They should shift the centre of gravity to behavioural endpoint controls while keeping signatures as one layer of defence. Signature-based AV still catches known malware, but the article shows it misses most modern threats. A mature programme uses runtime detection, telemetry, and response to reduce the gap between compromise and containment.
Why the Security Centre of Gravity Is Shifting
Signature-based AV still has a role, but it was built for a world where known malware families were the main problem. Modern endpoint defence has to cope with living-off-the-land abuse, fileless execution, credential theft, and payloads that change faster than a signature pipeline can keep up. Behavioural controls matter because they look for actions and outcomes, not just known bytes.
The practical question is not whether signatures are “bad”, but whether they are sufficient on their own. In most environments they are not, because detection value now comes from telemetry, correlation, and the ability to block or contain suspicious process, script, and privilege behaviour at runtime.
What Behavioural Endpoint Controls Add That Signatures Cannot
Behavioural endpoint controls observe how software behaves: process creation chains, command-line patterns, script execution, memory activity, lateral movement attempts, and anomalous privilege use. That makes them useful against malware variants, hands-on-keyboard intrusions, and techniques that reuse legitimate tools rather than dropping an obvious malicious file.
That said, behavioural products are not magic. They depend on telemetry quality, tuning, and response workflows. If the control can detect suspicious behaviour but nobody investigates alerts or contains hosts quickly, the organisation still carries a large window of exposure between initial execution and remediation.
Signatures remain useful for high-confidence blocking of commodity threats, known hash matches, and fast negative filtering. The mature posture is layered: signatures reduce noise and catch known bad, while behavioural controls widen detection coverage and improve containment when the first line fails.
How to Decide What to Invest In Next
The investment decision should follow threat reality, not product habit. If your endpoint programme is still tuned mainly for static malware, your biggest blind spot is likely runtime tradecraft, not missing hash updates. MITRE ATT&CK Enterprise Matrix is useful here because it helps teams map observed endpoint behaviour to the techniques attackers actually use.
For practitioners, the most important test is whether the control can shorten time to detect and contain. If it cannot surface script abuse, suspicious child processes, credential-dumping behaviour, or privilege escalation early enough to change the response, then it is not doing enough of the modern job.
Budget should therefore prioritise runtime visibility, prevention of known-bad and known-risky behaviours, and response integration over another narrow signature feed. Signature coverage still belongs in the stack, but it should no longer define the stack.
Risk and Threat Considerations
Relying too heavily on signatures creates a control gap against threats that are polymorphic, in-memory, or delivered through trusted tools. That gap matters because endpoint compromise often becomes the launch point for credential theft, lateral movement, and data access before the malware is ever recognised as malicious.
Failure mechanism: The control fails when detection depends on prior knowledge of a sample instead of observing suspicious runtime behaviour, so new variants, script-based attacks, and hands-on-keyboard activity evade or delay detection.
Impact: Attackers gain more dwell time, more opportunity to move laterally, and a higher chance of reaching sensitive systems before containment begins.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1059 — Command and Scripting Interpreter | Endpoint behaviour analysis must detect script-based attacker tradecraft. |
| T1055 — Process Injection | Behavioural controls help catch in-memory execution that signatures miss. | |
| Recommendation — Map script abuse to T1059 and alert on suspicious command execution chains. Hunt for process injection patterns and contain hosts showing anomalous memory activity. | ||
| NIST CSF 2.0 | DE.CM-01 — The network and system information is monitored to detect potential cybersecurity events | Behavioural endpoint telemetry is a core detection capability for modern endpoint defence. |
| RS.MA-01 — Incidents are contained | Behavioural endpoint tools matter when they can isolate hosts and reduce dwell time. | |
| Recommendation — Expand endpoint telemetry so detection coverage includes runtime behaviour and not just known-malware indicators. Automate endpoint isolation and containment when high-confidence malicious behaviour is detected. | ||
| CIS Controls v8 | CIS-10 — Malware Defenses | The question is directly about balancing malware prevention with behavioural detection. |
| Recommendation — Combine signature checks with behavioural malware detection and response coverage. | ||
Practitioner Guidance
What to prioritise: Put behavioural detection and response on the same footing as prevention, then keep signatures for commodity malware, known hashes, and baseline hygiene. The goal is not to choose one control class absolutely, but to make sure runtime visibility can catch what signatures miss.
What to verify: Validate that the endpoint stack can detect script abuse, suspicious parent-child process chains, credential access behaviour, and rapid containment actions such as isolation or kill/quarantine. If alerts do not lead to a bounded response, detection value is much lower than the dashboard suggests.
Practitioner takeaway: Treat signatures as a necessary but incomplete layer, and measure the endpoint programme by how quickly it spots and constrains active behaviour that was never seen before.
Related resources from NHI Mgmt Group
- When should organisations prioritise behavioural detection over signature-based controls?
- Should organisations keep separate controls for email, endpoint, SaaS, and AI use?
- Which enterprise controls should organisations require before adopting cloud-based e-signature workflows?
- What breaks when organisations rely only on endpoint controls to stop browser-based social engineering attacks?