Next-Generation Antivirus (NGAV).

Endpoint protection that augments signature scanning with machine-learning models, behavioral analytics, and exploit prevention to stop unknown and fileless threats. It belongs to the Defense & Operations category of cybersecurity.

Endpoint protection that augments signature scanning with machine-learning models, behavioral analytics, and exploit prevention to stop unknown and fileless threats.

Next-Generation Antivirus (NGAV) emerged in the mid-2010s in response to the limits of signature-only AV. Vendors such as CrowdStrike Falcon, SentinelOne Singularity, Microsoft Defender for Endpoint, VMware Carbon Black, and Cybereason combine cloud-trained ML classifiers, behavioral monitors that watch process and API telemetry, exploit-mitigation modules, and Indicator-of-Attack (IOA) detection. NGAV blocks fileless techniques like LOLBins and reflective DLL loading that bypass classical signatures, and is the prevention layer typically packaged with an EDR or XDR sensor. NIST SP 800-83 and the MITRE Engenuity ATT&CK Evaluations describe and benchmark this category. Effective NGAV reduces dwell time but requires tuning to control false positives in developer-heavy environments.

Defences for Next-Generation Antivirus (NGAV) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: NGAV, Next-gen AV.