Guide
What antivirus software does, and what it leaves untouched
A scanner is a pattern-matching tool with a defined job. Knowing where that job stops is the difference between a sensible purchase and a wasted one.
Quick answer
Antivirus software inspects files, processes and network requests on a single device and blocks the ones that match known-bad patterns or behave in ways associated with malicious code. It is effective against automated, opportunistic threats and largely irrelevant to anything that depends on persuading a person to act — which, in Australia, is where most reported consumer losses now come from.
Three ways a scanner decides something is malicious
Every consumer product in this category combines the same basic techniques. Vendors give them different names, but underneath they are doing one or more of three things.
- Signature matching
- The file is hashed or fingerprinted and compared against a catalogue of code that has already been analysed. This is fast, precise and produces very few false alarms, and it only works for things somebody has already catalogued. It is the reason definition updates exist and the reason a product that has not updated in months is noticeably weaker than one that has.
- Heuristic and behavioural analysis
- Instead of asking what a program is, the software watches what it does. A process that enumerates document folders and starts rewriting every file, or that injects itself into another running program, or that quietly adds itself to the list of things that start with the system, gets flagged on the strength of the behaviour alone. This catches things no one has seen before, and it is also where false alarms come from — legitimate backup tools and installers do some of these things for honest reasons.
- Reputation and cloud lookups
- The product sends a fingerprint of a file, or the address of a website, to the vendor's service and asks what is known about it. A file downloaded by four people worldwide in the last hour is treated with more suspicion than one shipped on millions of machines for years. This is the part of the product that depends on the vendor's own infrastructure, which is why an offline device gets less out of a modern suite than a connected one.
What "real-time protection" actually refers to
Real-time protection means the product has hooked into the operating system so that files are checked at the moment they are opened, written or executed, rather than only when a scan is run. On a day-to-day basis this is the component doing the work; scheduled full scans are mostly a way of catching something that arrived before the current definitions existed.
This has two practical consequences. The first is that the overlap between two real-time products on the same machine is a genuine problem — they compete for the same hooks, and the result is usually instability rather than double the protection. Running one at a time is the standard advice. The second is that turning real-time protection off, which people do to install something the scanner objects to, removes most of the value of the product for as long as it stays off.
What else is usually in the box
Very few products in this category are sold as a bare scanner. What gets added varies by tier and changes between releases, so treat the table below as a description of the category rather than of any particular product. The vendor's current page is the only reliable source for what a specific edition includes today.
| Component | What it does | Worth noting |
|---|---|---|
| Firewall management | Controls which programs may make or accept network connections. | Windows and macOS both include a firewall already; the bundled version is usually a different interface to similar rules. |
| Web or browsing protection | Checks addresses against a list of known phishing and malware-hosting sites before the page loads. | Usually a browser extension. It can only act on addresses already on a list, so a site registered an hour ago may not be on it. |
| Password manager | Generates and stores distinct passwords per site. | Addresses password reuse, which is a much more common cause of account compromise than malware. |
| VPN client | Encrypts traffic between the device and the provider's server. | Changes who can observe the connection. It does not make a device harder to infect and does not make a person anonymous. |
| Cloud backup | Copies selected folders to the vendor's storage. | The single most useful thing in a ransomware situation, and the component most often left unconfigured. |
| Identity or dark web monitoring | Watches for a supplied email address or document number appearing in breach data. | Notification after the fact. Useful as an early warning, not as a preventative measure. |
| Parental controls | Filters content and limits screen time per profile. | The eSafety Commissioner publishes independent guidance on setting these up sensibly. |
The risks a scanner cannot reach
This is the part that vendor pages, by their nature, cover least. None of the following is a criticism of any product; they are simply outside the boundary of what software on one device can do.
Outside the boundary
- Being persuaded. If somebody is convinced over the phone, by message or by email to transfer money, approve a payment or read out a code, no scanner is involved at any point. Scamwatch describes the approaches currently in circulation and what to do afterwards.
- Breaches at someone else's company. When a service you use loses its customer database, the exposure happened on their systems. What limits the damage is a distinct password per service and multi-factor authentication, not a product on your laptop.
- Unpatched software. An operating system, browser or router firmware that has stopped being updated stays vulnerable regardless of what else is installed. The Australian Cyber Security Centre puts updates near the top of its guidance for exactly this reason.
- Physical access and shoulder-surfing. An unlocked, unencrypted device handed to somebody else is a different category of problem, addressed by device passcodes and disk encryption.
- Account takeover using a valid password. Someone signing in with the correct credentials is not doing anything a scanner can object to.
Where the built-in tools already sit
Windows, macOS, Android and iOS all ship with security components maintained by the platform vendor and updated with the system. On Windows that includes an antivirus engine that is on by default and turns itself off when another real-time product is installed. On mobile platforms the model is different again: applications are sandboxed and distributed through a reviewed store, and a third-party "antivirus" app on a phone generally cannot inspect other applications the way a desktop product inspects files.
This matters when you are reading a five-device licence and working out what those five devices would actually get. A licence that covers two laptops, two phones and a tablet may deliver most of its value on the two laptops. That is not a reason to avoid it, but it is a reason to count devices carefully rather than counting seats.
How to tell whether the product is doing its job
There is no visible signal from good security software, which is precisely what makes it hard to evaluate. A few checks are worth running once a quarter, and none of them require any special knowledge.
- Open the product and look at the update date. Definitions should be hours old, not weeks. If updating fails silently, the subscription may have lapsed without anything obvious happening.
- Confirm real-time protection is switched on. If it was disabled temporarily at some point, it may never have been switched back.
- Check that only one real-time product is installed. Two is a common cause of slowdowns that get blamed on the hardware.
- Look at what the extra components are doing. Backup that has never run, or a password manager holding three entries, means you are paying for capacity you are not using — either use it or drop to a cheaper tier at renewal.
- Check the operating system's own update status while you are there. It costs nothing and covers the larger risk.
A note on numbers
Detection-rate percentages and comparative test scores circulate widely in this category. We do not reproduce them, because a figure separated from the test methodology, the sample set and the date it was measured cannot be checked by a reader and is not a claim we are able to stand behind. If you want that kind of data, go to the testing organisation that produced it and read its methodology alongside the result.
Reading the vendor's own description critically
Product pages are written to sell, which is legitimate, and they use a handful of phrases that reward a second look. "Advanced" and "next-generation" describe no specific mechanism. "Complete" protection is a description of a product range, not of a threat model. Anything stated as a guarantee is worth reading against the actual terms, since the terms are the enforceable document. Where a page makes a claim about what the product prevents, the useful question is: prevents on which device, against what, and measured how?
Under Australian Consumer Law, statements made to sell a product to consumers in Australia are held to a standard of not being misleading, and that standard applies to the vendor and to anybody publishing on their behalf. That is worth knowing as a reader, because it means claims are not merely marketing — they are representations the seller can be held to. Our page on consumer rights covers how that works in practice.