--- title: "Is next-generation antivirus (NGAV) deployed on all endpoints?" url: https://insuranceposture.com/questions/endpoint-and-patching/next-generation-antivirus-deployed-endpoints category: "Endpoint protection and patching" canonical_key: q_edr_002 evidence_state: partial updated: 2026-08-24 --- # Is next-generation antivirus (NGAV) deployed on all endpoints? URL: https://insuranceposture.com/questions/endpoint-and-patching/next-generation-antivirus-deployed-endpoints Section: Endpoint protection and patching Evidence state: Partly verifiable from your tenant Carriers ask this alongside the endpoint detection question because the two controls fail differently, and because signature-only antivirus is still surprisingly common. ## What the carrier is actually asking The carrier is asking whether endpoint protection uses behavioural and machine-learning detection rather than signature matching alone. Next-generation antivirus is expected to stop things it has never seen before, which is the entire category of threat that signature products miss by design. ## Why it is underwritten Ransomware payloads are usually unique per victim, which means their hashes are new. A signature product has nothing to match. Behavioural detection catches the actions instead: mass file modification, shadow copy deletion, suspicious process injection. Underwriters ask this separately because organisations that answer yes to the detection question sometimes turn out to be running a decade-old signature product with an updated marketing name. ## Where the answer lives in Microsoft 365, Entra ID, and Azure Product identity and coverage come from your endpoint console. The tenant can confirm the Microsoft components and whether device compliance requires antimalware at all. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Microsoft 365 | Intune compliance policy requirements for antimalware and real-time protection | The compliance policy actually requires antimalware to be present, healthy, and up to date | | Azure | Endpoint protection on virtual machines, and Defender for Servers state | Server workloads carry protection rather than relying on network controls alone | | Microsoft 365 | Device secure score and configuration baselines | Attack surface reduction rules and cloud-delivered protection enabled rather than left at defaults | | Entra ID | Conditional Access enforcement of device compliance | A device failing the antimalware requirement loses access, which is what makes the requirement real | | Endpoint console | Product name, version, and definition currency across the fleet | The actual product in use, with cloud-delivered and behavioural protection enabled. Attested | **Enabled features, not just an installed product** Modern antivirus ships with behavioural protection, cloud lookup, and attack surface reduction that can all be turned off, and in many estates some of them are, usually after a compatibility complaint years ago. Coverage is the first half of this answer; configuration is the second. ## What a defensible yes requires - The product performs behavioural and cloud-assisted detection, not signature matching alone. - Coverage extends to servers and cloud workloads, not only user endpoints. - Real-time protection, cloud-delivered protection, and tamper protection are on. - Attack surface reduction rules are enforced rather than left in audit mode. - Exclusions are inventoried, because broad path exclusions added years ago create protection-free zones. ## How this answer goes wrong The overlooked failure is exclusions. Someone excluded a whole drive to fix a performance complaint on a line-of-business application, and that exclusion has been in the baseline ever since. The product is deployed, healthy, and blind exactly where an attacker would choose to stage. The second failure is audit mode: attack surface reduction rules configured to report rather than block, which looks configured and prevents nothing. ## If this answer turns out to be wrong Agent coverage, patch state, and end-of-life software are the answers that move fastest without anyone deciding to move them, so this block is where an accurate answer most often ages into an inaccurate one before the policy expires. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [why an accurate answer ages, and when the policy makes that matter](https://insuranceposture.com/glossary/point-in-time-underwriting). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Is Defender Antivirus considered next-generation? Yes, when cloud-delivered protection and behavioural monitoring are enabled. It is a mainstream answer that carriers accept without comment. ### Do we need both antivirus and EDR? Most carriers expect prevention and detection together, and modern platforms deliver both from one agent. Answering yes to both from a single product is normal and worth stating clearly. ### How do exclusions affect the answer? Materially, and nobody asks about them on the form. Reviewing them before renewal is cheap and occasionally alarming. ### What about Linux and macOS endpoints? They count. Estates with mixed platforms often have full coverage on Windows and partial coverage elsewhere, which is a coverage gap the denominator should reflect. ## Related questions - [Is endpoint detection & response (EDR) deployed with central monitoring?](https://insuranceposture.com/questions/endpoint-and-patching/endpoint-detection-response-deployed-central-monitoring) - [What percentage of endpoints have EDR deployed?](https://insuranceposture.com/questions/endpoint-and-patching/percentage-endpoints-edr-deployed) - [Is software installation automatically controlled and unauthorized software blocked?](https://insuranceposture.com/questions/endpoint-and-patching/software-installation-automatically-controlled-unauthorized-software-blocked) - [Is application allow-listing enforced on critical servers to block unauthorized programs and scripts?](https://insuranceposture.com/questions/endpoint-and-patching/application-allow-listing-enforced-critical-servers-block-unauthorized-programs) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.