An organization's email filter is an ineffective control, and as a result, employees have been constantly receiving phishing emails. As part of a security incident investigation, a security analyst…

EDR and DLP focus on behavioral detection and outbound data loss prevention respectively, but do not provide the file-level change auditing needed to trace exactly how the malicious document altered the endpoint.

DAM is designed for database activity monitoring and provides no value for endpoint file analysis; MFA addresses authentication weaknesses rather than malware execution or data protection.

HIPS and application whitelisting are preventive controls that limit execution, but they do not generate the detailed forensic file-change data needed to identify the root cause of an existing compromise.

File Integrity Monitoring (FIM) records all unauthorized changes to files on the endpoint, giving analysts a forensic trail to trace exactly what the downloaded .doc file modified or created. Antivirus complements this by scanning and blocking known malicious code in documents before execution, protecting against similar phishing-delivered malware in the future. Together they satisfy both the root cause analysis and information protection requirements stated in the question.