Signature-based detection
Signature-based detection is the way anti-malware software recognises known malware, by comparing files against a list of fingerprints, called signatures or definitions, supplied by the vendor. The Cyber Essentials requirements do not use the term, but they require anti-malware software to be updated in line with vendor recommendations, which is what keeps signatures current (A8.2).
- Term
- Signature-based detection
- Also known as
- Signature detection, Virus definitions, Malware signatures
- Category
- Malware, cloud and threats
- Requirement area
- Scheme vocabulary
- Questions
- A8.2
- Reviewed against
- Requirements v3.3
What does the term signature-based detection mean in Cyber Essentials?
Signature-based detection is the way anti-malware software recognises known malware, by comparing files against a list of fingerprints, called signatures or definitions, supplied by the vendor.
How does signature-based detection apply to Cyber Essentials?
In plain terms
It works like a list of banned faces behind a bar. Each known piece of malware has a recognisable fingerprint. The anti-malware software compares every file against the list and turns away anything that matches. The weakness is the same as the bar's: a face that is not on the list yet gets in, which is why the list has to be refreshed constantly. Modern products add behaviour checks on top, but signatures remain the base layer.
What Cyber Essentials asks
The requirements say anti-malware software must "be updated in line with vendor recommendations". A8.2 asks whether it is "set to update in line with the vendor's guidelines and prevent malware from running on detection". The introduction to the Danzell malware section explains why: "Malware is continually evolving, so it is important that the supplier includes detection facilities which are updated as frequently as possible."
The scheme does not ask how your product detects malware. It asks that the product is up to date and stops what it finds.
What an assessor looks for
- Automatic updates left on. The A8.2 guidance says this "is usually the default setting for anti-malware software."
- At Cyber Essentials Plus, where test files do not settle the question, sub-test 3.1.3 checks that the software "is updated in accordance with the vendors configuration instructions."
- The Plus malware test files are inert samples chosen because common antivirus products are known to flag them, so an out-of-date product has little excuse for missing one.
See A8.2 and the malware protection requirements. Related: anti-malware software, malware.
Related terms
- Anti-malware softwareAnti-malware software is a program that checks files, downloads and websites for known harmful software and stops it before it can run.
- MalwareMalware is software that someone has written and spread on purpose to cause harm, such as computer viruses, worms and ransomware.
- Social engineeringSocial engineering is manipulating people, rather than hacking computers, to get them to hand over information, money or access, usually by pretending to be someone they trust.
- Supply chain securitySupply chain security is making sure the suppliers and service providers you rely on do not become the weak link that lets an attacker in.
- Vulnerability scanA vulnerability scan is an automated check in which software examines your devices or internet connections for known security weaknesses.
- Allow listing (application allow listing)Allow listing is a malware protection option in which only approved applications, restricted by code signing, are allowed to execute on devices.
Frequently asked questions
Signature-based detection is the way anti-malware software recognises known malware, by comparing files against a list of fingerprints, called signatures or definitions, supplied by the vendor.
In the 2026 Danzell question set, signature-based detection comes up at A8.2. Read those questions against the definition above so your answers use the term the way the assessor will.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.