A lot of businesses we speak to say: “We’ve got antivirus, so we should be covered.”
…and to be fair, that used to be a reasonable assumption.
Antivirus was designed to:
- detect known threats
- block malicious files
- stop obvious infections
and it still does that really well, but most of the issues I see now don’t look like that anymore.
The problem is: not everything looks malicious
Modern attacks don’t always rely on obvious malware.
They often use:
- legitimate logins
- trusted platforms like Microsoft 365
- normal user behaviour
- built-in system tools
From the outside, everything looks… fine.
What antivirus is good at
Antivirus still has a role.
It can:
- block known malware
- stop obvious threats
- prevent some ransomware activity
- provide a baseline level of protection
That’s all useful, but it’s only one part of the picture.
What antivirus doesn’t see
This is where things start to fall short.
Antivirus generally won’t pick up:
- a compromised Microsoft 365 account
- suspicious login behaviour
- inbox rules forwarding emails
- a user approving a malicious MFA request
- a trusted tool being misused
- a slow, low-noise attack unfolding over time
Because technically, nothing “malicious” is happening in the traditional sense.
A familiar scenario
A phishing email lands.
It gets through.
Someone clicks.
They log in.
MFA is approved.
No malware is downloaded.
No file is flagged.
Nothing is blocked.
Antivirus has done its job, but the problem has already started.
This is why things go unnoticed
From the system’s point of view:
- the login is valid
- the activity looks normal
- the tools being used are trusted
So nothing gets flagged.
No alerts.
No warnings.
No obvious sign anything is wrong.
What we often see
Across businesses in Chesterfield, Sheffield, Derbyshire and South Yorkshire, this pattern comes up a lot:
Antivirus is in place, but there’s no visibility beyond it
Email is protected, but identity behaviour isn’t monitored
MFA is enabled, but suspicious activity isn’t being reviewed
Backups exist, but they don’t help with access or misuse
Each piece works on its own, but the gaps between them are where problems start.
What actually makes the difference now
It’s not about replacing antivirus.
It’s about building around it.
1. Endpoint visibility, not just protection
You need to know what’s happening on devices, not just block what’s known.
That includes:
- unusual behaviour
- persistence mechanisms
- early signs of compromise
2. Identity and login monitoring
If most attacks start with a login, that’s where visibility needs to be.
That means:
- spotting unusual access
- detecting risky sessions
- identifying behaviour that doesn’t fit
3. Stronger email filtering
Reducing the number of phishing emails that land in inboxes removes a large chunk of risk before anything else needs to happen.
4. Backup as a safety net
Backup still matters.
It just doesn’t prevent the issue – it helps reduce the impact.
The shift most businesses haven’t made yet
The old thinking: “We’ll stop the bad files.”
The current reality: “We need to spot when something doesn’t look right.”
That’s a very different approach.
Linking this back to the bigger picture
If you’ve read this, it’s worth looking at:
What happens after a phishing click (and why MFA isn’t stopping it)
Why backups don’t save you from account compromise
Because those are the areas antivirus doesn’t cover.
If you’re relying on antivirus alone
You’re not alone. It’s still one of the most common starting points.
It’s just no longer enough on its own.
If you want to see where the gaps are
A quick review usually shows:
- what antivirus is covering
- what sits outside of it
- where visibility is missing
- what is worth improving next
Want a clearer view of where your cyber risk really sits?
If this feels familiar, a quick review can help highlight where the gaps are, what is already working, and what is worth improving next.
