AV

Software that detects and removes malware, traditionally using signatures.

AV is endpoint software that detects, quarantines, and removes malware, traditionally by matching files against a database of known signatures and increasingly adding heuristics and behavior analysis. Signature reliance means it can miss zero-day or polymorphic threats until definitions are updated, which is a core limitation to remember. Contrast traditional AV with EDR, which records and analyzes endpoint behavior for investigation and response; AV blocks known bad, while EDR targets detection of novel and advanced activity.