As any other product, NGAV can have different quality and set of features. The latter is more about a personal choice, but there are several things that should be present in a properly-made next generation antivirus solution.
The ability of local scanning. This function’s usefulness is often undervalued, but in fact it can be a great way to scan the network after the initial breach, giving no chances for crooks to hide their activities. Local scanning supposes the ability to scan the environment without the Internet connection - for example, when it was forcibly disconnected after the indication of compromise. It is also a good marker of a solution that brings all modules required to provide an efficient scanning.
Threat intelligence capabilities. The data about each attack is extremely valuable - it gives full information about the attackers’ approaches, tools they use and targets they go for. NGAV solutions that can perform an automated threat intelligence can give the analysts team a ready report regarding some of the attack details, easing the overall procedure.