A Brief History
The first antivirus tools in the late 1980s were dead simple: search every file for a known sequence of bytes, and if you found it, flag the file as infected. That signature-based approach is still in use today — but it is now just one of many techniques an antivirus product layers together.
Layer 1 — Signature Matching
A signature is a fingerprint of a known malware sample. It might be:
- A hash of the entire file (fast, but trivially defeated by changing one byte).
- A hash of specific code sections (more robust).
- A regex-like byte pattern that matches a family of variants.
- A YARA rule combining multiple conditions.
Signature databases are updated hourly to daily by vendors and contain millions of entries.
Strengths: fast, deterministic, near-zero false positives for well-curated signatures.
Weaknesses: useless against malware never seen before.
Layer 2 — Heuristic Analysis
Heuristics flag files based on suspicious traits rather than exact matches:
- "This Word document has a macro that calls PowerShell and downloads from a non-standard port."
- "This PE file imports CreateRemoteThread and WriteProcessMemory and has 100% entropy in its data section — likely packed malware."
Heuristics catch many novel variants of known malware families.
Strengths: catches new variants of known patterns.
Weaknesses: higher false-positive rate than pure signatures.
Layer 3 — Behavioural Analysis
The scanner watches what the file actually does when run, not what it looks like. This usually means executing the file in a controlled environment (a sandbox) and recording:
- Files created, modified, encrypted.
- Network connections opened.
- Registry keys changed.
- Child processes spawned.
- Anti-analysis tricks (sleep loops, VM detection).
If the behaviour matches known malicious patterns — for instance, rapid file enumeration followed by mass encryption — the file is flagged.
Strengths: detects truly novel malware.
Weaknesses: slow, requires execution, can be evaded by malware that detects the sandbox.
Layer 4 — Machine Learning
Modern engines feed files into ML models trained on tens of millions of known-good and known-bad samples. The models predict, from features extracted from the binary (imports, section names, entropy, control-flow shape), whether the file is malicious.
ML works particularly well for packed and obfuscated malware where signature matching breaks down.
Strengths: generalises across malware families.
Weaknesses: opaque (hard to explain a verdict), adversarial samples can fool the model.
Layer 5 — Cloud Reputation and Telemetry
When the local engine is uncertain, it asks the vendor's cloud:
- Has this exact file been seen before?
- Is its digital signature known good?
- How many other endpoints encountered this file in the last 24 hours?
- What did behavioural sandboxes report?
A binary with a Microsoft Authenticode signature seen on 100 million endpoints is almost certainly safe. A binary first observed on three endpoints in the past hour, with no signature, all in the same organisation, is very suspicious.
Layer 6 — Endpoint Detection and Response (EDR)
EDR products go further than traditional AV. They:
- Log every process spawn, network connection, file write, and registry change.
- Stream these telemetry events to a central platform.
- Correlate events across systems to detect lateral movement and complex attack chains.
- Allow incident responders to query historical activity (\"show me everywhere PowerShell touched a temp folder in the past 30 days\").
EDR is the layer that turns "we caught a bad file" into "we caught a multi-stage attack in progress".
What's Different in 2026
The big shifts of the past few years:
- Cloud-first detection. Most heavy lifting now happens server-side, with the endpoint as a lightweight collector.
- AI everywhere. Both attackers and defenders use ML; the defenders mostly seem to be winning.
- Living-off-the-land detection. Malware increasingly uses legitimate tools (PowerShell, certutil, wmic) so behavioural and contextual detection has become essential.
- Identity-centric defence. Many attacks now succeed without dropping a single binary — abusing OAuth, session cookies, and cloud APIs instead.
What This Means for You
Treating "antivirus" as a magic box that blocks all bad things is outdated. Modern protection is a stack:
- AV / EDR on every endpoint.
- Email gateway filtering inbound mail.
- DNS and network egress monitoring.
- Identity protection with MFA and conditional access.
- User vigilance for the things technology cannot catch.
And — for files received outside your normal stack — a quick scan with an independent online tool like Virus Purge is a sensible second opinion.