Old antivirus worked like a most-wanted poster: it matched files against a list of known-bad signatures. The problem is obvious in hindsight — anything not yet on the list walked right through. Behavioral detection flipped the question from "have I seen this file before?" to "is this software acting like an attack?"
A 2026 grant frames that shift precisely. IBM's US12566846B2, "Turing machine agent for behavioral threat detection" (issued March 3, 2026; CPC G06F 21/554 — detecting malicious behavior), describes a detector built like a state machine: it reads a sequence of behaviors and transitions through states to recognize the pattern of an attack. Read it at US12566846B2.
The way this actually works is sequence-aware. A single action — opening a file, spawning a process — usually means nothing. Attacks reveal themselves in the order and combination of actions: a document spawns a script, which contacts an unfamiliar server, which begins encrypting files. The "Turing machine" framing in the IBM grant is a precise way of saying the detector tracks state across a sequence, the way a state machine consumes a string of symbols, so it can recognize the attack pattern as it develops rather than after the damage is done.
One analogy, then gone: signature detection is recognizing a criminal from a photo; behavioral detection is recognizing a robbery from the actions — someone casing the room, blocking the exit, reaching for the register — even if you've never seen that particular person before.
Why this is a business story: behavioral EDR is what let a wave of endpoint vendors displace legacy antivirus, and it's what underpins the move to managed detection and response (MDR), where the vendor watches the behavior stream for you. The recurring telemetry — every endpoint constantly reporting what it's doing — is both the technical engine and the subscription hook. A grant framing detection as state-machine analysis of that stream is a claim on the core mechanism of the category.
The grounded read: EDR watches behavior sequences, not just files. The useful question for a buyer is what behaviors the product can string together, and how fast it acts when the sequence looks like an attack. IBM's grant names the mechanism — stateful reading of an action sequence — and that's a sharper definition of "behavioral detection" than most product pages offer.