Endpoint protection coverage across city departments is uneven, definitions are stale on many PCs, and detections often sit untriaged. What should anti-malware operations prioritize?

Anti-malware operations succeed as a citywide preventative and detective program only when three conditions hold: agents actually cover the endpoints that matter (staff PCs, kiosks, and other in-scope devices), protection content or signatures stay current so new threats are recognized, and a timely response process triages and remediates detections rather than letting alerts age unread. Uneven departmental coverage, stale definitions, and untriaged alerts create the exact conditions for malware to persist across municipal networks that share identity and file services.

Uninstalling agents on kiosks and laptops to improve boot speed trades a minor performance gain for major infection risk on high-touch civic devices. Allowing each department to pick any consumer AV with no central visibility destroys consistent policy, telemetry, and incident response. Relying only on annual reimaging without continuous prevention and detection leaves long windows for compromise between wipe cycles and provides no real-time stop for commodity malware or ransomware precursors.

Exam caveat: operating preventative/detective malware controls includes deployment coverage, update currency, and response workflows—not merely buying a product. Central visibility matters in federated city IT. Reimaging is recovery hygiene, not a complete anti-malware strategy.

Operational check: measure agent coverage and content age by department weekly, define SLAs for malware alert acknowledgment, ensure kiosks are in scope, and tabletop a ransomware detection from first alert through isolation so response is practiced before a real outbreak.