Antivirus Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen (Cybersecurity & Privacy) | Last updated: August 10, 2026 | License: CC BY 4.0
Twenty consumer antivirus products faced 400 live malware URLs between February and May 2026. Nineteen of them blocked at least 96%. The separation between them no longer sits in detection at all — it sits in false alarms, where the same panel ranged from zero wrongly blocked files to 83, and where the product that made zero mistakes ships free with Windows.
Quick Answer
Antivirus detection has converged. Across the AV-Comparatives Real-World Protection Test for February–May 2026, the twenty tested consumer products averaged a 98.14% protection rate against 400 live test cases, with only 7.8 percentage points separating the best from the worst. False alarms did not converge: the same panel ranged from 0 to 83 wrongly blocked domains and files. Axis Intelligence Research scores each product on the Axis Protection-Integrity Composite (APIC™), which weights protection at 70% and false-alarm burden at 30%. Kaspersky leads the consumer panel at APIC 96.8; Microsoft Defender — free, pre-installed, and the only product in the field with zero false alarms — ranks third at 93.0.
Key Findings
- Axis Intelligence Research finds that the twenty consumer antivirus products tested by AV-Comparatives between February and May 2026 averaged a 98.14% protection rate across 400 live test cases, with a spread of just 7.8 percentage points between the highest and lowest scores.
- Axis Intelligence Research finds that Microsoft Defender was the only product among twenty consumer contenders to record zero false alarms in the February–May 2026 Real-World Protection Test, and the only product among sixteen business contenders to do so alongside Cisco in the March–June 2026 Business Security Test.
- Axis Intelligence Research finds that 8 of the 20 branded consumer antivirus products tested in early 2026 run on a detection engine licensed from another vendor, giving the consumer panel an Axis Endpoint Engine Independence Index (AEII™) reading of 65.0 out of 100 as of August 10, 2026.
- Axis Intelligence Research finds that 81% of UK businesses reported up-to-date malware protection in the 2025/2026 Cyber Security Breaches Survey — up from 77% a year earlier — while 43% still identified a breach or attack in the same twelve months.
- Axis Intelligence Research estimates that Gen Digital, the largest listed consumer antivirus company, generated $42.27 in Cyber Safety Platform revenue per paid customer in fiscal 2026, derived from $3,339 million in segment revenue across 79 million paid customers reported to the SEC.
How Accurate Is Antivirus Software in 2026?
Accurate enough that accuracy has stopped being the interesting question.
The most current controlled evidence comes from the AV-Comparatives Real-World Protection Test covering February to May 2026, which ran 400 live malicious URLs against twenty consumer security products on fully patched Windows 11. Kaspersky compromised on one case out of 400. Bitdefender compromised on two. Avast, AVG and Norton compromised on three each. At the bottom of the same panel, Quick Heal compromised on 32.
Axis Intelligence Research computed the panel statistics directly from the published results table: mean protection rate 98.14%, median 98.50%, range 92.0% to 99.8%.
Consumer Protection Rates, February–May 2026
| Product | Blocked (of 400) | Compromised | Protection rate | False alarms | Source |
|---|---|---|---|---|---|
| Kaspersky | 399 | 1 | 99.8% | 3 | AV-Comparatives, Feb–May 2026 |
| Bitdefender | 398 | 2 | 99.5% | 5 | AV-Comparatives, Feb–May 2026 |
| Avast / AVG / Norton | 397 | 3 | 99.3% | 5 | AV-Comparatives, Feb–May 2026 |
| Microsoft / TotalAV | 396 | 4 | 99.0% | 0 / 5 | AV-Comparatives, Feb–May 2026 |
| F-Secure / Malwarebytes | 395 | 5 | 98.8% | 11 / 39 | AV-Comparatives, Feb–May 2026 |
| ESET / K7 / McAfee | 394 | 6 | 98.5% | 2 / 11.5 / 4 | AV-Comparatives, Feb–May 2026 |
| Total Defense / Trend Micro | 393 | 7 | 98.3% | 1 / 83 | AV-Comparatives, Feb–May 2026 |
| Fortect / G Data / Sophos | 391 | 9 | 97.8% | 6 / 14 / 4 | AV-Comparatives, Feb–May 2026 |
| Panda | 386 | 14 | 96.5% | 27 | AV-Comparatives, Feb–May 2026 |
| VIPRE | 384 | 16 | 96.0% | 3 | AV-Comparatives, Feb–May 2026 |
| Quick Heal | 368 | 32 | 92.0% | 6 | AV-Comparatives, Feb–May 2026 |
Fourteen of the twenty products cleared 98.0%. Seven cleared 99.0%. Read the compromise column instead of the percentage column and the picture sharpens: the difference between the best and the median product in this test is four infections out of four hundred attempts.
The Second Lab Says Something Slightly Different
AV-TEST ran its own consumer Windows evaluation across May and June 2026, scoring sixteen home products out of six points each for protection, performance and usability. Eight of the sixteen — Avast, AVG, Bitdefender, ESET, F-Secure, Kaspersky, McAfee and Norton — took a perfect 18 out of 18. Twelve of sixteen earned the institute’s “Top Product” designation at 17.5 points or better. The panel mean was 17.50.
Axis Intelligence Research notes the divergence rather than averaging it away. AV-TEST’s scale saturates: half its June 2026 panel hit the ceiling, which means the test can certify competence but cannot rank the top tier. AV-Comparatives’ 400-case URL set, by contrast, still produced a 7.8-point spread and a bottom cluster. Two credible labs, two different resolutions. Buyers reading a “perfect score” headline are reading the resolution limit of the instrument, not the limit of the product.
Marcus Chen, Cybersecurity & Privacy: The reason both labs look crowded at the top is that the signature-and-heuristic layer stopped being where the fight happens. URL blocking, reputation scoring and behaviour monitoring all fire before a file ever executes, and every serious vendor now ships all three. What that convergence doesn’t tell you is anything about the attacks that never present a file to scan — the stolen session cookie, the help-desk call, the valid credential logged in from a residential proxy. A 99.8% protection rate against 400 malicious URLs is a real number about a real test. It is not a statement about your exposure.
Which Antivirus Products Score Best on the Axis Protection-Integrity Composite?
A protection rate on its own rewards products that block aggressively, including products that block things they shouldn’t. AV-Comparatives handles this by downgrading award tiers for above-average false alarms, which is correct but coarse: it sorts twenty products into four buckets. Axis Intelligence Research publishes a continuous score instead.
APIC™ — Axis Protection-Integrity Composite
What it is: a 0–100 score expressing how well a product blocks threats without blocking clean domains and files. Higher is better.
Formula (fully disclosed, absolute rather than panel-relative, so readings compare across test periods):
P = (protection_rate − 90) ÷ 10 × 100 capped to the 0–100 range
F = (1 − min(false_alarms, 50) ÷ 50) × 100
APIC = (0.70 × P) + (0.30 × F)
Inputs: protection rate and false-alarm count as published by AV-Comparatives for the test period stated. Nothing else.
Weights and why: protection carries 70% because a missed infection is unrecoverable and a false alarm is not. False alarms carry 30% because they are the reason users disable protection, and a disabled product protects at 0%. The floor of 90% protection and the ceiling of 50 false alarms match AV-Comparatives’ own award thresholds, so the scale is anchored to published industry practice rather than to an arbitrary curve.
APIC Consumer Panel, February–May 2026
| Rank | Product | APIC™ | Protection sub-score | False-alarm sub-score | Source of inputs |
|---|---|---|---|---|---|
| 1 | Kaspersky | 96.8 | 98.0 | 94.0 | AV-Comparatives, Feb–May 2026 |
| 2 | Bitdefender | 93.5 | 95.0 | 90.0 | AV-Comparatives, Feb–May 2026 |
| 3 | Microsoft Defender | 93.0 | 90.0 | 100.0 | AV-Comparatives, Feb–May 2026 |
| 4= | Norton | 92.1 | 93.0 | 90.0 | AV-Comparatives, Feb–May 2026 |
| 4= | Avast | 92.1 | 93.0 | 90.0 | AV-Comparatives, Feb–May 2026 |
| 4= | AVG | 92.1 | 93.0 | 90.0 | AV-Comparatives, Feb–May 2026 |
| 7 | TotalAV | 90.0 | 90.0 | 90.0 | AV-Comparatives, Feb–May 2026 |
| 8 | ESET | 88.3 | 85.0 | 96.0 | AV-Comparatives, Feb–May 2026 |
| 9 | Total Defense | 87.5 | 83.0 | 98.0 | AV-Comparatives, Feb–May 2026 |
| 10 | McAfee | 87.1 | 85.0 | 92.0 | AV-Comparatives, Feb–May 2026 |
| 11 | F-Secure | 85.0 | 88.0 | 78.0 | AV-Comparatives, Feb–May 2026 |
| 12 | K7 | 82.6 | 85.0 | 77.0 | AV-Comparatives, Feb–May 2026 |
| 13 | Sophos | 82.2 | 78.0 | 92.0 | AV-Comparatives, Feb–May 2026 |
| 14 | Fortect | 81.0 | 78.0 | 88.0 | AV-Comparatives, Feb–May 2026 |
| 15 | G Data | 76.2 | 78.0 | 72.0 | AV-Comparatives, Feb–May 2026 |
| 16 | VIPRE | 70.2 | 60.0 | 94.0 | AV-Comparatives, Feb–May 2026 |
| 17 | Malwarebytes | 68.2 | 88.0 | 22.0 | AV-Comparatives, Feb–May 2026 |
| 18 | Panda | 59.3 | 65.0 | 46.0 | AV-Comparatives, Feb–May 2026 |
| 19 | Trend Micro | 58.1 | 83.0 | 0.0 | AV-Comparatives, Feb–May 2026 |
| 20 | Quick Heal | 40.4 | 20.0 | 88.0 | AV-Comparatives, Feb–May 2026 |
Panel mean APIC 80.8; median 86.0.
Two results deserve to be read slowly. Malwarebytes posted a strong 98.8% protection rate — joint eighth on raw detection — and lands seventeenth once its 39 false alarms are priced in. Trend Micro blocked 98.3% and scored zero on the false-alarm component, because its 83 wrongly blocked domains and files sit above the 50-count ceiling AV-Comparatives itself uses to exclude a product from the panel average.
And Microsoft Defender, which costs nothing and is already installed, out-ranks fifteen paid products on a composite that gives detection more than twice the weight of accuracy.
APIC Business Panel, March–June 2026
The AV-Comparatives Business Security Test for March to June 2026 ran the same 400-case structure against sixteen endpoint products.
| Rank | Product | APIC™ | Protection rate | False alarms |
|---|---|---|---|---|
| 1 | Kaspersky | 96.8 | 99.8% | 3 |
| 2 | Bitdefender | 96.2 | 99.8% | 4 |
| 3 | Microsoft Defender with MEM | 91.6 | 98.8% | 0 |
| 4 | Elastic | 91.4 | 99.8% | 12 |
| 5= | Norton | 90.6 | 99.0% | 4 |
| 5= | Avast | 90.6 | 99.0% | 4 |
| 7= | VIPRE | 90.4 | 98.8% | 2 |
| 7= | ESET | 90.4 | 98.8% | 2 |
| 9 | Sophos | 86.9 | 98.3% | 2 |
| 10 | K7 | 85.9 | 98.5% | 6 |
| 11 | CrowdStrike | 84.7 | 98.5% | 8 |
| 12 | Cisco | 81.1 | 97.3% | 0 |
| 13 | Trellix | 76.5 | 97.5% | 10 |
| 14 | G Data | 75.2 | 96.8% | 4 |
| 15 | SenseOn | 61.8 | 94.8% | 3 |
| 16 | ManageEngine | 50.9 | 95.3% | 27 |
Source for all inputs: AV-Comparatives Business Security Test H1 2026 (March–June), released July 15, 2026.
Panel mean APIC 83.8; median 88.7; mean protection rate 98.17%.
A merge Axis Intelligence Research declines to make. AV-Comparatives states plainly that its Business and Consumer Main-Test Series cannot be compared — different periods, different sample sets, different vendor-configured settings. So APIC is published as two separate panel readings and never averaged into one cross-segment number, however tempting the “consumer antivirus is noisier than enterprise antivirus” headline would be. The two false-alarm distributions are measured against different clean-file corpora. Reporting a ratio between them would produce a figure that means nothing, and the first analyst to check would find that out.
Marcus Chen: Fifteen of sixteen business products cleared certification; Sophos did not, on an impact score above the 40-point performance threshold rather than on protection. That is the shape of this market now. Products fail on operational cost — CPU drag, alert noise, admin time — far more often than they fail on catching malware. When a SOC lead tells you the tool “didn’t work,” ask which of those they mean. Nine times out of ten it’s the second kind, and no protection-rate table on earth predicts it.
How Many Antivirus Brands Actually Have Their Own Detection Engine?
Fewer than the shelf suggests.
AV-Comparatives discloses third-party engine licensing in both of its 2026 reports, and the disclosures are the most under-reported facts in the category. In the consumer panel, G Data, Total Defense and VIPRE run the Bitdefender engine; F-Secure, Fortect and TotalAV run the Avira engine; AVG and Norton run the Avast engine. In the business panel, Cisco, G Data, SenseOn and VIPRE run the Bitdefender engine, and Norton runs the Avast engine. Trellix’s tested ENS build uses the former McAfee engine now owned by Trellix.
AEII™ — Axis Endpoint Engine Independence Index
What it is: the share of branded products in a tested panel that rest on distinct detection-engine families, expressed 0–100. A reading of 100 would mean every brand ships its own engine; lower readings mean the visible brand count overstates the real diversity of detection logic available to buyers.
Formula:
AEII = (distinct detection-engine families ÷ branded products tested) × 100
A family is counted once and includes every product that licenses it, per the vendor-engine disclosures published in the AV-Comparatives report for that panel.
AEII Readings, as of August 10, 2026
| Panel | Branded products | Distinct engine families | Products on a licensed third-party engine | AEII™ |
|---|---|---|---|---|
| Consumer (AV-Comparatives, Feb–May 2026) | 20 | 13 | 8 (40.0%) | 65.0 |
| Business (AV-Comparatives, Mar–Jun 2026) | 16 | 11 | 5 (31.3%) | 68.8 |
Engine attributions sourced from AV-Comparatives’ published third-party engine disclosures in each report. Axis calculation.
Two of every five consumer antivirus brands on that test bench are a licensing arrangement wearing a logo. This is not a scandal — engine licensing is normal, disclosed, and often paired with the licensee’s own behavioural layers, which is why G Data scored 97.8% in the consumer panel and 96.8% in the business panel despite sharing an engine with Bitdefender’s 99.5% and 99.8%. But it does change what a comparison shopping table means. Choosing “three different antivirus products” from the wrong three brands can buy one detection engine three times.
Marcus Chen: For a home user this is trivia. For anyone running layered defence it is an architecture problem. If your endpoint agent and your mail gateway both resolve to the same engine family, your second layer inherits the first layer’s blind spots — same signature set, same classifier, same misses. Correlated failure is the whole thing you were buying a second layer to avoid. Ask the vendor which engine is underneath. It’s in the lab reports if they won’t say.
How Many Organisations Actually Run Antivirus?
Most, and the number is climbing — which is exactly why antivirus adoption alone no longer predicts breach outcomes.
The UK government’s Cyber Security Breaches Survey 2025/2026, fielded to 2,112 businesses and 1,085 charities between August and December 2025 by Ipsos for DSIT and the Home Office, is the most methodologically solid public read on deployment anywhere. It found 81% of businesses running up-to-date malware protection, against 77% the year before. Among large businesses the figure reaches 93%. Charities sit at 63%.
Technical Control Adoption, UK Businesses and Charities
| Control | Businesses | Charities | Source |
|---|---|---|---|
| Up-to-date malware protection | 81% | 63% | DSIT / Home Office, CSBS 2025/2026 |
| Secure cloud backup | 74% | 57% | DSIT / Home Office, CSBS 2025/2026 |
| Password policy | 74% | 56% | DSIT / Home Office, CSBS 2025/2026 |
| Network firewalls | 74% | 45% | DSIT / Home Office, CSBS 2025/2026 |
| Restricted admin rights | 73% | 65% | DSIT / Home Office, CSBS 2025/2026 |
| Any two-factor authentication | 47% | 38% | DSIT / Home Office, CSBS 2025/2026 |
| Software updates applied within 14 days | 34% | 20% | DSIT / Home Office, CSBS 2025/2026 |
Malware protection is the single most-deployed control in the country. Patching within a fortnight — the control that closes the vulnerabilities attackers actually queue up for — sits at 34%. That gap of 47 percentage points is the real finding in this table, and it is the reason the same survey reports 43% of businesses identifying a breach or attack in twelve months, equivalent to roughly 612,000 organisations.
Axis Intelligence Research estimates that approximately 270,000 UK businesses operate without up-to-date malware protection, derived as follows: the survey’s 612,000 breached businesses represent 43% of the in-scope population, implying a population of about 1.42 million; 19% of that population — the share without the control — is about 270,000. Sole traders and organisations with no IT capacity are outside the survey’s scope, so the true unprotected count is higher.
What Antivirus Is Not Being Asked to Stop
The threat mix explains the deployment paradox. In the same UK survey, phishing was the most prevalent attack type at 38% of businesses, and ransomware fell to 1%, down from 3% in each of the two prior years. On the US side, the FBI’s 2025 Internet Crime Report logged 1,008,597 complaints and losses of roughly $20.9 billion, up 26% year over year, with investment fraud accounting for close to half of scam-related losses and cryptocurrency-linked complaints alone reaching $11 billion across 181,565 filings. The full IC3 annual report records an average loss of $20,699 per complaint and a first-ever AI section covering 22,364 complaints and $893 million.
An endpoint agent does not stop a victim from wiring money to an investment platform that does not exist. That is the honest boundary of the product category in 2026, and pretending otherwise is how vendors lose the trust of the buyers they most need.
What Is the Antivirus Industry Actually Worth Per User?
The clearest public answer sits in an SEC filing rather than a market-research abstract.
Gen Digital — the parent of Norton, Avast, AVG and LifeLock — reported fiscal 2026 results to the SEC for the year ended April 3, 2026: total revenue of $5,000 million, Cyber Safety Platform revenue of $3,339 million, Trust-Based Solutions revenue of $1,661 million, and 79 million total paid customers against 68 million a year earlier. The company describes its reach as nearly 500 million users across more than 150 countries.
Axis Cross-Source Calculation: Consumer Security Revenue Per Customer
| Metric | Value | Formula | Source of inputs |
|---|---|---|---|
| Cyber Safety revenue per paid customer, FY2026 | $42.27 | $3,339M ÷ 79M | Gen Digital 8-K exhibit, May 7, 2026 |
| Total revenue per paid customer, FY2026 | $63.29 | $5,000M ÷ 79M | Gen Digital 8-K exhibit, May 7, 2026 |
| Paid conversion of stated user base | 15.8% | 79M ÷ 500M | Gen Digital 8-K exhibit, May 7, 2026 |
| Cyber Safety share of total revenue | 66.8% | $3,339M ÷ $5,000M | Gen Digital 8-K exhibit, May 7, 2026 |
| Cyber Safety revenue growth, FY2025→FY2026 | 5.1% | ($3,339M − $3,176M) ÷ $3,176M | Gen Digital 8-K exhibit, May 7, 2026 |
| Trust-Based Solutions revenue growth, FY2025→FY2026 | 118.8% | ($1,661M − $759M) ÷ $759M | Gen Digital 8-K exhibit, May 7, 2026 |
These are Axis calculations from company-reported figures, not company-reported metrics. The denominator is total paid customers across all product lines, including the identity and financial-wellness businesses acquired during the year, so $42.27 is a conservative floor for security-only revenue per security customer rather than a precise per-seat price.
The direction of travel is the story. Core Cyber Safety grew 5.1%. Everything else — identity monitoring, reputation, financial wellness — grew 118.8%, largely through acquisition, and now supplies a third of revenue. The largest company in consumer antivirus is being repriced as something other than an antivirus company, by its own P&L.
Marcus Chen: Follow that revenue mix and you can predict the product roadmap without reading a press release. When the security engine converges to parity across the field — 98% and change for everybody — it stops being the thing you can charge a premium for. So the premium migrates to what can still be differentiated: dark-web monitoring, restoration services, insurance, scam detection. The subscription still says antivirus on the tin. Increasingly, only a third of what you’re paying for is the scanner.
How Much New Malware Is Antivirus Handling?
The AV-TEST Institute registers over 450,000 new malicious programs and potentially unwanted applications every day, classifying and archiving each one. That intake rate is the operational context for every protection rate on this page: a signature-and-classifier system re-baselining itself against roughly a third of a million new artefacts per day, and still holding 98% on live URLs in an independent lab.
It is also why the daily-sample number is the wrong headline. Sample counts measure attacker output, not defender failure. The 400-case protection tests measure defender failure. Axis Intelligence Research reports both and treats only the second as evidence about product performance.
Methodology
Collection. Every figure on this page was retrieved from a primary source document during production on August 10, 2026. Lab results were taken from the published AV-Comparatives Real-World Protection Test (February–May 2026, released June 15, 2026, revised June 5, 2026), the AV-Comparatives Business Security Test H1 2026 (March–June, released July 15, 2026, revised July 13, 2026), and the AV-TEST consumer Windows 11 results for June 2026. Deployment data came from the UK Cyber Security Breaches Survey 2025/2026, published April 30, 2026 by DSIT and the Home Office, fieldwork August–December 2025, n = 2,112 businesses and 1,085 charities, random-probability telephone and online. Financial data came from Gen Digital’s Form 8-K earnings exhibit filed with the SEC on May 7, 2026. Loss data came from the FBI’s 2025 Internet Crime Report and its accompanying press release of April 6, 2026.
Verification. All arithmetic was recomputed in Python before drafting. As a control on data entry, the twenty consumer false-alarm counts were re-averaged under AV-Comparatives’ own stated convention of excluding products above 50 false alarms; the result, 8.24, reproduces the average of 8 printed in the source report. Every URL cited was confirmed live and confirmed to contain the claim attributed to it.
APIC™ formula. P = (protection_rate − 90) ÷ 10 × 100, capped 0–100. F = (1 − min(false_alarms, 50) ÷ 50) × 100. APIC = 0.70P + 0.30F. Inputs are the protection rate and false-alarm count published for the stated test period. The scale is absolute, not panel-relative, so readings from different periods are directly comparable. Weights are fixed for the calendar year and any change will be published with a re-baselined history rather than applied silently.
AEII™ formula. AEII = (distinct detection-engine families ÷ branded products tested) × 100, using the third-party engine attributions disclosed in the source report for that panel. Products combining a licensed engine with proprietary behavioural layers are attributed to the licensed engine family, matching the lab’s own disclosure convention.
Scope. Lab protection rates describe performance against a defined sample set at a point in time and do not forecast performance against future threats. AV-Comparatives states that its consumer and business series are not comparable to each other; APIC readings are therefore published per panel and never merged. The Gen Digital per-customer figures use a total paid-customer denominator spanning multiple product lines. The UK survey excludes sole traders, public-sector organisations other than education, and businesses with no IT capacity, and covers only breaches organisations identified and were willing to report. FBI IC3 figures are self-reported victim losses.
About This Dataset
Contents. 289 rows covering consumer and business antivirus protection rates, false-alarm counts, Axis Protection-Integrity Composite scores, Axis Endpoint Engine Independence Index readings, AV-TEST certification scores, UK technical-control adoption rates, US cybercrime loss figures, and Gen Digital consumer-security financials.
Temporal coverage. February 2026 – August 2026.
Spatial coverage. Global, with United Kingdom and United States national breakdowns.
Format. UTF-8 CSV, one observation per row, full provenance columns.
License. CC BY 4.0.
Citation: Axis Intelligence Research, Antivirus Statistics 2026, 2026.
Cite This Research
APA Axis Intelligence Research. (2026). Antivirus statistics 2026. Axis Intelligence. https://axis-intelligence.com/antivirus-statistics/
MLA Axis Intelligence Research. “Antivirus Statistics 2026.” Axis Intelligence, 10 Aug. 2026, axis-intelligence.com/antivirus-statistics/.
Chicago Axis Intelligence Research. “Antivirus Statistics 2026.” Axis Intelligence. Last modified August 10, 2026. https://axis-intelligence.com/antivirus-statistics/.
Frequently Asked Questions
Does a 99% protection rate mean 1 in 100 threats gets through my machine?
No. The rate describes performance against a curated set of live malicious URLs under lab conditions — 400 of them in the February–May 2026 test — not against the traffic mix reaching a specific endpoint. Your personal miss rate depends on what you actually encounter, how patched your third-party software is, and whether the attack presents a file to scan at all. Treat the figure as a comparative ranking signal between products, not as a personal risk forecast.
Why do false alarms matter more than a fraction of a percentage point of detection?
Because a false alarm is the failure mode users can see. When a product blocks a legitimate download or a working business domain, the user’s next move is often to add a broad exclusion or turn a shield off, and a disabled shield protects at zero. In the February–May 2026 consumer panel, twelve of twenty products kept false alarms at five or below while one recorded 83. That 83-count product still detected 98.3% — its usability failure, not its detection, is what should decide the purchase.
Is Microsoft Defender genuinely competitive with paid antivirus in 2026?
On the lab evidence, yes. Defender blocked 396 of 400 consumer test cases (99.0%) with zero false alarms, the only clean sheet in the field, and posted 98.8% with zero false alarms in the business panel. It scored 17.5/18 and “Top Product” status in AV-TEST’s June 2026 evaluation. On the Axis Protection-Integrity Composite it ranks third of twenty consumer products. What paid suites add is the surrounding layer — VPN, password management, identity monitoring, dark-web alerts, support — not a materially better scanner.
Which antivirus brands share a detection engine?
Per AV-Comparatives’ own disclosures for the 2026 test series: G Data, Total Defense and VIPRE use the Bitdefender engine in the consumer panel, joined by Cisco and SenseOn in the business panel; F-Secure, Fortect and TotalAV use the Avira engine; AVG and Norton use the Avast engine. Eight of twenty consumer products and five of sixteen business products run a licensed third-party engine, producing Axis Endpoint Engine Independence Index readings of 65.0 and 68.8 respectively.
If antivirus deployment is at 81%, why did 43% of UK businesses still get breached?
Because the dominant attack type does not target the endpoint agent. Phishing hit 38% of UK businesses in the 2025/2026 survey while ransomware fell to 1%. Attacks that arrive as a convincing email, a spoofed login page or a manipulated payment instruction pass a malware scanner untouched. The survey’s own control table shows where the gap sits: 81% deploy malware protection, 47% deploy any two-factor authentication, and 34% apply security updates within fourteen days.
Does the AV-Comparatives protection rate include cases where the user was asked to decide?
Yes, at half credit. The published protection rate is calculated as blocked percentage plus half of the user-dependent percentage — a case where the product prompts and the worst user decision results in compromise counts as half-protected. In the February–May 2026 consumer panel no product recorded user-dependent cases, so protection rate and block rate are identical there; in the business panel Sophos recorded two.
Should a small business buy consumer antivirus or a business endpoint product?
The lab result that matters here is not the protection rate — both panels averaged near 98% — but manageability. AV-Comparatives frames the threshold as the point where a business grows past a handful of machines and needs a central view of which endpoints are actually protected and which have fallen off the network. Consumer licences give you no console, no fleet-wide protection status, and no remote isolation. Below roughly five machines the difference is administrative; above it, the missing console is the exposure.
Why does Axis Intelligence Research refuse to compare consumer and business false-alarm counts?
Because the two test series use different clean-file corpora, different periods and vendor-configured settings, and AV-Comparatives states explicitly that results from the two series cannot be compared. Dividing one panel’s mean by the other’s would generate a clean, quotable, meaningless ratio. APIC is therefore published as two independent panel readings, and the restraint is documented rather than buried.
How often do these numbers change?
AV-Comparatives publishes consumer factsheets every few months, with the two overall four-month reports landing in June and November, and business reports in July and December. AV-TEST publishes consumer Windows panels bi-monthly. That cadence means any antivirus statistic more than about six months old is describing a superseded product build, and any comparison table without a stated test period is not evidence.