On-access scanners are endpoint security components that inspect a file at the moment it is written, opened, or executed. They sit in the path between an application and the file system, so they can block suspicious content before a user or process runs it. This is different from scheduled or manual scans, which only check files later.
They matter because many attacks depend on landing a payload on disk and then launching it immediately. Malware authors often try to bypass or confuse these scanners by using malformed file headers, compression, encryption, or masquerading as a legitimate program. Defenders respond by combining on-access scanning with reputation checks, sandboxing, hash-based lookups, and multiple parsers that can examine damaged files more reliably. In practice, a file that looks broken or unreadable to one engine may still reveal malicious structure to another, so on-access protection is most effective when it is part of a layered detection stack.