Antivirus & Anti-Malware

Category overview · ProPrivacyTime

Modern platforms ship competent built-in protection. The third-party question is no longer 'which antivirus' but 'which posture' - and the independent labs exist so you never have to take marketing's word.

We cover this category the same way we cover every other: by reading what vendors actually publish - privacy policies, independent lab reports, product documentation, and the fine print buried in renewal terms - rather than by running our own benchmarks. We do not run speed tests or infection simulations, and we do not make first-person "we tested / we found" claims. The point of a category page is not to hand you a winner but to show you the evidence and the method, so the decision stays yours and survives the next marketing cycle.

How we evaluate antivirus

Our criteria are document-based, because published documents are the evidence that survives contact with a real purchase. We weigh the following:

• Independent lab results. We read publicly published reports from the established testing labs - the AV-TEST and AV-Comparatives style organizations - and treat their combined coverage as the primary signal. We look at protection, performance impact, and false-positive rates together, and we prefer consistency across consecutive test cycles over a single strong quarter. A product that tops one cycle and disappears from the next is a different animal than one that places steadily near the top.
• What the built-in OS protection already covers. Before crediting a third-party product with a capability, we check whether the platform ships it for free. A feature that merely duplicates Microsoft Defender on Windows or the built-in protections on macOS is not an added benefit and should not be priced as one.
• Bundling and feature creep. Suites increasingly wrap a scanner around a VPN, a password manager, identity monitoring, and cloud backup. Each bundled component is a separate product and deserves separate scrutiny; a weak VPN behind a strong scanner is not a feature, and a free standalone alternative can outperform a bolted-on one.
• Vendor privacy. We read the privacy policy. Telemetry scope, account requirements, and what is uploaded to the vendor's cloud are as relevant to a "security" product as they are to any other. A tool that promises protection while quietly broadening data collection deserves the same skepticism we apply everywhere else.
• Renewal terms. First-year discounts are near-universal across the category; the question that matters is the second-year price and how hard cancellation is. We read the terms so you do not have to learn them from a surprise charge or a phone-only cancellation line.

Common misconceptions

• "The free built-in option is unsafe." The platform protections place near the top of independent tests year after year; for a careful, updated user they are a defensible default, not a risk to be scared out of.
• "More scan engines means safer." Layering engines mostly layers resource use and false positives; the labs do not reward engine count, and a product that alarms on harmless files has traded your time for its score.
• "Antivirus stops all phishing." Scanners catch some malicious pages and attachments, but email authentication, browser defenses, and user judgment carry much of that load. No scanner makes a careless click safe.
• "Macs don't need any posture." macOS ships real, signature- and notarization-based protections, but "lower-risk" is not "no-risk." The posture question is the same on every platform: what do you do, and how deliberately do you do it?

Where to start

The decision is rarely "which product"; it is "which posture, given my platform and habits." Two places to begin: