How does the endpoint agent manage resource efficiency across the agent, EDR, and NGAV?

Adding Next Generation Antivirus (NGAV) doesn’t change how EDR runs, and it continues to operate as effectively as it did before. 

If a large number of files are written at once, the scan catches up instead of holding things up or blocking, so performance should be fine. Full scans are heavily throttled, “low and slow,” so they take much longer but don’t noticeably impact the system. 

Scanning is not run at startup, when many other processes are already starting. Instead, there is an overnight scan, after which results are cached, so files don’t need to be rescanned unless something changes or the signatures are updated.