Is AntiVirus Really Dead? Security Professionals on Symantec's Declaration

Symantec Corp., one of the biggest names in anti-virus software, shocked the cybersecurity community Sunday when it declared to the Wall Street Journal that antivirus software “is dead.”

But that announcement was probably even more shocking to the Symantec customers who have been spending at least $50 a year for Norton AntiVirus, Symantec’s most popular consumer product, which has been many users’ primary security software for almost 25 years.

Did Symantec just tell its customers that they’ve been paying for an obsolete product?

“It’s quite a bold statement,” Jerome Segura, a senior security researcher at Malwarebytes, told International Business Times. “[AntiVirus] on its own is no longer sufficient. The threat landscape has diversified so much, and AV companies have not adapted as fast.”

What has changed since Symantec launched Norton AntiVirus in 1991 is that computer viruses, which infect files on a hard drive and replicate, are now just one of several dangers facing computer users. There is the broader threat of malware, like Trojans that open a back door into a computer for hackers, and spyware that can record a user’s every mouse-click and keyboard stroke. There are also security flaws like Heartbleed that are immune to AV software.

“[AV is] only a portion of the security business,” Segura said, and it’s a portion that has been very crowded for many years now. “The market share is so divided that making money in the AV space is getting more and more difficult.”

So the point is not really that AV is dead, but that Symantec isn’t making as much money from it anymore. The newer threats are being addressed by smaller companies like Malwarebytes and FireEye (which discovered that a group of hackers was exploiting the Internet Explorer bug to attack U.S. defense and financial firms), that emphasize minimizing damage when a security breach occurs.

“At some point, your network will be compromised,” Segura said. “You do as much as you can to protect it, but it will happen. What matters is how you react.”

Larger companies like Symantec now find themselves shifting their business model to keep up. According to the Wall Street Journal, Symantec will launch new initiatives in the next six months to turn around sliding revenue.

That’s not to say users should throw out their AV protection. Security experts point out that staying safe online means having several layers of defense, and traditional AV software still needs to be the first layer.

Raj Samani, chief technology officer at McAfee, one of Symantec’s primary AV competitors, and adviser on Internet security to Europol, said traditional AV programs still have a role to play.

“It acts like the bouncer at the door and still stops a considerable amount of what we know to be bad,” Samani told IBTimes, adding that he thinks Symantec really meant the days of using a single tool to protect a computer are dead.

“They say there’s no such thing as a silver bullet, but there are. All antivirus is a silver bullet, but not all threats are a werewolf.”

Samani and Segura both said that in addition to protecting against viruses and malware, users need to be vigilant about what they click online and use a Web browser that protects against dangerous websites.

Users also need to comply with the basic protection rules they've heard many times. According to Segura, consumers still don't change their passwords as often as they should, and -- despite repeated warnings -- many use the same password for multiple accounts. This makes a data breach to one account much more damaging.