{"id":7192,"date":"2026-09-15T15:07:46","date_gmt":"2026-09-15T13:07:46","guid":{"rendered":"https:\/\/mypr.co.za\/?p=191797"},"modified":"2026-09-15T15:07:46","modified_gmt":"2026-09-15T13:07:46","slug":"antivirus-alone-wont-save-you-why-endpoint-protection-is-only-as-strong-as-what-happens-after-you-buy-it","status":"publish","type":"post","link":"https:\/\/mypr.co.za\/mail\/antivirus-alone-wont-save-you-why-endpoint-protection-is-only-as-strong-as-what-happens-after-you-buy-it\/","title":{"rendered":"Antivirus Alone Won\u2019t Save You: Why Endpoint Protection Is Only as Strong as What Happens After You Buy It"},"content":{"rendered":"
<\/div>\n

CyberLogic says effective endpoint security now depends on behavioural detection, continuous monitoring and rapid response, as attackers increasingly use legitimate credentials and tools rather than traditional malware. According to Angela Pringle, organisations must treat endpoint protection as one part of a broader cybersecurity strategy, supported by proper configuration, identity and cloud security, penetration testing and clear accountability for ensuring controls actually work.<\/p>\n

From matching known files to watching behaviour<\/strong><\/p>\n

Antivirus has moved well beyond spotting known bad files. \u201cModern endpoint protection watches behaviour, context and patterns instead,\u201d says Angela Pringle, Cyber Security Lead at CyberLogic. That shift, from traditional antivirus to endpoint protection platforms (EPP), endpoint detection and response (EDR) and extended detection and response (XDR), reflects a change in what defenders are actually looking for today. Not simply blocking malware, but spotting what an attacker does once they are already inside an environment: persistence, privilege escalation, credential theft and lateral movement.<\/p>\n

This matters because a growing share of intrusions no longer rely on malware at all. According to CrowdStrike\u2019s 2026 Global Threat Report, 82% of 2025 detections were malware-free, a sign of how often attackers now operate through legitimate credentials, tools and trusted systems rather than files an antivirus product would recognise as malicious. \u201cAntivirus is evolving into something less about a product on a laptop and more about visibility and response across the whole environment,\u201d says Pringle.<\/p>\n

AI hasn\u2019t created a new kind of attack, it\u2019s created faster attackers<\/strong><\/p>\n

Pringle is cautious about framing AI-generated attacks as simply \u201cbetter malware.\u201d The more significant change, she says, is speed and accessibility: AI accelerates reconnaissance, social engineering and scripting, and lets attackers with limited skill carry out intrusions that previously required real expertise. CrowdStrike\u2019s 2026 report recorded an 89% year-on-year rise in AI-enabled attacks, with the fastest observed breakout taking just 27 seconds.<\/p>\n

Because attackers increasingly \u201clive off the land\u201d, abusing legitimate tools and stolen credentials rather than deploying custom malware, traditional antivirus often has nothing obvious to flag. \u201cKeeping pace means strong behavioural detection and automated response,\u201d says Pringle. \u201cIt\u2019s about building a security operation that moves at AI speed, not finding a product that solves AI.\u201d<\/p>\n

Treat every AI agent like a privileged user<\/strong><\/p>\n

The same speed that makes AI valuable to attackers makes it risky when organisations deploy their own agents carelessly. Pringle\u2019s test for whether a process is ready to hand to an AI agent is simple: it needs to be well-defined, repeatable and measurable. \u201cHand an AI agent a messy process and you just get a bad process happening faster,\u201d she says.<\/p>\n

The stakes are not hypothetical. A 2026 State of AI Agent Security survey found that 54% of organisations had experienced or suspected an AI-agent security or data-privacy incident in the previous 12 months. Pringle\u2019s recommendation is to onboard an agent the way a security team would onboard a privileged user: start with least privilege, log everything, keep human approval on high-impact actions, and test in a controlled environment before expanding permissions \u2013 then actively check whether those permissions can be abused, bypassed or escalated.<\/p>\n

Antivirus is a control, not the strategy<\/strong><\/p>\n

For Pringle, there is no longer a clean line between antivirus and cybersecurity more broadly. Endpoint protection is one control among many, and it can\u2019t address compromised credentials, cloud misconfigurations or social engineering on its own. Verizon\u2019s 2026 Data Breach Investigations Report found that vulnerability exploitation has overtaken stolen credentials as the leading way attackers gain initial access, accounting for 31% of breaches.<\/p>\n

\u201cThe best way to know whether your controls hold up is to test them from an attacker\u2019s perspective,\u201d says Pringle. A penetration test or red-team exercise reveals whether someone who gets past the endpoint can still escalate privileges, move laterally or reach sensitive data. Antivirus, in her view, needs to sit alongside identity, cloud security, application security and incident response \u2013 \u201ca piece of the strategy, not the strategy.\u201d<\/p>\n

Who owns endpoint security when it fails?<\/strong><\/p>\n

Responsibility for endpoint security, Pringle argues, is shared rather than owned by one team. IT manages the devices and deployment, security defines requirements and responds to alerts, employees interact with the endpoint every day, and leadership funds and prioritises the investment. \u201cA great platform that\u2019s under-resourced won\u2019t deliver,\u201d she says.<\/p>\n

Security teams, she adds, should validate their own assumptions through penetration testing and red teaming rather than assuming a deployed control is a working one. \u201cKnowing a control is deployed and knowing it works under attack are two different things,\u201d says Pringle. \u201cThe real question isn\u2019t who owns the antivirus, but who\u2019s accountable when protection fails.\u201d Ends<\/p>\n

About Cyberlogic<\/strong>
Cyberlogic is a leading provider of secure, scalable cloud and IT services, helping businesses transform through world-class managed services, cyber security, and automation. For more information, please visit: www.cyberlogic.co.za<\/p>\n

For more information: Samantha Hogg-Brandjes | GinjaNinja | samantha@ginjaninja.co.za | +27-84-458-4857<\/p>\n

CLICK HERE to submit your press release to MyPR.co.za<\/a>.<\/p>\n

Author<\/strong>: Samantha Hogg-Brandjes from GinjaNinja PR (PTY) Ltd on behalf of Cyberlogic<\/strong>.<\/strong><\/strong><\/p>\n

<\/p>\n

Track Your Press Release HERE:<\/h3>\n

<\/strong><\/p>\n

\n

Check Online Visibility<\/h4>\n

Verify where this release is currently indexed:<\/p>\n<\/div>\n

<\/p>\n

Pages: Page <\/span>1<\/span> Page <\/span>2<\/a><\/div>\n

CLICK HERE to Read the Original Press Release on MyPR<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

CyberLogic says effective endpoint security now depends on behavioural detection, continuous monitoring and rapid response, as attackers increasingly use legitimate credentials and tools rather than traditional malware. According to Angela Pringle, organisations must treat endpoint protection as one part of a broader cybersecurity strategy, supported by proper configuration, identity and cloud security, penetration testing and …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","autoblue_enabled":true,"autoblue_custom_message":"","autoblue_shares":[{"did":"did:plc:revymtt5qssww7e7avbruzic","date":"2026-09-15T14:14:23+00:00","uri":"at:\/\/did:plc:revymtt5qssww7e7avbruzic\/app.bsky.feed.post\/3mvkspieqja2b","response":"{\"uri\":\"at:\/\/did:plc:revymtt5qssww7e7avbruzic\/app.bsky.feed.post\/3mvkspieqja2b\",\"cid\":\"bafyreidmqkvxgtzgvhp65tntqcep7srjf2i7gemn4rbxbt7bv5kgyhepfa\",\"commit\":{\"cid\":\"bafyreiddltla75bei2f6apktejdgu7blvdqbgdz24agairjtgvevcys6nm\",\"rev\":\"3mvkspieyda2b\"},\"validationStatus\":\"valid\"}"}],"autoblue_post_url":"","autoblue_publish_document":false,"republication-tracker-tool-hide-widget":false,"footnotes":""},"categories":[3],"tags":[29],"class_list":["type-post","category-news","tag-mypr-africa","entry"],"acf":[],"_links":{"self":[{"href":"https:\/\/mypr.co.za\/mail\/wp-json\/wp\/v2\/posts\/7192","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mypr.co.za\/mail\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mypr.co.za\/mail\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mypr.co.za\/mail\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mypr.co.za\/mail\/wp-json\/wp\/v2\/comments?post=7192"}],"version-history":[{"count":0,"href":"https:\/\/mypr.co.za\/mail\/wp-json\/wp\/v2\/posts\/7192\/revisions"}],"wp:attachment":[{"href":"https:\/\/mypr.co.za\/mail\/wp-json\/wp\/v2\/media?parent=7192"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mypr.co.za\/mail\/wp-json\/wp\/v2\/categories?post=7192"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mypr.co.za\/mail\/wp-json\/wp\/v2\/tags?post=7192"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}