Anti-Malware Tools - What's the difference and why do I need one?

Antivirus and anti-malware tools have come a long way in the past several years.  These tools originally functioned by simply scanning your computer for infected files, and eventually evolved to become more proactive by scanning downloaded files and inbound e-mails as they were downloaded to your computer.  Today these tools are better known as Endpoint Detection and Response (EDR) tools and they are far more sophisticated than simple file scanning. 

What differentiates EDR platforms is that they go beyond scanning infected files to monitor user activities, behaviors, and processes running in the background, seeking to identify patterns of activity that are consistent with Ransomware, hacking, and data theft.  The EDR agent running on a computer reports this data back to a Security Operations Center, a 24x7 threat monitoring operation that constantly monitors what is being reported back for anomalies.  Rather than relying on updated virus definitions as previous generations have, these platforms rely on threat intelligence from the dark web and hot spots for hacker activity in order to inform agents for what behavior to look for that may be malicious, so that the platform can quickly identify an advanced cyber threat and stop it before it causes damage. 

If you’re still using a basic antivirus tool from previous generations, or if your antivirus software isn’t being consistently monitored by a Security Operations Center or Managed Security Services Provider, it may not be catching all of the latest sophisticated cyber threats and types of malware, leaving your business open to potential attacks.  It may be time to consider a new Endpoint Detection and Response platform.  There are many options out there including Microsoft, CrowdStrike, SentinelOne, Sophos, and Carbon Black just to name a few.  For more information, check out the 2021 Gartner Magic Quadrant for Endpoint Protection Platforms.