Antivirus Is Dead: What Replaced It in 2026

The antivirus you remember scanned files against a list of known-bad signatures. It worked when malware arrived as a file and stayed the same long enough to be listed.

That is not how most incidents start now. The attacker signs in with a valid password, uses tools already on the machine, and never drops a file worth scanning. Signature matching is still in the product - it is just no longer the part doing the work.

What actually changed

Three shifts, none of them subtle.

Credentials replaced malware as the entry point. Credential abuse is the most pervasive technique across breach chains, and a stolen password looks identical to a real one at the file layer^[1]. There is nothing for a scanner to find.

The delivery moved to email and unpatched software. Sophos puts malicious email, phishing and exploited vulnerabilities at the top of ransomware root causes^[2]. Two of those three never involve an executable landing on disk.

Attackers use what is already installed. PowerShell, scripting hosts, remote management tools. MITRE ATT&CK catalogues these as techniques rather than files precisely because there is no signature to write^[3].

So detection had to move from "is this file on the list" to "is this behaviour normal for this machine".

What replaced it

Behavioural detection watches sequences: a document spawning a script interpreter, a process reading credential storage, an unusual outbound connection immediately after a sign-in from a new location. It does not need to have seen the malware before, and it can act on its own - isolating a device or rolling back a change without waiting for a human^[4].

Two pieces of that are worth naming, because they are the ones most often left switched off:

• Attack surface reduction rules block whole classes of behaviour - Office applications launching child processes, credential theft from LSASS, executables running from mail clients. They ship with the licence and several are off by default^[5].
• EDR in block mode lets endpoint detection remediate malicious artefacts behind a third-party antivirus that only ran in passive mode^[6]. If you kept an old AV product alongside Defender, this is the setting that decides whether the second layer does anything.

Is the old antivirus test still useful?

Yes, with a caveat. Independent labs still test business endpoint products against real-world samples, and those results are the only comparison worth quoting because they are not written by a vendor^[7]. What they measure is one layer of a stack that now includes identity, email and configuration. A perfect protection score does not stop a valid login.

What you probably already own

If you are on Microsoft 365 Business Premium, Defender for Business is included: behavioural endpoint detection, attack surface reduction, automated investigation and remediation across Windows, macOS, iOS and Android^[4]. Business Premium lists at USD 22 per user per month on annual commitment^[8].

The common failure is not a missing product. It is a licensed product in a default state: devices never enrolled, ASR rules never turned on, alerts arriving in a console nobody has logged into since the onboarding call.

The five-minute check

1. 1Enrolment. Every company laptop and phone shows as managed and compliant, not just "registered".
2. 2Real-time and cloud protection on. Tamper protection too, so a user or a script cannot switch it off.
3. 3Attack surface reduction rules in block mode, not audit mode. Audit records what would have happened and stops nothing^[5].
4. 4No second antivirus running actively. Two products fighting each other is worse than one working. If a legacy AV must stay, put Defender in EDR block mode^[6].
5. 5A named person who reads alerts. NIST's small-business guide and CISA's performance goals both treat detection and response as one obligation, and both expect a named owner rather than an installed agent^[9][10].

What this does not cover

Endpoint protection is one layer. It does not stop an invoice fraud email that contains no attachment, it does not stop a valid sign-in with a stolen password, and it does not restore data after a successful encryption event. MFA, conditional access, email authentication and tested backups are separate controls, and each of them fails independently.

Country notes

Israel. The Business Premium licence and Defender for Business are sold the same way locally, so the practical question is whether an integrator enrolled the devices in Intune or only handed over licences.

Europe. NIS2 Article 21 asks for risk management measures and incident handling rather than an antivirus product; a licence in default state is hard to evidence as either^[11].

Spain. ENS control families name endpoint protection and event monitoring separately - which is the same distinction between having the tool and watching what it says.

What to do with this

1. 1Open your endpoint console and check enrolment and compliance counts against your actual headcount.
2. 2Turn the standard attack surface reduction rules from audit to block, in a small pilot group first.
3. 3Remove or passively configure any legacy antivirus, and enable EDR block mode if it stays.
4. 4Decide who reads the alerts, and write it down. That is the control, not the software.