Each device you use is called an “endpoint”. This lesson is about the software that defends them against malware.
What is it?
Antivirus (also called endpoint protection) is software that detects, blocks, and removes malware from a device. Modern versions do far more than scan for known viruses — they watch program behaviour to catch brand-new threats too.
Select any component in the diagram to read what it does.
Text description of this diagram
Protection software on each device spots and stops harmful programs before they cause damage.
Why is it important?
From Module 4 you know malware is behind a huge share of attacks. Antivirus is the layer that stands guard on the device itself — the last line when a malicious file slips past email filters or lands from a download or USB stick.
How does it work?
- Signature detection — compares files against a list of known malware.
- Behaviour detection — flags programs that act maliciously, catching new, unknown threats.
- Real-time protection — checks files as they are opened or downloaded, not just during a scan.
- Quarantine — isolates suspicious files so they cannot cause harm.
Keep antivirus turned on and updated. Out-of-date protection does not recognise the newest malware. Most modern operating systems include capable antivirus built in.
A real-world example
A user downloads an email attachment that turns out to be malware. The moment they open it, real-time protection spots the harmful behaviour, blocks it, and moves it to quarantine before it can encrypt a single file. The attack is stopped at the device, and the user is simply warned.
Check what you learned
What does endpoint/antivirus protection do?
It detects, blocks, and removes malware on a device, using known-malware signatures and behaviour monitoring.
Why must antivirus be kept updated?
New malware appears constantly; out-of-date protection does not recognise the latest threats.
Key takeaways
- Antivirus/endpoint protection guards each device against malware.
- It uses both known signatures and behaviour detection.
- Keep it on, updated, and running in real time.