By Hallgrimur (Halli) Bjornsson, Chief Executive Officer (CEO) and Co-founder, Varist

Not long ago, the thought of AI-led malware that could morph or ‘play dead’ to avoid detection kept security leaders up at night. Now it’s our stark reality, one with the potential to overwhelm today’s detection by the end of this year. 

The scale of modern malware attacks already favors threat actors. Research by industry leaders shows that in 2025 nearly half (44%) of all data breaches involved malware and email-based malware attacks surged 131% year over year.

With conventional detection already failing to keep pace with new threats, the emergence of agentic AI will broaden the gap between injection and detection by orders of magnitude. The illusion of patching our way to safety is officially shattered. To keep up with AI-scale threats, anti-malware infrastructures will need to acknowledge and overcome two cold hard truths about the current approach:

Today’s detection assumes you can’t scan everything  

For most providers, scanning every file that should be scanned and analyzing every anomaly that should be analyzed would cost too much and take too long. Conventional scanning also generates huge volumes of false positives that create work analysts don’t have time to do. 

The alternative — delivering files unscanned — is something most companies do but nobody likes to think about.  

Old defenses are missing with new threats and flooding conventional sandboxes

Traditional malware detection relies on signatures and heuristics, which basically means taking a ‘black and white’ approach — the scan either turns up the signature of something known to be malicious, or it doesn’t. Novel or zero day threats flow effortlessly through gateways, servers, IDSs, and other defenses undeterred until something bad happens (like ransomware detonates) and someone reports it. 

If that’s a bit of an over-simplification, it’s not an overstatement to say that failing to detect novel threats becomes a massive shortfall in the face of agentic AI. Just last year, WatchGuard reported a 171% quarter-over-quarter spike in unique malware detections along with a rise in zero days — a clear indication that signature-based safeguards are missing more threats.

So, what now?

These two glaring gaps in today’s detection pipeline must get filled in order for anti-malware defenses to hold their own and avoid falling even farther behind. 

The Two Foundational Tenets of AI-Scale Detection 

To the extent that the industry thinks of anti-virus/anti-malware technology as a commodity, it’s time to think again. Even now, the differences in speed, scale, accuracy, and reliability make a huge difference, one that will be hugely magnified in days to come. 

To turn the tables on new attacks, AI-scale malware defenses need to scan every file and allow analysts to evaluate every legitimate threat easily at speed and scale.

Let’s break these down:

What would it take to scan everything?  

The first step in scaling defenses is to do what you’re already doing but do it much better. That means building hyperscale file scanning capabilities able to screen every file in real time. 

Scanning must be based on the largest, most up-to-date malware dataset available and be able to scan billions of files per day in seconds or even milliseconds, with extreme accuracy. Then comes the hard part, the new part: flagging every suspicious-looking anomaly for further investigation without generating too much work or too many false positives. 

Can you recognize, analyze, and prioritize new threats without overflowing sandboxes?

Even with hyperscale file scanning, a static or heuristics-based approach to looking for risky behaviors won’t recognize the next wave of unknown, AI-assisted malware threats. With no signature to match against pre-existing databases, the odds of detecting self-evolving or polymorphic malware that changes to avoid detection are slim and none.  

Evolving beyond ‘signatures’ 

Detection engines must eclipse signature lookups to detect more granular behavioral signals like:

• Structural anomalies
• Format abuse
• Entropy
• Metadata fingerprints – compiler/packer information

Putting these signals together tells a story, allowing context-aware risk profiles to be built for each file. Instead of black-and-white determinations, detection engines can assign ratings based on the likelihood of a file exhibiting malicious behavior in the live scenarios.  

Simulating behavior reveals risk and obfuscation

Emulating behavior shows what anomalous content could unfold and progress into full-blown malware, ransomware, and other types of attacks. Conducting this analysis in real time finds more risky behavior and helps to assign severity ratings to it which helps in prioritizing and making time-consuming sandbox explorations more efficient.  

Simulating AI-generated threat behavior lets defenders fight fire with fire to beat attackers at their own game by generating malware first, often using better data to predict the next interaction.

AI-scale detection modernizes the economics 

Sandboxing is and will remain an integral part of anti-malware defenses, but flooding the sandbox will only bury new threats in mud. It’s time to augment or supplement the process. With a deep run through a sandbox potentially taking 10 minutes or more, and then analysts’ work to figure out what the results mean taking much longer, sandboxing is not a viable option for analyzing every possible threat. 

Hyperscalers need an exponentially faster, more economical way to extract data from files that look suspicious — without relying on signatures and heuristics — and take a closer look. That means using dynamic analysis, or a sort of ‘pre-sandboxing’ technology to simulate the behavior of components in real-world situations before running a full sandbox exercise. 

Privacy must be protected

Modern detection solutions must increasingly protect the privacy of companies’ data, including the files and components they scan, to avoid misuse and ensure or demonstrate compliance.

Redefining “at scale” is a process

The combination of hyperscale file scanning and dynamic real-time simulation makes AI-scale malware detection possible. For hyperscalers, cloud providers, security vendors, and SOC teams that means:

• Scanning 100% of files in real time at massive scale
• Achieving average file analysis speeds of under 10 milliseconds 
• Maintaining false positive rates of .001% or lower
• Analyzing suspicious behaviors up to 1000x faster than conventional sandboxes  

Start with a baseline

Answering these questions helps to set realistic goals and prioritize investment:

• How many and what types of threats get detected?
• How long does it take to scan each individual file?
• What percentage of novel or zero-day threats gets flagged by your layer 1 defenses?
• What happens next when defenses recognize malware signatures or flag anomalous behaviors? 
• How much do you spend detecting the threats you’re catching today?

Finally, when a suspicious file gets through, what else do you have in place to catch and respond to it?  

Democratize detection and leverage AI for good

Detection can no longer be the job of one control, one team, or even a single provider. 

A ‘shift-left’ is key to avoiding more breaches and reducing the costs associated with detection, investigation, response, recovery, and compliance for everyone involved.  

While that won’t happen all at once, it can happen quickly and cost-effectively to keep pace with AI-propelled threats. Leverage AI-scale detection and analysis everywhere you can and choose providers that do the same. Acting on clearer, more insightful and actionable data at each stage is your best chance of standing your ground as AI does its thing in 2026. 

Let the games begin!

Hallgrimur (Halli) Bjornsson, Chief Executive Officer (CEO) and Co-founder

Halli’s two decades of business leadership include bringing innovative technology products to market and helping to drive the evolution of anti-malware technology worldwide. Before Varist, he served as VP of Anti-Malware at Cyren leading all aspects of product line growth and market development. Prior to that he held multiple senior management positions including VP of Software Engineering and Head of ITO at biotech firm Genuity Science and several senior product management roles at Adobe Systems. Halli also founded and led the Doc2PDF Ltd document management service through its acquisition in 2013. He earned a Master of Science in Electrical Engineering degree at Lund University and holds an MBA from the University of Edinburgh.