What is Antivirus (AV)?

Antivirus (AV) is security software that scans files as they cross a network – in web downloads, email attachments, or file transfers – comparing them against known malware signatures and blocking, alerting on, or rejecting infected files before they reach the user or server they were sent to.

Key takeaways

• AV scans files in web and email traffic for known malware signatures.
• Predefined profiles scan up to 512 KB; custom profiles scan larger files.
• Matches trigger alert, allow, deny, or reject actions per profile.
• Versa applies AV as an NGFW threat profile inside VOS policy rules.
• Signature-database updates ship through periodic Versa SPack releases.

On this page: Why it matters · How it works · Types · AV & Versa · FAQ

Why is AV important?

Files are still one of the most common ways malicious code reaches a network – an infected email attachment, a trojanized installer over HTTP, a payload hidden inside an ordinary download. Antivirus matters because it inspects that traffic at the point it crosses the network, rather than relying only on the endpoint that eventually opens the file.

That network-level check matters because endpoint protection is inconsistent – personal devices, contractor laptops, and unmanaged endpoints on a hybrid network don’t always run current anti-malware software, leaving gaps an attacker can walk through. Scanning files in transit closes that gap for the traffic types most commonly abused for delivery: web downloads and email attachments. Antivirus is one layer in a defense-in-depth strategy – it doesn’t replace endpoint protection or user training, but it stops a known threat before it reaches whatever device is waiting on the other end.

What is AV?

Antivirus software scans files carried in two kinds of traffic: web traffic sent over FTP and HTTP, and email traffic sent over IMAP, MAPI, POP3, and SMTP. It works file by file – when the last byte of a file is transmitted, the antivirus engine extracts a copy, buffers it, and scans it against a database of known malware signatures, across dozens of supported file types spanning executables, archives, documents, and media files.

If the scan finds a match, the engine enforces whatever action its profile specifies – alert, allow, deny, or reject the file. If no match is found, the held-back data is released and the temporary copy is deleted, so the check adds essentially no delay to a clean file.

Types of antivirus scanning

Antivirus products differ mainly in how they decide a file is malicious, and most combine more than one method.

Signature-based detection compares a file against a database of known malware fingerprints – fast, with few false positives, but blind to threats it hasn’t seen yet.

Heuristic and behavioral detection flags code that behaves like a virus even without a matching signature, catching new and modified strains at the cost of occasional false positives.

Cloud-assisted detection offloads analysis to a service that correlates telemetry across customers and updates its threat intelligence continuously, sometimes via sandboxing. Most deployments layer all three rather than relying on one alone.

AV & Versa

VOS devices enable antivirus as one of two threat profiles – the other is Vulnerability (IDS/IPS) – configured inside NGFW security access policy rules as part of Versa’s unified threat management (UTM) capability. The engine scans web and email traffic, extracting and buffering each file as its last byte arrives and comparing it against Versa’s signature database, kept current through periodic SPack updates.

VOS ships three predefined profiles – Scan Web Traffic, Scan Email Traffic, and Scan Web and Email Traffic – each capped at 512 KB. Larger files require a custom profile paired with a storage profile, buffering to hard disk or RAM disk at the system or organization level. Scan statistics and threat logs surface in Versa Analytics. See Configure Antivirus and Configure Antivirus (NGFW) for the full procedure.

Frequently asked questions

What’s the difference between antivirus and antimalware?

The terms are largely interchangeable today, though antivirus historically meant signature-based detection of known viruses, while antimalware implies the broader coverage added by heuristic and behavioral analysis, which catches ransomware, spyware, and other threats that don’t yet have a known signature.

What types of traffic does antivirus scanning cover?

On VOS devices, antivirus scans two traffic categories: web traffic sent over FTP and HTTP, and email traffic sent over IMAP, MAPI, POP3, and SMTP. Predefined profiles – Scan Web Traffic, Scan Email Traffic, or Scan Web and Email Traffic – target one or both categories.

What happens when antivirus detects a virus in a file?

The profile’s configured action takes effect: alert lets the file through and logs it, allow lets it through silently, deny blocks it, and reject blocks it while resetting the connection to both client and server. Which action applies depends on the profile attached to the matching policy rule.

What’s the maximum file size antivirus can scan?

Predefined antivirus profiles cap scanning at 512 KB. To scan larger files, administrators create a custom antivirus profile paired with a storage profile, which buffers the file on hard disk or RAM disk – at the system or organization level – while the scan completes.

Does antivirus replace endpoint anti-malware software?

No. Network-based antivirus and endpoint anti-malware software cover different exposure: one inspects files as they cross the network, the other protects the device afterward, including through channels – like removable media – that never cross a network chokepoint. Effective defense uses both.

More on AV

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about AV, these are worth looking at next.