How We Test Antiviruses

Many antivirus companies brand their products as “the best product available with 100% malware protection” — but that isn’t always the case.
No one antivirus can offer total protection against all existing viruses and malware. But some antiviruses do a much better job than others at protecting against cyberthreats.
Here’s how we test antivirus products:

1. Purchase & Download — 5%

Our reviewers first pay for an antivirus subscription — usually the most comprehensive package available. We assess the pricing and range of payment options, and we try to find out if there are any hidden costs involved with purchasing each antivirus subscription.

We then download the antivirus installation file to assess the size of each download and whether or not it takes up a lot of storage space on our test devices.

Our reviewers give a score out of 10 based on their experience with purchasing and downloading each product. This score makes up 5% of the final score.

2. Installation & Setup — 10%

We then run the installation process on a variety of systems, including Windows, Mac, Android, and iOS, to see how easy or difficult the antivirus is to set up.

We also assess the amount of time it takes to install the product and whether or not any technical knowledge is required to successfully complete the installation.

Once installed, our reviewers complete any final setup process and ensure that the application has been fully installed.

We score our experiences with installation and setup out of 10. This score makes up 10% of the final score.

3. Malware Protection — 30%

We take an in-depth look at the antivirus technology behind each product to ensure it’s secure, accurate, up-to-date, and effective against the latest malware threats.

We use a variety of methods to test the effectiveness of each antivirus:

3a. Malware Scanner Detection — 15%

Our reviewers run a range of system scans to see how many malware files each product’s anti-malware scanning engine is able to detect.

We use hundreds of malware samples in each malware scanning test. But during this particular test, we’re simply assessing each antivirus program’s ability to detect malware files stored on a system, so we don’t open or execute any malware files.

Each antivirus scanner is tested against a wide range of both old and new malware samples, including viruses, ransomware, spyware, trojans, keyloggers, rootkits, and more.

Here are some examples of malware we include in each test:
Ransomware — encrypts/locks up a user’s device and forces the user to pay a ransom to unlock the device.
Backdoors/trojans — exploits system vulnerabilities to secretly access a user’s device and steal data.
Spyware/Remote access trojan (RAT) — remotely controls a user’s device, accesses sensitive files, and installs harmful malware.
Keystroke loggers — tracks a user’s keystrokes, allowing hackers to steal login usernames, passwords, banking details, and more.
Webcam & mic hijackers — gives hackers unauthorized access to a user’s webcam or computer microphone to secretly record a user’s activity.

Once the malware scanner detection tests are complete, we see how many malware samples the antivirus scanning engine caught. While we like to see scores of 100%, we consider a 95% malware detection rate to be sufficient enough for us to consider the antivirus as “very secure”.

We convert the overall malware detection percentage to a score out of 10. This score makes up 15% of the final score.

3b. Real-Time Protection Tests — 15%

Our real-time protection tests include a series of simulated attacks to see how well each antivirus real-time protection engine blocks each simulated attack.

Some of the malware attacks we simulate during our tests include:
Executed malware files — we run a script that “executes” or “launches” each malware sample one-by-one, and we judge the real-time engine’s capability to block and remove each malware threat as it attempts to infiltrate our test system.
Ransomware simulations — we launch various ransomware simulations that mimic legitimate ransomware attacks to see if the real-time protection blocks and disables the ransomware.
Zero-day viruses — we simulate attacks using unknown malware files that haven’t been added to a known malware database. We measure how fast each antivirus detects these unknown threats and how each antivirus responds to each attack.

After completing all of the real-time protection tests and simulations, we see how many threats were blocked by each antivirus’s real-time protection engine. While scores of 100% are obviously excellent, we consider a score above 90% to be good enough for most users.

We convert the overall real-time protection percentage to a score out of 10. This score makes up 15% of the final score.

4. Web Protection — 10%

Our reviewers look at what web protections each antivirus offers, and we run a series of tests to ensure these web protections work as intended.

Many antiviruses come with web protection features like network firewalls, anti-phishing protection, privacy leak detection, tracking link blocking, etc.

We test each web protection’s effectiveness against things like:
Network attacks — attempts to infiltrate a user’s private network to gain access to network-connected devices.
Phishing sites — fake websites that trick users into inputting their personal information, like passwords and bank card details.
Malware sites — dangerous websites known to contain malware or malicious scripts.
Email phishing scams — scam emails disguised as legitimate emails that contain phishing links.
Ad & tracking links — annoying popup ads and tracking links that follow your activity across the web.

We calculate the number of network attacks, phishing links, malware sites, ads, and tracking links blocked by each antivirus’s web protections.

While we give an overall score for web protection in our reviews, we make sure to clearly point out specific web protection features that perform really well and ones that perform poorly.

After we’ve completed our web protection tests, we give an overall score out of 10. This score makes up 10% of the final score.

5. Extra Features — 15%

Most antiviruses come with more than just malware protections. We take a look at all of the extra features and functions offered by each antivirus.

We test each additional feature to assess its functionality, purpose, and usefulness for most users. Many of these extra features increase the overall cost of the product, so we assess whether or not these features are actually worth this added cost.

Typically, antivirus packages usually offer additional features like a device/performance optimizer, junk file removal, a virtual private network (VPN), a password manager, etc.

In line with our testing standards, we assess each additional feature for the following:
Performance — how well the feature does the thing it’s supposed to do.
Usefulness — whether users will actually benefit from using the feature or if it’s just an unnecessary add-on.
Impact on system performance — how much CPU, RAM, and system energy the feature uses.
Value — how much the feature is worth.
Standalone comparison — how the feature scores when compared to top-rated standalone apps that have the same purpose (like a VPN/password manager).

We give each feature individual scores based on our findings. We then calculate an average score out of 10. This score makes up 15% of the final score.

6. Impact on System Performance — 10%

Antiviruses need to be effective while not slowing down a user’s system. We measure each antivirus’s impact on CPU, RAM, battery usage, and overall system performance.

To make our research useful and relatable to most users, we look at how each antivirus uses system resources on a variety of old and new systems, including Windows, Mac, and mobile devices to ensure a fair performance average is established.

We assess each antivirus’s performance while idle (not running an active scan), during each scan, and during simulated malware attacks. When testing performance, we look at:

CPU usage — how much computer processing power each antivirus uses.
RAM usage — how much system memory each antivirus requires to run efficiently.
Battery usage — how much battery power each antivirus uses (during full scans and while idle) and whether or not the antivirus maintains an overall energy efficiency.

If an antivirus uses around 20% CPU power, less than 500 MB RAM during a full system scan, and has good energy efficiency (as measured with the task management system), we consider it to be a great choice. Anything above 50% CPU usage, over 2 GB RAM, and/or with poor energy efficiency is generally a bad choice.

After we’ve completed our performance tests, we give an overall score out of 10. This score makes up 10% of the final score.

7. Pricing — 10%

We assess the packages or subscriptions offered by each antivirus company and determine whether or not they’re low-cost, overpriced, or a good value.

Our reviewers determine the value of each product by looking at the quantity and quality of the features offered in each package. We then compare the price of each package to similar products available to see how well each package aligns with the market average.

This method helps us to clearly define which antiviruses offer a good deal and which antiviruses aren’t worth the money.

Based on our assessments, we give an overall score out of 10. This score makes up 10% of each product’s final score.

8. Customer Support & Refunds — 10%

We look at each antivirus company’s support options and test each option by sending numerous questions via email, live chat, phone support, website FAQs, forums, and more.

Our reviewers then qualify how well each company’s support team performed by looking at response times, the quality of each response, and whether or not the response was useful in addressing and solving the issue(s).

We give good scores to support teams that have a wide range of contact options, respond quickly with useful solutions, and ensure users are satisfied with the product.

Finally, we see if each company offers a refund policy or money-back guarantee. We assess the entire refund process by requesting a refund within the correct time frame, judging how easy or difficult it is to get our refund request processed, and how long it takes for the money to arrive back in our account.

We give a score out of 10 based on our overall customer experience. This score makes up 10% of the final score.

Final Scores for Antiviruses

After carrying out extensive testing, our reviewers calculate a final score for each antivirus based on the score of each test category.

Each test category has a varying influence on the final score, so we divide each test score by the following percentages:

Purchase & Download: 5%

Extra Features & Utilities: 15%

Installation and Setup: 10%

Impact on System Performance: 10%

Malware Protection: 30%

Pricing: 10%

Web Protection: 10%

Customer Support & Refunds: 10%

We then add up the figures to reach a final score for each antivirus, which is shown at the top of each review. Products with an overall score above 8/10 are generally considered to be a great choice for most users. Products scoring around 7/10 are generally pretty good, though there are likely better options elsewhere. Scores around 6/10 and below indicate that our reviewers ran into many issues, and the product probably isn’t the best for most users in its current form.