Traditional antivirus matches files against a database of known-bad signatures. It stops what has been seen before and misses what hasn't. Endpoint detection and response (EDR) adds behavioural detection, flagging what a piece of software is actually doing rather than only what it matches, plus a response capability: isolating an affected endpoint from the network automatically or on command. NCA ECC-2:2024's Cybersecurity Defence domain names endpoint protection as a control requiring central management, which a per-device antivirus licence with no central visibility and no behavioural detection does not satisfy.

Phishing remains the starting point for a large share of the incidents any response team investigates. Email security in this context means anti-phishing filtering, attachment sandboxing that detonates suspicious files in isolation before they reach an inbox, and impersonation protection that catches a spoofed sender address before a finance team acts on it. This is prevention working upstream of everything else: an email that never reaches a user cannot be clicked.

Credential-based attacks, a reused password, a phished login, a session token stolen from an unpatched browser, are frequently the more efficient path into an environment, more efficient than finding and exploiting a software vulnerability. Identity threat protection watches for the signals that indicate compromised credentials in use: logins from an impossible travel distance, privilege escalation outside a normal pattern, authentication from a new device without the expected verification step.

Prevention stops what it can recognise, whether by signature, behaviour, or anomaly. It does not stop everything, and treating it as a complete defence is the mistake that leaves organisations exposed. Two things it explicitly does not replace:

Monitoring and response. Prevention reduces the volume reaching a security operations centre; it does not eliminate the need for one. Some threats, particularly identity misuse that looks like a legitimate login using stolen credentials, require a human watching for a pattern rather than a rule blocking a known signature.

Vulnerability management. Prevention tooling defends the endpoint and the inbox. It does nothing about the unpatched server or the misconfigured cloud storage bucket that an attacker reaches by a different route entirely.

Advanced threat protection, managed detection and response, and vulnerability management are three distinct layers that work together rather than substitute for one another: prevention reduces volume, vulnerability management shrinks the attack surface prevention has to defend, and monitoring catches what the first two don't stop. An organisation that has invested heavily in one and skipped the other two has a gap, whichever one it is.

A free cybersecurity maturity assessment scores endpoint, email, identity, and the surrounding controls against the NIST Cybersecurity Framework, and is a reasonable starting point for seeing which of the three layers is actually the weakest one in your environment.