What is a next-generation antivirus (NGAV)?

Unlike traditional antivirus software that uses signature-based detection to identify previously known threats, NGAV can detect unknown malware threats and malicious behavior as they occur in near real-time. In this way, it offers a more effective method for addressing modern threats such as ransomware, scripting attacks, fileless malware and zero-day vulnerabilities.

Legacy antivirus (AV) solutions use a database of malware signatures and heuristics to detect viruses in endpoint devices such as desktop computers, laptops, tablets and smartphones. These signatures are strings of characters within a file that indicate a virus could be present.

This approach leaves endpoints vulnerable to potential threats that have yet to be identified and cataloged in the signature database. Even with frequent signature updates, a new or unknown malicious file could go undetected.

In contrast, NGAV solutions use behavioral detection to identify the tactics, techniques and procedures (TTPs) associated with cyberattacks. Machine learning algorithms continually monitor events, processes, files and applications for malicious behavior.

If an unknown vulnerability is targeted for the first time in a zero-day attack, NGAV can detect and block the attempt. NGAV can also prevent fileless attacks such as those that exploit Windows PowerShell and document macros, or phishing emails that persuade users to select links that run fileless malware.

As a cloud-based technology, NGAV is also faster, easier and more cost-effective to deploy and manage than their traditional counterparts. With its ability to monitor endpoint activity and provide immediate incident response, NGAV can block many of the attack vectors hackers use to infiltrate systems.

While capabilities differ across vendors, most NGAV solutions offer the following capabilities:

• Machine learning algorithms: NGAV can examine thousands of file characteristics and endpoint activities in near real-time and identify anomalies and unexpected actions that can help stave off known and unknown threats.
  
  
• Behavioral analysis: NGAV establishes baseline behaviors and identifies suspicious behaviors that indicate malicious activity or cyberattack through analysis of users, devices, applications and systems.
  
  
• Threat intelligence: Many NGAV solutions can integrate the latest threat intelligence on the sources, tactics and impacts of specific malware attacks to help detect and block them faster and more effectively.
  
  
• Predictive analytics: NGAV collects a massive amount of data and feeds it into predictive models that can detect the presence of malware or a potential cyberattack before it occurs. Once a threat is identified, NGAV intervenes to prevent or minimize damage.

Although NGAV is more effective than traditional antivirus software, it is not foolproof. Occasionally, it might return a false positive or fail to detect a virus. Cybercriminals and hackers are still creating and testing new methods of evading the latest antivirus protection technologies.

When NGAV defenses are breached on an endpoint device, organizations often rely on other technologies, such as endpoint detection and response (EDR), unified endpoint management (UEM) or security information and event management (SIEM). These security solutions offer a broader, system-wide approach to the prevention and mitigation of cyberthreats across many different endpoints.