Antivirus software is not enough to keep a computer safe

A green tick appears on the screen after a scan finishes. The user feels a wave of relief. This feeling is familiar. For years, installing a piece of security software was seen as the final step in protecting a computer. Once the software was running, the machine was considered safe from harm.

This belief started in an era when threats were simple. In the early days of personal computing, viruses were often files that spread via floppy disks or early email attachments. These viruses tended to be static. They had a unique pattern called a signature. A signature is like a digital fingerprint. Antivirus software kept a database of these fingerprints. If it found a match on the hard drive, it deleted the file. This approach was logical. It solved the most common problems of the time using a method that worked reliably.

The limits of fingerprints#

The problem with signatures is that they only catch what is already known. For a signature to exist, someone must have already been infected, identified the threat, and shared the fingerprint with the software provider. This leaves a window of opportunity for an attacker. If a hacker writes a new piece of malware, the antivirus has no signature for it yet. It is like trying to stop a criminal using a book of photographs that only contains people who have already been caught.

There are also many ways into a system that do not involve a malicious file at all. Phishing is one common example. This occurs when an attacker tricks a person into giving away their password through a fake email or website. A password is a key. Antivirus software does not stop someone from using a valid key to enter a house. Similarly, misconfiguration can leave a system exposed. This happens when a server or application is set up incorrectly, leaving a digital door unlocked for anyone to walk through.

Attackers have also learned to use tools that are already present on the machine. This technique is called living-off-the-land. The attacker uses legitimate administrative tools, such as PowerShell—a command line shell used by system managers in Windows—to move through a network and steal data. Because these tools are official parts of the operating system, the antivirus software does not recognise them as threats. It sees a trusted tool performing a task, even if that task is malicious.

Layers of defence#

Security professionals shifted their approach when it became clear that a single tool was insufficient. The industry adopted a strategy called Defence in Depth. This means creating multiple layers of security so that no single point of failure exists. If an attacker bypasses the antivirus, a second or third layer should stop them. It is the difference between relying on a single lock and having a fence, a locked door, and a safe inside the room.

This shift acknowledges that perfection is impossible. Instead of trying to keep every threat out, the goal is to make it as difficult and expensive as possible for an attacker to succeed. This requires looking at the entire environment rather than just the endpoint. It involves monitoring behaviour on the network and limiting what a user can do once they are inside.

The focus moved from detection to resilience. A resilient system assumes that some level of intrusion will happen eventually. By distributing security across different layers, an organisation ensures that one mistake or one new piece of malware does not lead to a total collapse. Antivirus remains useful as one of these layers, but it is no longer the primary shield.

To improve security, start by enabling Multi-Factor Authentication on every account. This requires a second piece of evidence, such as a code from a mobile app, to prove identity. Set all software to update automatically to fix known flaws in the code. Finally, ensure that user accounts have only the minimum permissions required for their work, reducing the damage an attacker can do with stolen credentials.