Antivirus has been a standard part of business IT for years. Most of us know we should have it, and if you asked whether your laptops and computers were protected, there’s a good chance the answer would be, “Yes, we’ve got antivirus.” So, job done, right? Unfortunately, not quite...
Traditional antivirus is still useful, but the way businesses use technology has changed considerably. Your team may be working from different locations, accessing files through Microsoft 365, using cloud applications and signing into company systems from laptops that regularly leave the office.
At the same time, cyber attacks have changed too. Malware is only one part of the problem. Stolen passwords, compromised Microsoft 365 accounts, phishing, ransomware and attacks that use perfectly legitimate software all need to be considered.
That means protecting a modern business requires a few more layers.
At its simplest, antivirus software looks for malicious files and programs on your device. It can identify known threats, quarantine suspicious files and prevent malware from running.
Modern antivirus products are considerably more capable than they once were, and they remain an important part of protecting your computers.
The problem comes when businesses assume antivirus covers everything.
A criminal who has obtained a genuine employee password, for example, doesn't necessarily need to install a virus. If they can simply sign into an account using valid credentials, traditional antivirus may have very little to say about it.
That's one reason the National Cyber Security Centre recommends businesses take a broader approach to cyber security rather than relying on one particular product.
There isn't one security product that deals with every possible threat. A sensible approach uses several protections that work together.
Think about your devices first.
Modern Endpoint Detection and Response, usually shortened to EDR, goes further than traditional antivirus by monitoring what is actually happening on a laptop, desktop or server.
Instead of only asking, “Do we recognise this virus?”, it can look for suspicious behaviour.
For example :
👉 A program suddenly starts encrypting large numbers of files
👉 An unusual script starts running in the background
👉 A program unexpectedly tries to gain administrator access
👉 A device begins behaving in a way that could indicate an attack
EDR can detect that activity and, depending on the setup, take action such as isolating the affected device from the network.
You can read more about how we use Endpoint Detection and Response at Espi.
A lot of cyber attacks don't begin with someone attacking a server. They begin with an email.
We covered this in our recent article about spotting phishing emails, but technical email protection is just as important as staff awareness.
Good filtering can help identify suspicious links, attachments, impersonation attempts and other potentially dangerous messages before they reach somebody's inbox.
Microsoft provides a range of email authentication guidance for SPF, DKIM and DMARC, which can also help organisations protect their domains and reduce email spoofing.
The important point is that your staff shouldn't be your only email security system!
Passwords remain a favourite target because gaining access to a genuine account can give an attacker a much easier route into business information. That's why multi factor authentication, MFA, has become so important.
MFA requires something else in addition to the password before access is granted. The NCSC guidance on multi factor authentication explains why this additional check makes it much harder for an attacker to access an account even if they have obtained the password.
Microsoft also recommends MFA as part of its identity and access security guidance.
If you use Microsoft 365 and haven't reviewed how MFA is configured across your users recently, it is something worth checking.
We all know the update notification.
You're busy. Windows wants to restart. You click “later”.
And then possibly “later” again tomorrow...
Software updates aren't only about adding features. They frequently contain security fixes for vulnerabilities that have been discovered since the software was released.
The NCSC recommends keeping software and devices up to date, particularly because known vulnerabilities can provide attackers with a route into systems.
This is one of the reasons businesses use Remote Monitoring and Management. Updates, device health and other issues can be monitored centrally rather than relying on everybody remembering to look after their own laptop.
This is the bit that sometimes gets forgotten.
Good cyber security isn't based on the assumption that nothing will ever go wrong. You also need to think about what happens if it does.
Could you detect suspicious activity quickly? Could you isolate an affected device? Are your backups working? Could you restore the information you need?
Microsoft's own ransomware protection guidance includes prevention, detection and recovery rather than treating ransomware as something that can be solved by antivirus alone.
Our own Espi Cyber Security services take the same layered approach, covering prevention, detection, response and recovery. espi.net
Absolutely. The point isn't that antivirus is outdated or unnecessary. It's that antivirus should be one part of your protection rather than the whole thing. A modern business should be thinking about :
✅ Antivirus and endpoint protection
✅ Email security
✅ MFA and account security
✅ Regular patching and updates
✅ Microsoft 365 protection
✅ Backups
✅ Monitoring and detection
✅ Staff awareness
You don't necessarily need eight different suppliers or a cupboard full of security products either. The important thing is understanding which protections you already have, where the gaps are and whether somebody is actually monitoring them.
If you're reading this and thinking, “I'm fairly sure we've got antivirus, but I'm not entirely sure about the rest”, don't worry, you're certainly not the only one!
Our Espi IT Support team can take a look at what you currently have in place and explain it in plain English. We can tell you what's already covered, what isn't and what we'd recommend doing about it.
No need to become a cyber security expert yourself. That's our job 😊
📞 01954 213999
