Antivirus (AV).

Endpoint software that detects and removes malicious files using signature databases, file scanning, and basic heuristics — the historical foundation of endpoint security. It belongs to the Defense & Operations category of cybersecurity.

Endpoint software that detects and removes malicious files using signature databases, file scanning, and basic heuristics — the historical foundation of endpoint security.

Antivirus (AV) is the historical category of endpoint security software. Pioneered by products like John McAfee's VirusScan (1987), Eugene Kaspersky's AVP, and Bernd Fix's early routines, AV scans files on disk, in memory, and in transit, comparing them to a continually updated signature database and applying simple heuristics. AV agents traditionally hook the Windows filesystem (via mini-filter drivers) and email gateways, quarantining or deleting matches. The model excels against widespread commodity malware but struggles with polymorphic, packed, and fileless threats; AV-Test, AV-Comparatives and MITRE Engenuity evaluations consistently show signature-only engines missing modern attacks. Most vendors have therefore evolved AV into NGAV/EDR platforms with behavioral analytics, while classic AV remains a baseline regulatory and compliance control.

Defences for Antivirus (AV) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: AV, Anti-virus, Signature-based antivirus.