What antivirus software does and does not do
How antivirus finds known malware, and where it stops, in CISA terms.
How it finds malware
CISA says antivirus software scans files or memory for patterns that may indicate malware, based on the signatures or definitions of known malware.
Why updates matter
CISA says antivirus vendors find new and updated malware daily, so it is important to have the latest updates installed. It says many products can receive updated definitions automatically.
Scans
CISA says most antivirus software can be set to scan files in real time and to prompt you at set intervals to run complete scans. It says to scan your entire computer periodically.
Where it stops
CISA's archived guidance says that because it relies on signatures, antivirus software "can only detect malware that has known characteristics." It says you can still be exposed to malware that spreads before vendors add signatures, so keep taking other safety precautions as well. CISA's current guidance says "no single antivirus or anti-malware program can guarantee 100% protection against viruses or malware."
Other habits
CISA also says to install software updates as soon as possible and to turn on automatic updates, including for web browsers and antivirus software.
This is general information, not security or technical support advice.
Sources: CISA, Understanding Anti-Virus Software (archived); CISA, Update Software (archived); Microsoft Support, Protect yourself from online scams and attacks; Apple Platform Security, Protecting against malware in macOS; CISA, Ensure Your OS Antivirus and Anti-Malware Protections are Active.
FAQ
Next: built-in protection
What your computer already has.
