A security administrator notices a recent increase in workstations becoming compromised by malware. Often, the malware is delivered via drive-by downloads, from malware hosting websites, and is not…

Increasing antivirus update frequency does not help when the malware is unknown or zero-day and is already evading the existing AV engine's signatures.

A cloud-based content filter blocks access to known malware-hosting websites by category before any payload is delivered to the endpoint, bypassing the antivirus detection gap entirely. This is a proactive defense that stops the attack at the source rather than attempting to detect malware after it arrives. Because the malicious content never reaches the workstation, signature-based AV failures become irrelevant.

A NIPS still relies on detection of known exploit signatures rather than preventing access to malicious sites, and may not intercept all web-based malware especially over encrypted channels.

A gateway antivirus server uses the same signature-based detection that is already failing, so it would not solve the problem of malware evading corporate antivirus.