Is next-generation antivirus (NGAV) deployed on all endpoints?
Carriers ask this alongside the endpoint detection question because the two controls fail differently, and because signature-only antivirus is still surprisingly common.
What the carrier is actually asking
The carrier is asking whether endpoint protection uses behavioural and machine-learning detection rather than signature matching alone. Next-generation antivirus is expected to stop things it has never seen before, which is the entire category of threat that signature products miss by design.
Why it is underwritten
Ransomware payloads are usually unique per victim, which means their hashes are new. A signature product has nothing to match. Behavioural detection catches the actions instead: mass file modification, shadow copy deletion, suspicious process injection. Underwriters ask this separately because organisations that answer yes to the detection question sometimes turn out to be running a decade-old signature product with an updated marketing name.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Product identity and coverage come from your endpoint console. The tenant can confirm the Microsoft components and whether device compliance requires antimalware at all.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Microsoft 365 | Intune compliance policy requirements for antimalware and real-time protection | The compliance policy actually requires antimalware to be present, healthy, and up to date |
| Azure | Endpoint protection on virtual machines, and Defender for Servers state | Server workloads carry protection rather than relying on network controls alone |
| Microsoft 365 | Device secure score and configuration baselines | Attack surface reduction rules and cloud-delivered protection enabled rather than left at defaults |
| Entra ID | Conditional Access enforcement of device compliance | A device failing the antimalware requirement loses access, which is what makes the requirement real |
| Endpoint console | Product name, version, and definition currency across the fleet | The actual product in use, with cloud-delivered and behavioural protection enabled. Attested |
Modern antivirus ships with behavioural protection, cloud lookup, and attack surface reduction that can all be turned off, and in many estates some of them are, usually after a compatibility complaint years ago. Coverage is the first half of this answer; configuration is the second.
What a defensible yes requires
- The product performs behavioural and cloud-assisted detection, not signature matching alone.
- Coverage extends to servers and cloud workloads, not only user endpoints.
- Real-time protection, cloud-delivered protection, and tamper protection are on.
- Attack surface reduction rules are enforced rather than left in audit mode.
- Exclusions are inventoried, because broad path exclusions added years ago create protection-free zones.
How this answer goes wrong
The overlooked failure is exclusions. Someone excluded a whole drive to fix a performance complaint on a line-of-business application, and that exclusion has been in the baseline ever since. The product is deployed, healthy, and blind exactly where an attacker would choose to stage. The second failure is audit mode: attack surface reduction rules configured to report rather than block, which looks configured and prevents nothing.
Frequently asked
Is Defender Antivirus considered next-generation?
Yes, when cloud-delivered protection and behavioural monitoring are enabled. It is a mainstream answer that carriers accept without comment.
Do we need both antivirus and EDR?
Most carriers expect prevention and detection together, and modern platforms deliver both from one agent. Answering yes to both from a single product is normal and worth stating clearly.
How do exclusions affect the answer?
Materially, and nobody asks about them on the form. Reviewing them before renewal is cheap and occasionally alarming.
What about Linux and macOS endpoints?
They count. Estates with mixed platforms often have full coverage on Windows and partial coverage elsewhere, which is a coverage gap the denominator should reflect.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture