Which Antivirus Offers Best Real-World Protection?

Some lab tests analyze how well antivirus and security suite products recognize and eliminate static malware samples. Others evaluate behavioral detection techniques, and still others measure each product's ability to detect malware-hosting URLs. But to the user, just what component blocked an attack doesn't matter, as long as the malware got whacked. The Whole Product Dynamic Protection test just released by AV-Comparatives lets every component of each security product have a chance to shine, and gives credit for successfully preventing attacks no matter how that success was accomplished.

The test is grueling, requiring researchers to challenge 20 or more antivirus products with brand new malicious URLs every day for months, making sure to keep them up to date. Over the course of the test, they hit each product with nearly 2,000 real-world samples. A product gets full credit if it either prevents the malware attack completely or removes all significant traces. If the malware compromises system security, naturally the product gets no credit.

What about cases where the product displays a notification asking the user what to do? In those cases, the researchers always choose Allow, OK, or the equivalent wrong choice. A product that prevents infestation despite the user's error gets full credit. One that allows system compromise if the user makes a mistake gets half credit.

Mostly Successful
Almost all of the 20 products tested scored 90 percent or better. Panda Free Antivirus managed an amazing 99.9 percent, and Bitdefender Internet Security £24.99 at Bitdefender UK came close with 99.8. Kaspersky Internet Security , Trend Micro Internet Security, Avast Pro Antivirus, and Tencent PC Manager managed 99.7 percent.

At the other end of the spectrum, Ad-Aware barely squeaked by with 90 percent protection, while Vipre and Microsoft came in even lower.

Little Change
The set of contenders has changed just slightly since the last round of testing. AhnLab, Qihoo 360, and KingSoft are out; Quick Heal is in. All of these products are more popular in Asia than in the U.S., so for most PCMag readers this change probably doesn't make much difference, nor does the fact that Tencent zoomed from merely Standard in the previous test to Advanced+ in the current test.

Emsisoft Anti-Malware £31.16 at Emsisoft UK and Trend Micro would have managed Advanced+, but false positives dragged both down to Advanced. Avast Free rose from Advanced to Advanced+. All 16 of the other products scored exactly the same as in the previous round of testing. Given that most of those rated Advanced+ or Advanced, staying the same isn't necessarily a bad thing.

An Award-Winning Test
Running a comprehensive test like this is a lot of work, but the results are worthwhile. In fact, the test methodology has received a number of awards, among them the Constantinus Award from the Austrian government and the Cluster Award from the Tyrolean government. The testers at AV-Comparatives definitely deserve kudos. I pay serious attention to their results when conducting my own evaluations of antivirus and security suite products.

About Our Expert

Neil J. Rubenking

Principal Writer, Security

My Experience

When the IBM PC was new, I served as the president of the San Francisco PC User Group for three years. That’s how I met PCMag’s editorial team, who brought me on board in 1986. In the years since that fateful meeting, I’ve become PCMag’s expert on security, privacy, and identity protection, putting antivirus tools, security suites, and all kinds of security software through their paces.

Before my current security gig, I supplied PCMag readers with tips and solutions on using popular applications, operating systems, and programming languages in my "User to User" and "Ask Neil" columns, which began in 1990 and ran for almost 20 years. Along the way, I wrote more than 40 utility articles, as well as Delphi Programming for Dummies and six other books covering DOS, Windows, and programming. I also reviewed thousands of products of all kinds, ranging from early Sierra Online adventure games to AOL’s precursor Q-Link.

In the early 2000s, I turned my focus to security and the growing antivirus industry. After years of working with antivirus, I’m known throughout the security industry as an expert on evaluating antivirus tools. I serve as an advisory board member for the Anti-Malware Testing Standards Organization (AMTSO), an international nonprofit group dedicated to coordinating and improving testing of anti-malware solutions.

The Technology I Use

Much of the testing I do, particularly testing with real-world ransomware, is just plain dangerous. To perform such tests safely, I sequester them inside virtual machines managed by VMWare Workstation. For cross-platform testing, I use a MacBook Air, a Google Pixel 4, and a 6th-generation iPad.

I rely on my Delphi coding skills to create and maintain small applications. These include programs to check whether an antivirus correctly handled the malware it detected, launch dangerous URLs and record the security program’s reaction, and analyze the malware that I collect for use in testing. I also wrote a tiny browser and text editor for use in testing security apps that have predefined reactions for known products.

I do my writing and research on a Dell OptiPlex desktop, relying on Microsoft Word (my fingers know all the shortcuts). Many of my articles include charts and analysis; Excel is my go-to for those. When work hours end, though, I escape the bounds of Microsoft and Windows. There’s an iPhone in my pocket, I relax with my oversized iPad, and my Kindle Oasis is always loaded with the best science fiction and fantasy.

Read the latest from Neil J. Rubenking

Read full bio