Antivirus software used to be something you installed once and forgot about. That’s no longer good enough,  not because the software changed, but because what it’s defending against did.

What’s actually required

Under the Cyber Security: Core Standard, anti-malware protection must cover every device on the network, including cloud-based systems, against both viruses and the wider category of malware (ransomware, spyware, trojans, and the rest). The standard is specific about how it should run, not just that it should exist:

• Anti-malware must be centrally managed and monitored, not left to individual devices to handle on their own.
• Alerts should route to IT support for investigation, not sit unread in a dashboard nobody checks.
• The NCSC’s early warning service is recommended as an additional layer for spotting malicious activity before it escalates.
• USB storage should be blocked by default, with any approved exceptions scanned before use.

Why “real-time protection” is the right framing now

Traditional antivirus relied heavily on signature-based detection, matching files against a list of known threats. That still matters, but it’s no longer sufficient on its own: malware-as-a-service means new variants appear faster than signature lists can keep up, and attackers increasingly rely on techniques that don’t look like a “virus” in the traditional sense at all. Real-time, heuristic-based scanning, flagging behaviour that looks malicious even when the specific file has never been seen before, is what closes that gap.

One honest caveat here: more sophisticated organisations are moving towards full Endpoint Detection and Response (EDR) tooling, which goes further than traditional anti-malware by actively hunting for and responding to suspicious activity across a network. The DfE’s own standard doesn’t require EDR by name, it’s written in terms of anti-malware and monitoring, so treat EDR as a direction worth being aware of rather than a compliance requirement you’re currently missing.

Controlling what reaches the endpoint in the first place

Anti-malware is the last line of defence, not the first. It works best alongside the controls covered earlier this series: an approved application list, software verified as coming from known suppliers, and browser settings locked down so staff and pupils can’t install extensions that bypass protection. The fewer unmanaged routes onto a device, the less anti-malware software has to catch.

Who’s accountable

IT support is Responsible for deploying, centrally managing, and monitoring anti-malware tools, and for acting on alerts. The SLT digital lead is Accountable for making sure that monitoring is actually happening, not just installed and assumed to be working. The DPO is Consulted where malware protection intersects with personal data, including DPIA screening when new software is brought in to handle personal data. Governors remain Informed, and question 6 from the NCSC’s governor questions (training staff on threats like phishing) sits right next to this topic, malware often arrives through exactly the kind of click that training is meant to prevent.

💡Daily Cyber Tip

Don’t just check that antivirus is “on”: check who actually looks at the alerts it generates, and how often. Centrally managed anti-malware that nobody reviews is only doing half its job.

Further reading

DPE’s Digital Standards Tracker remains available for monitoring progress against this and the other DfE standards.