Unlike traditional antivirus, which only has one opportunity to detect and stop a given threat, Webroot protection works in multiple stages. First, it attempts to prevent malware from infiltrating the system. If malware does get through, Webroot protection works to stop it before it can execute. Should it execute (this might happen in cases of brand-new, never-before-seen malware), Webroot protection will journal the file’s activities and undo its changes to local drives, once it’s determined to be malware.

The small but powerful software agent only needs 30 seconds to install and will not conflict with existing security software. That means trials, brand new deployments, and even replacing legacy software are fast and easy, so you never have to worry about impacting user productivity to roll out security.

A key advantage of a cloud-driven, real-time approach is that the heavy processing associated with machine learning and malware discovery is performed in the cloud, not on the client device. That means full scheduled scans, agent updates, user impact, and resource usage (CPU and RAM) are extremely low. With the exception of block notifications when users attempt to navigate to a malicious or suspicious site, most users will hardly notice Webroot Business Endpoint Protection running.

Webroot uses propriety technology to monitor, journal, and contain potential infections, even when a given endpoint is offline. This reduces the number of false detections to nearly negligible levels. Instead of a Volume Shadow Copy, which can be compromised by attackers, Webroot uses a patented approach to preserving data and system changes. That means a compromised endpoint’s local drives may be automatically restored to its uninfected state, without reimaging.