Signature-based antivirus is an older malware detection method that compares files, processes, or network artifacts against a database of known patterns, called signatures. A signature may be a byte sequence, filename, hash, or other characteristic that identifies a specific threat family or variant.
It matters because it is fast, simple, and effective against malware that has already been analyzed. In real defenses, signature matching still helps block common threats and supports quarantine decisions. Its weakness is that it depends on prior knowledge: new malware, heavily modified samples, and fileless techniques can evade it until defenders create and distribute a new signature. Modern attacks often exploit that gap, which is why antivirus is now only one layer in a broader defense-in-depth strategy that also uses behavior monitoring, reputation checks, and human investigation.