AV-Comparatives released its September malware protection results for 20 consumer security products on 15 October. The headline for buyers is not who blocked the most, because 15 products landed in the same top protection cluster. It is that the awards turned on false alarms, which is where Bitdefender separated from Norton, Avast and TotalAV.
What the test measured
According to the full report, the Malware Protection Test runs on Windows with cloud access allowed and executes malicious files to see whether a product prevents or reverses the changes. The lab's announcement says it used around 10,000 malware samples and that six products earned its top Advanced+ award: Bitdefender, ESET, G Data, Kaspersky, Total Defense and VIPRE.
The report also carries a warning that matters for shoppers. The lab says it does not recommend buying a product purely on the basis of one test, and suggests weighing price, ease of use, compatibility and support, and trying a free trial in everyday use.
How the products you may be comparing did
Protection rates are out of 10,000 samples. The report lists them as follows for the products on our shortlist:
- Bitdefender Total Security: 99.98% (2 compromised), 1 false alarm, Advanced+.
- TotalAV Premium: 99.97% (3 compromised), 15 false alarms, Advanced.
- Norton Antivirus Plus: 99.96% (4 compromised), 15 false alarms, Advanced.
- Avast One Free Antivirus: 99.96% (4 compromised), 15 false alarms, Advanced.
Avira was not among the 20 products in this test, so there is no result to quote for it here. The report does note that TotalAV, F-Secure and Fortect use the Avira engine.
All four sit in the lab's top protection cluster. The gap between the best and the weakest of them is two samples in 10,000. For a household, that is hard to read as a meaningful difference in everyday safety, and the lab itself groups them together.
Why the awards still differ
The lab's ranking system combines the protection cluster with the number of false positives on a set of clean files. In the report's ranking table, 11 to 20 false alarms count as "many", and a product in the top cluster with that many drops from Advanced+ to Advanced. The separate false alarm appendix says the lab tolerates up to 10 false alarms before penalising scores.
That is why Bitdefender, with one false alarm, and Kaspersky, with five, reached Advanced+, while Norton, Avast and TotalAV, each with 15, did not. A false alarm means a clean file was flagged. The lab argues such errors can cause as much trouble as a real infection, and that a product prone to them may find it easier to post high detection rates.
Same engine, same numbers
The report states that AVG and Norton use the Avast engine. The numbers bear that out: Avast, AVG and Norton all show 9,996 samples blocked, 4 compromised and 15 false alarms. That includes the free Avast product, which is the Avast edition that was tested. If you are weighing a paid Norton plan against a free Avast, this test shows no protection gap between those two engines. What the paid plan adds is outside what this test measured, so compare the extra features against the price yourself.
The lab also notes that a vendor's engine can behave differently in someone else's product, because of settings, extra engines, whitelists and the speed at which signatures reach it. So shared engine does not guarantee identical results in every test.
The offline caveat
The report separates detection with and without an internet connection. Offline, Bitdefender detected 97.2%, TotalAV 96.0% and Norton and Avast 95.4%. McAfee's offline figure was 81.3% and Microsoft Defender's 82.2%, rising to 98.3% and 95.5% online. The lab suggests vendors of cloud-heavy products should warn users when the connection to the cloud is lost. If you often work offline, or plug in USB drives from other people, that gap deserves a look.
Two other results worth knowing
Microsoft Defender Antivirus, the product Windows ships with, protected 99.89% of samples but produced 28 false alarms, which the lab rates as "very many", and received a Standard award. McAfee Total Protection protected 99.97% with 36 false alarms and also received Standard. Both show the same pattern: strong protection numbers pulled down by false positives.
What to do before you buy or renew
- Read the report's false alarm column, not just the protection rate. Two products with near identical protection can earn different awards.
- Do not treat one test as a verdict. The lab runs several test types, and its own advice is to look at more than one.
- Check which engine sits underneath a brand. If two products share one, the cheaper or free one may be enough.
- Look at the renewal price, not only the first-year offer, and use a trial to see how the product behaves on your own files.
- Note which edition was tested. Some vendors asked the lab to enter their free product instead of a paid suite, so a result for one edition does not automatically describe another.
The full report and appendix are free to read on the lab's site, without registration.
