3 September 2026LANTEK Computers
There is a version of this argument that says antivirus is dead, and it is wrong. Antivirus still blocks a large volume of ordinary, known, commodity malware every day, cheaply and without anybody thinking about it. Removing it would be a mistake.
The accurate statement is narrower and more useful: the share of the problem antivirus addresses has shrunk, because the attacks that cost businesses the most no longer involve a malicious file at all.
What antivirus is actually for
Traditional antivirus works by recognition. It compares files against a list of things known to be bad, and blocks matches. Modern products add behavioural detection, but recognition remains the core.
That model has one structural requirement: there has to be a file, and it has to be recognisable. Which means it works well against the mass-produced and badly against the specific.
The three cases where there is nothing to recognise
Somebody signs in with a valid password. The most common and most expensive case. There is no file. An attacker with a working credential signs in the ordinary way, reads mail, and eventually sends a message asking for a payment to go somewhere else. Every part of that is legitimate software being used by the wrong person. This is the whole subject of how business email compromise actually works, and no endpoint product would have anything to report.
The tooling is the operating system’s own. A great deal of what happens after an initial foothold is done with software that is already on the machine and entirely legitimate: scripting engines, administrative utilities, remote management tools. Blocking those outright is not an option, because they are how the machine is administered. What distinguishes an attack is the sequence and the context, not the tool.
The file is new. A file assembled for one target has never been seen before, so there is nothing to match against. Behavioural detection helps here, and it is why it exists.
What sits around it now
Not products to buy in sequence. Capabilities, several of which you may already have.
Recording what happened, not only blocking
The most consequential change. Traditional antivirus blocks and logs the block. What you also need is a record of activity on the machine: what ran, what it spawned, what it connected to, what changed.
The value shows up in two places. Something suspicious can be investigated, because there is a history rather than a single alert. And after an incident you can answer the question that actually matters, which is what did this reach, rather than guessing. Without that record, the scope assessment in a notification decision is guesswork.
Identity as the thing being protected
If the common attack is a valid sign-in, then the controls that matter are about the account rather than the device. Multi-factor authentication, rules that refuse sign-ins that make no sense, and alerting on the ones that are merely unusual.
This is the shift that takes longest to internalise: for most businesses, the account is now a more important perimeter than the network. Why MFA is not optional makes the case.
Somebody looking at the output
Recording activity produces a great deal of data, and data nobody reviews is storage rather than security. The distinction between an installed product and a managed service is whether an alert at two in the morning reaches a person.
This is also the answer to the machine that has quietly stopped reporting. No product alerts loudly about its own absence. Somebody comparing what is enrolled against what exists notices. Monitoring and response is that function.
Patching, which is unglamorous and does more than any product
Most successful exploitation uses a known weakness with an available fix. Not a novel discovery: a patch that was published and not applied. A business that patches promptly, across browsers and readers and firmware as well as the operating system, removes a large share of the opportunity without buying anything.
Keeping the rights small
A staff member working as a local administrator all day means anything that runs in their session runs with full rights on that machine. Ordinary users for ordinary work, with a separate route for the occasional thing that genuinely needs elevation, limits what any single mistake can do.
This one generates the most resistance and delivers a lot for nothing.
What to actually do about it
In order, and note where the money is and is not.
One, multi-factor authentication everywhere, which costs nothing and closes the most common route. Two, patching on a stated cycle covering more than Windows. Three, remove standing administrator rights from ordinary accounts. Four, make sure whatever endpoint product you have is being watched by somebody, and that a machine dropping off the console is noticed. Five, then consider upgrading the endpoint product itself to something that records activity rather than only blocking.
Notice that the first three are configuration rather than purchase. The common failure is doing five first, because it is the one with a proposal attached.
The question to ask a provider
Not which product do you use. Ask: if a member of staff’s password were stolen tonight and used from another country tomorrow morning, what in our setup would notice, and who would be told?
An answer that describes antivirus has missed the question. An answer that describes sign-in monitoring, alerting and who responds is the right shape, whatever product sits underneath it.
That gap between something starting and somebody noticing is where the cost accumulates, and closing it is what beyond the endpoint means in practice. How we approach it is on Cybersecurity. If you want to know what is already exposed before changing anything, the free dark web scan is thirty minutes and you keep the report.