Cylance Protect. It uses Machine Learning Algorithms only and ever consumes a maximum of 4% CPU when evaluating bulk files. It works only upon the attempt to execute a file, not persistent disk scanning. Unlike "signature" based AVs, Cylance uses math to distinguish between known good or known bad based upon 16 Million features of any given file. Signatures are written specifically for specific exploits. Transform or mutate a hash table, and the signature is defeated. Simple as that.
Most every "attack" is based upon known exploits in OS, or applications. Simply because an application has a vulnerability doesn't mean you are vulnerable. You may not run that application or have the environment suitable for the exploit. So AV vendors spend inordinate amounts of time writing signatures that no one ever depends upon. And signatures are written by humans, who are themselves fallible. MLAs are math-based and inherently far more accurate and faster (after all, a computer is a math machine). So let the computer do what its best at, computing and the human what they're best at, using a computer.
