Step 1 of 6 · Threat Guard path

What antivirus software actually does

Strip away the shields, vaults and force fields used in the marketing and the category is doing three fairly mechanical jobs. Knowing which three makes every feature list you read later legible.

The three ways a threat gets detected

A security product watches files and processes and tries to decide, quickly, whether each one is safe. It has three broad methods, and every mainstream product uses some mixture of them.

Signature matching: The oldest method. The vendor keeps a catalogue of known malicious files, identified by cryptographic fingerprints or distinctive byte patterns, and the software compares what is on your machine against that catalogue. It is fast and produces very few false alarms. Its limitation is obvious: something has to have been seen and catalogued before. This is why the definition updates matter, and why a product that cannot reach its update servers gets steadily less useful.
Heuristic and behavioural analysis: Instead of asking "have I seen this exact file", the software asks "is this program behaving like malware". A document that launches a scripting engine, a freshly downloaded executable that begins encrypting files in your documents folder, a process that tries to modify system start-up entries — each is a behaviour worth interrupting regardless of whether the file is in any catalogue. This is what catches threats too new to have a signature. It is also the source of most false alarms, which is why legitimate but unusual software sometimes gets quarantined.
Reputation and cloud lookup: The product sends a fingerprint of an unfamiliar file, or the address of a site you are about to open, to the vendor's servers and asks what is known about it across their whole user base. A file seen on eleven machines worldwide in the last hour is treated differently from one seen on eleven million machines for three years. This is effective and it is also the part with a privacy cost, because it means the product is reporting on what you run and where you browse. Vendors describe this in their privacy policies with varying clarity, and it is worth reading that section before you subscribe.

Real-time protection and manual scans are not the same thing

Two modes of operation sit behind almost every product, and people often confuse them.

Real-time protection, sometimes called on-access or resident scanning, hooks into the operating system so that files are checked at the moment they are opened, written or executed. It runs constantly and it is what actually prevents an infection, because it acts before the malicious code does. It is also the part with a performance cost, since every file operation gets inspected.

A manual or scheduled scan walks through storage and inspects what is already there. It finds things that arrived before the product was installed, or that arrived while real-time protection was disabled, or that were dormant. A full scan of a large drive can take a long time and is not something most households need to run often. What a scan does not do is protect you between scans.

The vocabulary, briefly

Malware is the umbrella term for software written to cause harm. Ransomware encrypts your files and demands payment for the key. A trojan is malware disguised as something you wanted to install. Spyware quietly collects information about what you do. Phishing is not software at all — it is a message that persuades you to hand over a credential or a payment. Fuller definitions are in the glossary.

What the rest of a modern suite is for

Very few vendors now sell plain antivirus. What is sold is a bundle, and the bundle usually contains some of the following. Each is a real thing, but each is also available separately, sometimes at no cost, which matters when you reach the comparison step.

A firewall controls which programs may talk to the network and which incoming connections are permitted. Windows and macOS both include one; a third-party firewall is mostly about finer-grained control and clearer prompts.
A browser extension or web filter blocks known malicious and fraudulent sites before the page loads. Browsers already do some of this themselves. The overlap is substantial and the benefit is real but smaller than the marketing implies.
A VPN encrypts your connection to a server run by the provider. It hides your browsing from whoever runs the network you are on, and it hides your home address from the sites you visit. It does not make you anonymous, it does not stop malware, and it does not stop you being tracked by accounts you are signed in to.
A password manager generates and stores distinct passwords for each account. Of everything in a typical bundle, this is the component most likely to change your actual risk, because reused passwords are the mechanism by which one company's breach becomes a problem with your other accounts.
Breach or identity monitoring tells you when an address of yours appears in a published data breach. Useful as a prompt to change a password; it cannot undo the disclosure.
Tune-up and cleaner tools delete temporary files and browser history. These have the weakest claim to be security features, and the strongest tendency to be presented with alarming red counters.

What to watch out for while researching

Anything on a web page that appears to have scanned your computer is a fabrication. A web page cannot read your file system, cannot enumerate your installed software, and cannot detect an infection. If you land on a page showing a progress bar, a list of "threats found", or a dialogue box styled to look like part of Windows or macOS, that is a well-known advertising trick, sometimes called scareware. Close the tab; do not ring any number it displays.

The same applies to messages claiming your subscription has expired and your device is now unprotected. Check the status in the product itself, or on your account page at the vendor's own address typed by hand, and never through a link in the message.

The problems antivirus software cannot solve

This is the part left out of most product pages, and it is the reason steps five and six of this path exist.

It cannot help when you were persuaded, rather than infected. If a convincing message leads you to type your banking credentials into a page that looks right, no scanner was involved at any point; nothing malicious was downloaded. Detection of fraudulent sites helps sometimes, but the defence that works is recognising the pattern and verifying by another channel.

It cannot undo a breach at a company you deal with. When an organisation you have an account with loses its customer database, your details are disclosed regardless of what is installed at your end. What protects you there is that the password used on that site was unique, and that the account had a second factor.

It cannot substitute for updates. A large share of successful attacks use a flaw that had a fix available. Operating system and browser updates close those doors; security software mostly watches the door.

It cannot recover files you have no copy of. Against ransomware, a current, tested backup that is not permanently connected to the machine is the difference between an afternoon's annoyance and a permanent loss.

It cannot protect an account you have handed over. Once someone has a valid password and can pass any second factor, they are not attacking your computer at all.

Where the comparative test results come from

We publish no detection rates or scores of our own — Threat Guard runs no laboratory and conducts no tests. Independent testing organisations do run comparative evaluations and publish them, and their methodology pages are worth more of your attention than their league tables, because the way a test is scored determines who wins it. Read the source directly rather than a vendor's summary of it, and check the date: results are only about the versions tested at the time.

A reasonable expectation to set

A competent security product, kept updated and left running in real-time mode, substantially reduces the chance that a piece of commodity malware gets a foothold on a device from a download, an email attachment or an infected file from someone else. That is genuinely worth something, particularly on a shared family computer where you are not the only person deciding what to click.

It does not make a device invulnerable, and any wording that says or implies it does — total protection, complete security, guaranteed — is marketing language rather than a technical claim. The Australian Cyber Security Centre publishes practical guidance for individuals and families that is free, vendor-neutral and worth reading alongside anything you buy, at cyber.gov.au.

With that in place, the next question is not which product to buy. It is what is already running on your devices — because for a number of readers, the answer changes the decision entirely.