoint telemetry retained?
Given that breaches often go months before discovery, retention shorter than the detection gap means the evidence is gone.
Could you produce an incident timeline for an auditor?
Which machine, which user, what ran, what it touched. That reconstruction is what an investigation needs.
Does your insurance application ask about EDR specifically?
Questionnaires increasingly separate antivirus from endpoint detection and response. Read your own form.
Is every incident documented, or only the serious ones?
Auditors ask for the record. Selective documentation reads as an absent process rather than a quiet year.
Do you know which frameworks require endpoint monitoring?
Identify the ones that apply to you and confirm the wording with your auditor rather than assuming coverage.
Frequently asked questions
EDR stands for endpoint detection and response. It is software that continuously records what happens on a device, including process activity, network connections, file changes and credential access, and flags sequences that look like an attack. Unlike antivirus, it does not need to recognize a specific file, because it evaluates behavior rather than identity. The response half means it can also act: isolating a device from the network, terminating a process, or rolling back changes an attack made.
Antivirus compares files against a list of known malicious fingerprints and blocks matches, which requires somebody to have seen the threat before. EDR watches behavior on the device and identifies attacks by what they do rather than what they are, so novel threats are not a special case. Antivirus also stops at detection, while EDR can contain the problem by isolating the machine or terminating the process. In practice the two are complementary rather than alternatives.
No, and it is not intended to. Antivirus is efficient at blocking the large volume of commodity malware that is already catalogued, and it does that cheaply. EDR covers the categories antivirus structurally cannot see: attacks that never write a file, attacks that use legitimate administrative tools, and code that has never been catalogued. Many endpoint products now bundle both. The important question is whether behavioral detection and response are present, not which label the vendor uses.
Fileless malware runs entirely in a computer's memory without writing a file to the hard drive. It typically arrives through a document macro, a script or an exploit, and executes directly in memory. Because antivirus works by scanning files, there is nothing for it to examine, so a disk scan reports a clean machine while the attack is running on it. The Ponemon Institute reports that 60 percent of modern malware uses fileless or behavioral techniques that signature-based tools cannot detect.
It describes attackers using software already installed on the machine rather than bringing their own. PowerShell, remote management utilities and other built-in administrative tools are legitimate, digitally signed, and used by IT teams daily, so security software cannot block them without breaking normal operations. The attack is not the tool but the sequence, such as a script reading credentials from memory at night and then connecting to an unfamiliar external address. Each step is permitted, and the pattern is what gives it away.
It significantly improves the odds, because ransomware relies on the techniques behavioral detection is designed to catch. Attackers usually spend a long quiet period mapping the network, escalating privileges and staging data before any encryption starts, and that preparation is where EDR has the best chance of intervening. Encryption itself is the visible end of the process rather than the beginning. EDR is not a substitute for tested, immutable backups, which are what determine whether an encryption event becomes a recovery or a negotiation.
EDR is the technology that monitors endpoints and enables response. MDR, managed detection and response, is EDR plus a team who actually watches the alerts and acts on them around the clock, which matters because a detection nobody sees at 3am is documentation rather than protection. XDR extends the same behavioral approach beyond endpoints to correlate signals across email, network and cloud. The practical question for most businesses is not which acronym they buy but who responds when something fires outside office hours.
The techniques that defeat antivirus are automated and untargeted, so being small offers no protection from them. Ponemon puts 70 percent of successful attacks as originating at endpoints, and IBM's research puts the average time to identify a breach at 194 days, which is long enough for a small business to be thoroughly compromised without noticing. The realistic constraint for a smaller organization is not the tooling but whether anyone is available to respond to an alert overnight, which is usually the argument for a managed service rather than a license.
Not sure what your endpoints are missing?
Get a free endpoint assessment. We'll find the devices with no agent, check what happens after hours, and show you the gap.
