NexusSec.Ransomware operators stopped relying on files that antivirus recognises years ago. Understanding what each technology can and cannot do is the difference between believing you are protected and actually being protected.
What traditional antivirus does
Antivirus compares files against signatures of known malware and applies heuristics for suspicious file characteristics. It is fast, cheap and effective against commodity threats — and it remains genuinely worth having.
What it misses: novel malware with no signature yet, fileless attacks that run entirely in memory, and "living off the land" techniques where the attacker abuses legitimate tools already on the system — PowerShell, WMI, PsExec. None of those involve a malicious file for antivirus to match.
What EDR does
Endpoint Detection and Response continuously records what happens on the endpoint — processes launched, network connections opened, files and registry keys modified, parent-child process relationships — and analyses those patterns for attacker behaviour.
Because it looks at behaviour rather than file identity, EDR can flag a Word document spawning PowerShell which then connects to an unfamiliar host, even though no individual component is a known-malicious file. Crucially, it also provides response: isolate the host from the network, terminate a process, and reconstruct the sequence of events for investigation.
Side by side
| Aspect | Antivirus | EDR |
|---|---|---|
| Detects by | Signatures and heuristics | Behaviour and activity patterns |
| Novel malware | Often missed until a signature exists | Frequently caught behaviourally |
| Fileless attacks | Largely blind | Designed for exactly this |
| Visibility | File verdicts | Full activity timeline |
| Response | Quarantine or delete file | Isolate host, kill process, trace and remediate |
| Operational effort | Minimal | Requires someone to triage alerts |
The honest caveat about EDR
Where XDR and MDR fit
- EPP — Endpoint Protection Platform: the modern successor to antivirus, prevention-focused. Most products today combine EPP and EDR.
- XDR — Extended Detection and Response: correlates endpoint telemetry with firewall, identity, email and cloud signals for a fuller picture.
- MDR — Managed Detection and Response: a provider operates the tooling and responds on your behalf. For most businesses without a security team, this is the realistic route to value.
What we recommend
- Treat EDR as the baseline for business endpoints in 2026 — signature-only protection is no longer sufficient against ransomware.
- Be honest about who watches it. No one available? Choose a managed service.
- Pair it with the network layer. Sophos Synchronized Security, for example, lets the firewall automatically isolate an endpoint the EDR flags — see our Sophos vs Fortinet comparison.
- Do not neglect fundamentals. EDR does not replace patching, least privilege, MFA and tested offline backups. Most ransomware we investigate succeeded through unpatched services or weak credentials, not exotic malware.
The bottom line
Antivirus answers "is this file known to be bad?" EDR answers "is something behaving like an attacker on this machine, and what do I do about it?" You need the second capability — but only if someone acts on what it tells you. Buy the capability you can actually operate, and if that means a managed service, that is the right answer rather than a compromise.