Malware Protection Compliance
Learn how to shield endpoints from malicious scripts, block virus execution, and satisfy the fourth control of UK Cyber Essentials.
Download 2026 EDR & Antivirus Endpoint Pre-Audit Checklist PDF
Comprehensive audit verification checklist covering Endpoint Detection & Response (EDR), active antivirus signature updates, application sandboxing, and code signing policies under NCSC standards v3.3.
What is Malware Protection?
Malware is any software designed to disrupt, damage, or gain unauthorized access to your systems. This includes viruses, ransomware, spyware, and trojan horses. Malware typically enters a network when users click malicious email links, mount unsafe media, or visit compromised web pages.
Ensuring active malware defence means establishing layers of automated inspection that prevent malicious code from executing, or quarantine it instantly if detected.
The Three Defence Options
To comply, you must use at least one of the three recognised defence mechanisms: (1) Active antivirus software, (2) Application sandboxing (restricting scripts), or (3) App store code signing (restricting downloads).
How to Prevent Malware Infections
Deploy Active Anti-Malware Software
Install reputedly active antivirus scanning programmes (like Microsoft Defender or similar endpoint agents) on all company devices. Ensure real-time scanning is turned on, files are scanned on access, and signature databases are configured to update daily.
Enforce Application Code-Signing/Allowlisting
Restrict application installation to recognised, trusted app stores (like Microsoft Store or Mac App Store) or use code-signed installer verification. This blocks users from executing untrusted, unsigned `.exe` or script files downloaded from the web.
Restrict Browser Extensions and Scripting
Block the installation of unapproved browser add-ons and restrict the execution of scripting environments (such as Windows Script Host or PowerShell) for standard users to prevent web-delivered payloads.
Frequently Asked Questions: Malware & Ransomware Defence
🛡️ Does built-in Microsoft Defender satisfy Cyber Essentials Control #4? +
Yes. Native Microsoft Defender meets NCSC Cyber Essentials requirements provided that real-time protection is permanently switched on, daily automated signature updates are active, and users cannot disable the protection without administrator intervention. Pair this with our User Access Control & MFA guidance to stop attackers elevating privileges.
💻 Are Apple MacBooks and mobile devices subject to malware audits? +
Yes. macOS, iOS, and Android devices that connect to company email, cloud files, or servers are in-scope. On macOS, Gatekeeper and XProtect must be enabled, or software installation must be restricted to the Mac App Store and code-signed developers. For network isolation rules, see our Boundary Firewalls Guide.
⚠️ How does malware protection stop ransomware? +
Ransomware typically enters via email attachments or unpatched browser exploits. Cyber Essentials Control #4 blocks unsigned payload execution, while 14-Day Patch Management removes the zero-day vulnerabilities attackers exploit. Read real-world UK cases on our Cyber Security News & Breach Insights page.
Cyber Essentials Malware Protection: The 3 NCSC Approved Defence Options
To pass Cyber Essentials Control #4, every in-scope endpoint connecting to organisational data must be defended by at least one of three NCSC-approved defence mechanisms. For hybrid workforces, businesses commonly combine native antivirus with managed application allowlisting.
Option A: Anti-Malware Software
Must be configured to scan files on access (real-time protection), scan web traffic as it is accessed, update signature databases daily, and isolate/quarantine threats automatically without requiring end-user action.
Option B: Application Sandboxing
Mobile operating systems (iOS and iPadOS) comply natively via application sandboxing, restricting apps from accessing sensitive operating system kernels or cross-application files without explicit user consent.
Option C: Application Allowlisting
Enforcing AppLocker, Windows Defender Application Control (WDAC), or macOS Gatekeeper ensures standard users can only run approved, code-signed executables from verified software vendors or official app stores.
| Operating System | Compliant Default Tooling | Mandatory Audit Setting | Assessor Testing in Plus |
|---|---|---|---|
| Windows 11 / 10 Pro | Microsoft Defender Antivirus / Defender for Endpoint | Real-time ON + Daily Cloud Signatures | EICAR test payload blocked |
| macOS (Apple Silicon / Intel) | XProtect + Gatekeeper or third-party EDR | Allow apps downloaded from App Store & identified devs | Unsigned package execution blocked |
| iOS / Android Mobile | Native OS App Sandboxing & App Store enforcement | Sideloading disabled / Google Play Protect ON | Sample device verification |
Executable Verification & Malware Analysis: What is safewatch.exe?
If you have discovered an executable file named safewatch.exe running in your Windows Task Manager, startup entries, or %AppData% folder, this technical advisory provides security verification instructions under NCSC Cyber Essentials Control #4 (Malware Protection & Application Allowlisting).
⚠️ Official SafeWatch UK Entity Verification
SafeWatch UK (https://www.safe-watch.co.uk) is an accredited UK Cyber Essentials Certification Body and enterprise cybersecurity advisory firm licensed by IASME and the UK National Cyber Security Centre (NCSC). SafeWatch UK does NOT manufacture, publish, or distribute consumer downloadable software executable binaries like safewatch.exe. Our audit services are delivered via web-based portal assessments and credentialed Lead Assessor reviews.
How System Administrators Should Verify Unknown Executables (safewatch.exe)
Step 1: Check File Path & Origin
Legitimate enterprise software typically resides in C:\Program Files\. If safewatch.exe is located in user-writable directories like C:\Users\<Username>\AppData\Roaming\ or C:\Windows\Temp\, treat it as suspicious.
Step 2: Inspect Digital Signatures
Right-click the file → Properties → Digital Signatures. Check if the binary is code-signed with a valid, trusted certificate. Unsigned binaries or certificates issued to unknown third parties should be quarantined.
Step 3: Calculate SHA-256 Hash
Open PowerShell and run: Get-FileHash safewatch.exe -Algorithm SHA256
Submit the resulting cryptographic hash to VirusTotal to inspect detection across 70+ antivirus engines.
Step 4: Enforce NCSC Allowlisting
Cyber Essentials Control #4 recommends Application Allowlisting (via Microsoft AppLocker or Windows Defender Application Control - WDAC) to prevent standard non-admin users from executing unapproved binaries anywhere on the endpoint.