Explain like I'm five · Security

What is Antivirus?

Antivirus and endpoint protection (EPP), told as a story about a guard in every room checking boxes against a deck of bug cards.

my roompicture booktoyletter?boxes come every day — and some hide a bug

Boxes come every day. Some of them hide a bug.Each room is one computer. The boxes are downloaded files, attachments on letters, plugged-in sticks. A bug hides inside them.

a hundred boxes a daychews the papers, locks the chestsyou can't open every box — and one bug is enough

You can't open every box yourself. But one bug is enough.Nobody can open a hundred boxes a day by hand. Yet a single bug that gets in chews the papers, locks the chests, and calls its friends.

BUG CARD No. 4six legs, red backthe chest-locking bugone card per bugevery incoming box is compared against the cardsif it matches a card, it's stopped at the door

Antivirus is a guard at every room holding a deck of bug cards.The guard compares every incoming box against the cards, one by one. If a bug matches a card, it's stopped at the door and put in a jar.

Compare to the cardsknown bugs are caught by their looks
New cards every daynew bug news means new cards
At the doorstopped before it gets in
Into the jara caught bug goes in a jar it can't leave
?a bug on no card just walks paststarts locking chests — that's a bug!today's guards watch what it does, not just its face

A bug on no card walks right past. So today's guards also watch what it does.This is where the picture cracks. A brand-new bug nobody knows has no card. But if something starts locking chests or secretly copying letters, the guard calls it a bug — card or no card.

card guard — stops it at the doorWOOF!guard dog — chases it once insidethe castle needs both

The card guard stops it at the door; the guard dog chases it once inside.The guard dog watches and writes down everything that happens inside the room. What the card guard misses, the dog catches. You need both.

In one breath

Antivirus = a guard at every room holding bug cards, comparing each incoming box and stopping known bugs at the door. Today's guards also watch what a bug does.

Antivirus / EPP (Endpoint Protection Platform) scans files against signatures (fingerprints of known malware), catches new variants with heuristic and behavior-based detection, and quarantines what it finds. Tracking and responding after something gets in is EDR's job.

When grown-ups say it

Signature
What a known bug looks like. One card per bug; a match means a catch. Cards are made from a fingerprint or a telltale piece of the bug.
Heuristic
Close enough to a card is suspicious. Six legs and a red back looks like a bug even without a card. How guards catch new variants.
Behavior-based detection
What it does, not what it looks like. Locking chests, secretly copying letters, sneaking out to the village at night — that's a bug.
EPP
The card guard's modern name. Cards, heuristics, behavior watching, even a small firewall — all carried by one guard.
Quarantine
A caught bug can't get out. Not destroyed, just jarred — so it can be let out if the guard was wrong.
Definition update
More cards every day. When the watchtower friend reports a new bug, new cards are drawn. Old cards make a blind guard.
EDR vs. antivirus
At the door vs. once inside. The card guard blocks; the guard dog watches and chases. These days they come as one set.
False positive
Caught a toy bug. Sometimes a harmless tool that looks like a bug gets jarred. That's why there must be a way to let it out.
Next story
A Walk Unlike the Usual →
Want another term as a picture book? Request →