ATP is a set of technologies that defend against sophisticated, evasive attacks designed to bypass traditional security — things like zero-day malware, targeted phishing, business email compromise, ransomware and fileless attacks. Rather than relying only on known signatures, ATP uses techniques like sandboxing (safely detonating suspicious files), behavioural analysis and live threat intelligence to catch threats that have never been seen before. It's most commonly applied at email, endpoint and network — the points where advanced attacks arrive.

Traditional antivirus matches files against a database of known threats — fast and effective against known malware, but blind to anything new. ATP is built for the unknown: it observes what a file or link actually does in a safe environment and looks for malicious behaviour, so it can stop a threat the first time it's ever seen. Most organisations run both — antivirus as a baseline, ATP for the advanced attacks that get past it.

They overlap and complement each other. ATP focuses on preventing advanced threats at the point of delivery — especially email — using sandboxing and behavioural detection. EDR focuses on detecting and responding to threats on endpoints, and XDR correlates detection and response across many domains. Some platforms bundle these together. The key is avoiding paying twice for the same capability, which is exactly what we help you check — and we have dedicated EDR and XDR comparisons too.

Sandboxing is opening a suspicious file or link in an isolated, disposable environment — separate from your real systems — to watch what it does. If it tries to encrypt files, contact a malicious server or exploit a vulnerability, the ATP sees that behaviour and blocks it, all before the file ever reaches a user's device. It's one of the most effective ways to catch zero-day and unknown malware that signature-based tools would miss.

By strengthening protection and generating detection and incident evidence, ATP supports CERT-In expectations around defending against and reporting incidents, and helps protect personal data in line with the DPDP Act and RBI expectations for regulated entities — with where email and files are scanned mattering for data residency. Pricing is typically per user per month for email ATP and per endpoint per month for endpoint and network ATP. Figures here are illustrative, and this is general guidance, not legal advice — confirm current requirements with the vendor and your advisors.