How We Test, Rate, and Review Antivirus Software

Antivirus software is necessary to keep your internet-connected device free from Trojans, viruses, malware, and potentially unwanted programs. To choose the best option for you, learn how we test, rate, and review it.
We receive compensation from the products and services mentioned in this story, but the opinions are the author's own. Compensation may impact where offers appear. We have not included all available products or offers. Learn more about how we make money and our editorial policies.

Over the last five years, the All About Cookies team has conducted hands-on testing on 30+ antivirus programs. Each product is tested by a dedicated reviewer across Windows, macOS, Android, and iOS, using subscriptions purchased with our own money.

To evaluate each product, we look at a combination of real-world testing, independent third-party test scores, feature depth, and overall value. We then weigh each factor and calculate an overall rating out of five stars.

We'll provide an in-depth look at how All About Cookies tests, rates, and scores antivirus software.

In this article
Test results (49%)
Editor's score (20%)
Core features (20%)
Bonus features (2%)
Value (3%)
Compatibility (3%)
Customer service (3%)
How we calculate our ratings

Test results (49%)

Independent third-party testing is one of the best ways to evaluate a security product. We take test results from AV-TEST, a reputable independent organization, as well as our own EICAR testing to see how well the software works.

Scan speed

What it is: This is how fast your software scans your device for viruses, Trojans, malware, and potentially unwanted programs. A quick scan should be complete in under three minutes, making it fast enough to run routinely without interrupting your work. 

On the other hand, if a quick scan takes longer than one hour, it's no longer "quick." A scan that takes an hour becomes one you skip, and skipped scans leave you exposed.  

How we test it: We run quick scans and full scans on a standardized test device during normal browsing activity, measuring completion time, system performance impact, and malware detection effectiveness.

How we rate it:

  • Best: A quick scan that takes less than three minutes
  • Worst: A quick scan that takes over an hour 

ZoneAlarm full scan timer

EICAR tests

What it is: European Institute for Computer Anti-Virus Research (EICAR) is an independent company that provides test files that mimic malware, viruses, Trojans, phishing, and potentially unwanted programs to test the effectiveness of your antivirus software.

Because EICAR files are industry-standardized rather than proprietary, they give us a vendor-neutral baseline that's directly comparable across products. By passing all three tests, an antivirus program demonstrates it can catch common cyberthreats before they reach you.

How we test it: After installing the antivirus program, we download the EICAR files from its site and visit the EICAR phishing webpage. 

How we rate it:

  • Best: The antivirus program passes the malware detection, drive-by malware, and phishing protection tests
  • Worst: The antivirus software lets everything through and fails all the EICAR tests.

AVG EICAR malware test blocked

AV-TEST results

What it is: AV-TEST is one of the most reputable independent testing organizations in the security industry. Strong performance here means the software holds up under rigorous, standardized scrutiny beyond our own controlled tests. 

It's worth noting that vendors pay to be evaluated by AV-TEST, but the organization maintains strict independence and does not adjust findings based on that relationship. We factor in scores across Windows, macOS, and Android to assess consistency across platforms, not just performance on a single OS.

How we rate it:

  • Best: An average score of 18/18 on the AV-TEST results for Windows, macOS, and Android
  • Worst: No AV-TEST results available

Malwarebytes AV-TEST protection score on Windows, August 2023

Editor's score (20%)

Some of the most important qualities of antivirus software don't fit neatly into our structured testing criteria. Our editor's score captures everything that falls outside our quantitative categories. This includes user interface quality, onboarding experience, overall trustworthiness, and how the product feels to use day-to-day.

How we test it: We examine a product as if we knew nothing about how it’s supposed to work. Our evaluation includes finding every advertised feature to see if it’s readily available or if you have to search for it.

How we rate it:

  • Best: A clean, modern dashboard with features written in plain language and accessible within one or two clicks
  • Worst: An outdated interface with technical jargon and hidden features

Screenshot of Bitdefender Antivirus Free dashboard showing your device is at risk messages.

Core features (20%)

Your antivirus software is only as good as its foundational protections. This section evaluates the features that form the backbone of any security product: how well it detects and blocks threats in real time, whether it gives you control over when and how scans run, and how far its coverage extends beyond basic malware detection. 

These are the capabilities that determine whether a product actually keeps you safe day to day.

Real-time protection

What it is: Unlike a manual scan that checks for threats already on your device, real-time protection intercepts malicious downloads and attacks as they happen. It's the difference between catching a threat before it lands and cleaning up after it already has. 

How we rate it:

  • Best: The antivirus has real-time protection on by default and it blocks fake virus downloads before they can be downloaded
  • Worst: The software has no real-time protection available

Surfshark real-time protection catching a threat

Manual and scheduled scans

What it is: Manual scans let you investigate your device on demand, which can be useful if you suspect something is wrong. Scheduled scans run automatically in the background, so your protection doesn't depend on you remembering to initiate one.

How we rate it:

  • Best: Offers both manual and scheduled scans and may include unscheduled scans initiated automatically as a precaution
  • Worst: Doesn’t allow you to scan your device at will

Avira allows you to set up scheduled smart and quick scans.

Extra antivirus features

What it is: Basic antivirus catches known malware, but modern threats go well beyond that. Ransomware, network intrusions, and phishing attacks require dedicated protections that signature-based scanning alone won't address. We evaluate whether the software meaningfully extends its coverage into these areas or leaves them unaddressed.

How we rate it:

  • Best: Includes ransomware protection, a firewall, network protection, webcam and/or microphone protection, and phishing protection.
  • Worst: No extra antivirus features included

Value (3%)

This evaluates how much value the product adds at its price point, especially in comparison to its competitors. We also look at free products to make sure they keep your data safe and do what they advertise.

How we test it: We compare each antivirus to competitors to see who’s offering the best value for the money. We've found that most premium antivirus programs have an average starting price of about $34.00/yr, so anything in that price range should be expected.

How we rate it:

  • Best: Less than $50.00/first yr as its starting price, a free product or extended money-back guarantee period, and unlimited device coverage 
  • Worst: More than $50.00/yr as its starting price, no free plan or money-back guarantee, and limited to one device

Compatibility (3%)

What it is: A security product that only covers one device or operating system leaves the rest of your digital life unprotected. We evaluate how broadly each antivirus is available across desktop and mobile platforms, so you can have antivirus protection across your devices.

How we rate it:

  • Best: Available on both desktop and mobile platforms
  • Worst: Limited to a single operating system

Norton mobile antivirus

Customer service (3%)

What it is: For most software, slow support is an inconvenience. For a security product, it can be a serious problem — if something goes wrong during an active threat, response time matters.

How we test it: We reach out to customer support via live chat, or email if live chat is unavailable. Then, we evaluate response times and the quality of the answers we receive.

How we rate it:

  • Best: A product with live chat or phone support that goes directly to a real person who can help us in plain language.
  • Worst: Only email or web-based submission forms that take hours or days to receive a response, if you get one at all.

Norton 360 customer support live chat

Bonus features (2%)

Bonus features go beyond core security to offer tools that many users would otherwise need to source and pay for separately. A built-in VPN, password manager, or parental controls can consolidate your security setup as long as they're genuinely functional and not just checkbox additions.

How we rate it:

  • Best: Includes tune-up services, a password manager, an ad blocker, identity monitoring, parental controls, and a VPN
  • Worst: Nothing beyond antivirus features

Bitdefender VPN's dashboard (connected to automatic server)

How we calculate our ratings

We’ve included the percentages of how each aspect is weighted when we evaluate the software. We keep a grading rubric where we enter all the information based on a five-star system. Once the totals are tallied, we input our star rating on our product reviews based on the breakdown you see above.

Decision factor Weight What's covered
Editor's score 20% The ease of use and intuitiveness while testing the product
Value 3% Lowest plan price, money-back guarantee length, maximum number of devices included
Core features 20% Inclusion of real-time protection, scheduled scans, manual scans, ransomware protection, a firewall, network protection, webcam and/or microphone protection, and phishing protection
Bonus features 2% Inclusion of performance optimization tools, a password manager, an ad blocker, identity monitoring, parental controls, and a VPN
Test results 49% Results for quick scan speed, in-house EICAR tests, and most recent AV-TEST
Compatibility 3% Availability of apps for desktop and mobile
Customer service 3% Number of methods available for human support

Testing is not a one-and-done situation. We retest products regularly and give updates on if and how the service has changed. This allows us to recommend the best antivirus software so you can make an informed decision.