Business antivirus solutions: recommendations and things to avoid

For a company, the right antivirus solution is a single one, the same on every computer and server, managed centrally from a console and, preferably, with endpoint detection and response (EDR) features, not an antivirus installed separately on each computer by each user.

The need to secure workstations has grown since people started working a lot from home, not just from the office. And when we talk about IT security, we also have to talk about antivirus solutions.

In this article, we present some recommendations and some things you should avoid.

Recommended: install the same antivirus solution on all company workstations

An infrastructure is only as secure as the most vulnerable device on the network. That’s why we recommend protecting all workstations and servers with the same antivirus solution, including the laptops people use to work from home and Mac computers (see also whether Mac OS X needs antivirus protection).

There’s no point in securing only the servers and critical workstations: if a single computer on the network gets infected, for example with ransomware, it may manage to encrypt all the company’s data.

One antivirus per computer, not two: two active antivirus programs on the same computer interfere with each other, slow down the system and can leave gaps in protection.

Avoid: antivirus software that can’t be managed centrally from a console

The most effective antivirus solutions are the ones managed centrally, from a console. Besides monitoring, the console lets you update the antivirus on every workstation and easily change security policies, and alerts from any computer immediately reach the people who manage the network.

The main advantage is that protection can’t be turned off from the workstations (the feature is usually called tamper protection), so users always stay protected, even if a malicious program or a user in a hurry tries to disable it.

Recommended: keep the antivirus solution and its signature databases constantly updated

A powerful antivirus is useless if it isn’t updated to recognize the latest threats. That’s why you should constantly update both the antivirus software and the signature databases, preferably automatically, from the console.

It’s just as important to update the operating system and other software: an antivirus doesn’t close a vulnerability that has been left unpatched.

Recommended: implement strict security policies

A good security practice is to restrict access to everything that isn’t necessary for the company’s work. If some workstations don’t need internet access, it should be restricted.

Likewise, services that don’t run on the workstations should be blocked in the security solution’s firewall. Regular users shouldn’t have administrator rights, and macros in documents received from the internet should be blocked.

Avoid: extensive virus scans during working hours

So you don’t slow down your colleagues’ work, don’t schedule full workstation scans during working hours.

Antivirus programs provide active protection anyway, detecting threats in real time. On top of this, though, you need to run full scans periodically. Operationally, the simplest approach is to pick one day, company-wide, when workstations stay on overnight, so the scan finishes outside working hours. Many solutions can also start the scan only when the computer isn’t in use.

Recommended: move from classic antivirus to EDR

A classic antivirus mainly recognizes threats that are already known. An EDR (Endpoint Detection and Response) solution also monitors how programs behave, so it can detect attacks for which no signatures exist yet, it can remotely isolate a compromised computer and it keeps a history of events, which is useful when you need to find out what happened.

For small companies, EDR no longer necessarily means a separate cost: for example, the Microsoft 365 Business Premium subscription includes Microsoft Defender for Business. And if you don’t have someone to watch the alerts, a managed detection and response (MDR) service does it for you.

The differences between antivirus, EDR, XDR and MDR, and the solutions we recommend (Bitdefender, Microsoft Defender, Fortinet), are on our page about IT security for businesses.

Avoid: relying on antivirus alone

Antivirus is just one layer of protection. On top of it, the company needs:

• backup kept separate from the company network, from which data can be restored after an attack (see backup recommendations);
• two-step verification for email and remote access;
• updates applied promptly to systems and software;
• training for your colleagues, because many attacks start with a phishing email; see also popular types of malware and how to protect yourself against them.

RezolvIT protects companies’ computers and servers as part of IT security; antivirus licenses are included in the Business Unlimited plan. We’re ISO/IEC 27001 certified for information security. If you want to know how well the computers in your company are protected, we start with a free IT audit.