What is Malware?

Malware (malicious software) is any program or code built to damage, disrupt, or gain unauthorized access to a computer system without the owner’s consent. It includes viruses, worms, Trojans, spyware, adware, and ransomware, and can steal data, deny access to systems, or give attackers a foothold inside a network.

Key takeaways

• Malware covers viruses, worms, Trojans, spyware, adware, and ransomware.
• It can steal data, spy on users, or hold systems for ransom.
• Antivirus tools detect and block it in files as they move across the network.
• Endpoint checks confirm anti-malware software is running before granting access.
• Ransomware, phishing, and unpatched software are today’s most common infection paths.

On this page: Why it matters · How it works · Types · Malware & Versa · FAQ

Why is malware important?

Malware is the vehicle behind most cyberattacks – ransomware, data theft, credential harvesting, and denial-of-service all start with malicious code reaching a device or a network. Its cost is more than a ransom payment: downtime, incident response, regulatory exposure, and reputational damage follow a successful infection, and modern strains often chain several techniques – a phishing email drops a loader that then fetches ransomware – to maximize damage before defenders notice.

For network and security teams, malware matters because the attack surface keeps expanding. Remote work puts unmanaged devices on the internet, direct-to-cloud connections bypass the traditional perimeter, and encrypted traffic hides payloads unless inspected at the right point. Effective defense needs coverage at multiple layers – file inspection in transit, endpoint verification, and behavioral detection for threats that evade signature scanning – not a single choke-point firewall.

What is malware?

Malware is a general term for software written with malicious intent – the trait that separates it from buggy or merely unwanted legitimate software. It spreads through phishing attachments, drive-by downloads, exploited vulnerabilities, infected removable media, and trojanized installers that impersonate legitimate applications.

Once it reaches a target, malware behaves according to its purpose: viruses and worms self-replicate to spread further; Trojans disguise themselves as legitimate software to gain a foothold; spyware and keyloggers exfiltrate credentials silently; ransomware encrypts files and demands payment for the key; adware and rootkits are less destructive but respectively degrade the user experience and hide an attacker’s presence.

Defenses match that variety. Signature-based antivirus catches known malware against a database of identifiers. Heuristic and behavioral analysis flags code that acts maliciously even without a known signature – encrypting files rapidly, contacting unusual command-and-control servers – which matters most against new strains. Sandboxing detonates suspicious files in an isolated environment to observe behavior first.

Types of malware

Malware is commonly grouped by how it spreads and what it does once installed. Viruses attach themselves to legitimate files or programs and replicate when the host file runs, spreading to other files on the same system. Worms are self-propagating and spread across networks without needing a host file or user action, often exploiting unpatched vulnerabilities. Trojans masquerade as legitimate software to trick users into installing them, then open a backdoor or deliver a secondary payload. Ransomware encrypts files or entire systems and demands payment for restoration – often the final stage of a multi-step attack chain. Spyware and keyloggers run silently to capture credentials, keystrokes, and browsing activity for exfiltration. Adware displays unwanted ads and often bundles tracking components. Rootkits modify the operating system to hide an attacker’s presence.

Malware & Versa

Versa addresses malware at two points in the network. Malware Protection Policies – configured under Secure SD-WAN > Profile Elements > Policies > Security > Malware Protection, and referred to as antivirus policies once attached to a profile – inspect traffic by protocol and file type and enforce an action (Alert, Allow, Deny, or Reject) on a match. The Configure SD-WAN Malware Protection Policies guide walks through building and attaching one.

Separately, Endpoint Information Profile (EIP) posture checks validate that a connecting device runs approved anti-malware software – CrowdStrike Falcon, SentinelOne, Jamf Protect, Malwarebytes, or Microsoft Defender for Endpoint – before the Versa SASE Client authenticates it. Administrators define the approved vendor and product in an EIP object; devices that fail are flagged non-compliant and denied access until the protection is installed. See the EIP configuration guide and its step-by-step walkthrough.

Frequently asked questions

What is the difference between a virus and malware?

Malware is the umbrella term for all malicious software. A virus is one type of malware – code that attaches to a legitimate file and replicates when that file runs. Worms, Trojans, ransomware, spyware, and adware are other malware types that spread differently.

How does malware get onto a system?

Common delivery methods include phishing attachments, drive-by downloads from compromised sites, exploited software vulnerabilities, infected removable media, and trojanized installers disguised as legitimate applications. Attackers often chain these – a phishing link drops a loader that then fetches a ransomware payload.

What is the difference between antivirus and antimalware?

The terms are largely interchangeable today, though antivirus historically meant signature-based detection of known threats, while antimalware implies broader coverage – behavioral analysis and heuristics that also catch ransomware, spyware, and other non-viral threats that lack a known signature to match against.

Can malware be detected before it executes?

Yes. Signature-based scanning blocks known malware on sight, heuristic and behavioral analysis flags suspicious code even without a matching signature, and sandboxing detonates unknown files in an isolated environment to observe their behavior before they ever reach a live endpoint.

How does Zero Trust help stop malware?

Zero Trust checks device posture – including whether approved anti-malware software is installed and running – before granting access, so an unprotected endpoint is denied rather than trusted by default. Versa enforces this through Endpoint Information Profile (EIP) checks tied to the SASE Client.

More on Malware

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about malware, these are worth looking at next.