Tech Graveyard/security
Signature-Based Antivirus (1987 to Dying)
In 2014 a Symantec executive told The Wall Street Journal that antivirus was dead. Marketing budgets kept signature AV alive another decade. EDR and XDR are finishing the job.
Born 1987 · Still dying, projected end 2027 · Status: dying
By Deepak Gupta · Published · Last updated
Paired prediction: what replaces it in Future Tech
Certificate of Death
Name of decedent
Signature-Based Antivirus
- Born
- 1987
- Died
- Not yet
- Age
- 39+
Cause of death
Polymorphic and AI-generated malware made signature matching mathematically impossible
Survived by
EDR (CrowdStrike, SentinelOne), XDR, behavioral analytics platforms
Invented by
Multiple inventors; commercialized by McAfee VirusScan and Symantec Norton AntiVirus
The hook
AV-TEST registers more than 450,000 new malware samples per day. Signature-based AV requires writing a new signature for each. The math has not worked since 2015.
Thesis. Signature AV is not dying from a technical breakthrough. It is dying because the input volume crossed the rate at which signatures could be generated.
The story
The origin
McAfee VirusScan, 1987. The idea was simple: compare each file against a database of known-bad byte patterns. Simple, fast, effective for the malware landscape of the late 1980s.
The peak
2005. AV is mandatory on every Windows machine. Compliance auditors check the box. The category was so well-defined that it spawned the most successful enterprise security companies of the era.
The polymorphism problem
Late 2000s onward. Malware mutates each instance. Static signatures stop matching. Generic detection improves but cannot keep up with the rate of new variants being generated.
The behavioral pivot
CrowdStrike (2011), SentinelOne (2013), Cylance (2012). Endpoint Detection and Response replaces 'scan for known bad' with 'watch for suspicious behavior.' The model fundamentally changes from pattern matching to telemetry analysis.
The compliance migration
In May 2021, Executive Order 14028 directed US federal agencies to deploy EDR. Signature matching alone stopped being an acceptable endpoint control on federal networks. Policy is now reinforcing what the technology change started.
Key data points
- McAfee VirusScan launch: 1987
- AV-TEST daily malware sample count: 450,000+
- CrowdStrike founding: 2011
- SentinelOne founding: 2013
- US Executive Order 14028 directs federal EDR rollout: May 2021
- Symantec executive calls antivirus 'dead': May 2014
Contrarian angle
The most successful product in cybersecurity history was a model that fundamentally could not scale. The vendors knew. They sold something else (EDR) once they could.
The flip side
What replaces it
The paired prediction in Future Tech.
Read the prediction◆ Technology Rewired
See the full evolution in Technology Rewired:
FAQ
Is Windows Defender still signature-based?
Hybrid. Defender uses cloud-delivered ML detection, behavioral analytics, and signatures together. The signature component is the smallest share of the actual detection now.
Do I still need antivirus on my Mac?
Built-in XProtect plus Gatekeeper covers most consumer threats. For enterprise Macs, EDR is the right tool. Pure signature-based AV is not the answer on either platform.
Is 'next-gen AV' different from EDR?
Largely a marketing distinction now. NGAV originally meant 'ML-based instead of signature-based.' EDR adds telemetry retention and response capabilities. Modern platforms are both.
More from guptadeepak.com
Further reading
Related obituaries
More from the security graveyard.
2000 to dying
DyingThe CAPTCHA
Bots solved distorted-text CAPTCHAs with 99.8% accuracy in a 2023 UC Irvine study. Humans scored 50 to 84%. The CAPTCHA increasingly blocks humans, not bots.
Cause: Bots and AI vision models solve CAPTCHAs as well as humans, for a fraction of a cent per solve
security · Peak 2014 · Projected end 2027
1839 to dying
DyingThe Photo as Proof
I built a CIAM platform that scaled to over a billion users, and its whole job was deciding whether a credential is real. Photographs used to do that work for free. That era is ending quietly, and almost nobody has changed how they look at an image.
Cause: Generative models that produce photoreal images of anything, indistinguishable from a capture, at zero marginal cost.
security · Peak 2005 · Projected end 2028
1960 to dying
DyingStranger Danger
We taught a whole generation one rule: do not talk to strangers. Then we got in their cars, slept in their homes, and matched with them at 11pm. I spent years building identity systems, the kind of trust rails that made the rule obsolete, and I am still not sure we made the right trade.
Cause: Rating systems and platform intermediation made stranger trust scalable, so the instinct to avoid strangers stopped paying off.
security · Peak 1990 · Projected end 2030