How we test antivirus software at PCWorld

Antivirus software can be confusing. If security protections are already built into Windows, what makes a third-party alternative worth the switch, much less the money you might pay for it? And heck, what makes Microsoft trustworthy?

There are good reasons to use third party software—a friendlier interface and protection against more types of threats, for example. But no matter which security suite you’re interested in, it’s important to understand what you’re getting. That’s so even when wanting to stick with Windows Security.

For this reason, we test and review antivirus suites. We want readers to feel informed when choosing their security software. Performance, features, price—these and more are factors to consider. So we take the apps for a spin, study their performance reports, and lay it all out for you.

All antivirus software gets evaluated with these criteria in mind:

• The efficacy of the antivirus engine—that is, how well it detects malware and other threats, as well as how well it protects against them
• The performance impact of the software upon the PC
• App experience and usability
• Efficacy, usefulness, and number of included features
• Price and value of the antivirus plan
• Customer service availability
• Data security and privacy policy for any sensitive info stored (as related to identity and financial protections)

After you read one of our antivirus software reviews, you should understand what it’s like to use the software and be able to decide if it’s a good match for your needs. You should also know what distinguishes a particular subscription from others offered by the same vendor.

Every antivirus suite we review is chosen by the PCWorld staff with complete editorial independence, free from input from outside parties. Any app that makes it onto our list of the best antivirus software is chosen with careful consideration, and the reasons for its selection are clearly outlined, along with who will find it useful.

the best overall antivirus suite

Norton 360 Deluxe

Read our review

Price When Reviewed: $49.99 for the first year

Best Prices Today: $19.99 at PCWorld Software Store | $49.99 at Norton

How we evaluate antivirus protection

Antivirus software these days wears multiple hats, but its number one job is still stopping malware and other threats in their tracks. But how it achieves that job now is much different than decades ago, when antivirus software first became necessary—it’s had to evolve with the ever-changing landscape. For example, a good security suite prevents users from interacting with phishing websites or email, rather than waiting to clean up after exposure and infection.

In the olden days, reviewers had to sling viruses, trojans, worms, and other malware at antivirus engines to see how well it caught them. While this self-testing process is still possible, we at PCWorld feel that security experts who put security software through their paces are better equipped to handle this work. 

Accordingly, we look at the results of evaluations conducted by leading security research organizations like AV-Test and AV-Comparatives, to determine the efficacy of antivirus software. We examine the test scores for not just online protection and detection, but also offline detection. While most users are online continuously, some people may still have exposure to offline risks. We also consider how well a suite handles more sophisticated online threats.

PCWorld

When we then present this data to our readers, we contextualize in context of how those benchmark results stack up against rivals, but also what the expected user experience will be. For example, most antivirus engines have similarly high online protection scores, but some also post more false positives—a potentially stressful experience.

How we evaluate antivirus performance

Antivirus software can be measured on two fronts. The first is qualitative—the experience of using the app. If it’s slow, buggy, or even poorly laid out, it won’t be rated as favorably as an app that runs smoothly and feels intuitive.

The other is quantitative—how the app affects your PC’s system resources. Some antivirus suites barely affect your computer’s ability to run its other tasks efficiently. Others can cause a notable dip. 

Because slower hardware will more clearly highlight these kinds of performance changes, we test with a modest budget laptop to get a better idea of just how hard the hits land. Our current review unit, an Acer Aspire 3 15, sports an AMD Ryzen 5 7520U, 8GB RAM, and a 512GB SSD. We start with a fresh install of Windows 11 Home, then install and run our benchmarks before the security suite under review is installed.

The first test is done within PCMark 10. Its Extended benchmark simulates typical PC activities, including document editing, web browsing, video chatting, and light gaming. The second test is UL Procyon’s Office benchmark, which focuses on editing in Microsoft apps like Word, Excel, and PowerPoint. (This is something PCMark 10 doesn’t do—it uses free open-source apps for document and image editing.) Finally, as a punishing stress test, we run Handbrake to transcode a large video into a smaller file. On many PCs, this encoding workload utilizes 100 percent of the CPU. 

PCWorld

After this initial baseline is established, we then install the antivirus software being reviewed and then run a second round of benchmarks while online. Benchmarks are often run offline to avoid unexpected software updates influencing results, but this scenario better imitates real-world use—and these days, many software suites rely on online access for threat detection. Companies lean on their cloud servers to minimize impact on your computer’s performance. We only run our tests after verifying that no outstanding updates exist for Windows or other background apps, to minimize any effect on scores.

This second set of benchmarks establishes the app’s affect on performance while idle in the background, watching for any real-time threats. For a fuller picture on what happens when the software is busy scanning new or altered files, we run a third round of tests with a full scan happening continuously as the benchmarks run. 

Most antivirus software, when run in this manner, will affect system performance on a budget PC—dropping the test scores by as much 20 percent or more. It gives a worst-case outlook for when you’re constantly changing or adding new files to your PC.

However, this kind of full scan is not a good reflection of how modern security suites typically behave. Most engines today only run a complete full scan on first run. Afterward, any unchanged files are skipped—so if you’re like most people, your system performance will be closer to the results when the app is idling in the background. You can change the settings in some apps to always scan every bit and byte during a full scan, but it’s almost never the default.

Speaking of defaults—most full scans are also scheduled by the vendor for off-hours. So heavy screening usually happens when you’re asleep.

How we evaluate antivirus features

Whether the features included with an antivirus plan match what Windows offers or go beyond, they should work—and do so in a polished manner. More importantly, they should be useful.

To that end, we try each tool and utility within the app. Ex: For ransomware protection that blocks unauthorized access to select folders, we check if programs not on the allowed list are actually blocked. Likewise, we put VPNs, password managers, and parental controls through their full paces, testing them similar to when writing a separate review on each.

PCWorld

We also consider the features as a set—which informs our assessment of the software’s value.

For entry-level antivirus subscriptions, we look at how well their features match Windows Security (which wraps up antivirus and firewall with other security safeguards), as well as what extras are included. If they stick closely to Microsoft’s formula, we expect them to at least feel more polished and easier to use. And any additional features should tangibly improve threat protection, not be window dressing.

For mid-tier antivirus plans, we check for features expand defenses to include identity theft issues, like monitoring data leaks. You can’t guard against social engineering attacks on your accounts if you don’t know what information about you is floating around on the internet, for example. These subscriptions should also ideally provide methods to improve password security and privacy while on public internet connections.

For flagship plans, we weigh the usefulness of the additional premium features, like identity theft recovery insurance (e.g., $1 million to cover financial losses related identity theft) and privacy setting changes to your social media accounts. We also find out how the company secures any sensitive data you share to set up those identity and financial protections.

How we evaluate antivirus value

In a nutshell, an antivirus suite’s value depends on the strength of its protection, the balance and usefulness of its feature set, and its price.

For example, if a security suite is cheap but has a weak antivirus engine, it’s a poor value. (It doesn’t even fulfill its basic mission.) Meanwhile, a subscription for software with excellent malware detection that also costs much more than a rival with a minimally lower protection rating also has debatable value.

But if an antivirus plan packs in both major defenses and extra services like a VPN and password manager, plus other tools while keeping cost relatively low? It’ll likely end up on our Best Antivirus list as our top pick.

Our top pick for best antivirus

Norton 360 Deluxe