What detects and prevents malicious software on an endpoint device?

Antivirus detects and helps prevent malicious software on endpoint devices. It scans files, programs, and sometimes running processes for known malware signatures, suspicious characteristics, or malicious behavior. Antivirus is a core endpoint security component because endpoints are frequent targets for trojans, viruses, spyware, ransomware, and malicious scripts. A VPN secures network communication over an encrypted tunnel, but it does not detect malware on the host. A packet filter enforces network rules, usually based on packet attributes, and is not focused on malicious software detection. A proxy mediates traffic between users and online resources but does not replace endpoint malware protection. Modern endpoint protection often expands beyond traditional antivirus by including behavioral detection, exploit prevention, endpoint detection and response, and host firewall controls. Still, antivirus remains the best answer for detecting and preventing malicious software on a device. Reference/topics: Endpoint Security 4.3, antivirus; Cybersecurity 1.3, malware.