Concepts · Entry 1

What antivirus software is

A working definition of the category, the three jobs a scanner performs, and an honest account of where its reach ends.

Part of the Momentum Space knowledge base · Last reviewed 22 September 2026

A definition worth starting from

An antivirus product is a program with privileged access to a device, which examines other software on that device and intervenes when something matches a description of malicious behaviour. Three parts of that sentence do the work. Privileged access, because a scanner that could only see what an ordinary application sees would be useless. Examines other software, because the object of attention is code and the files that carry it. Intervenes, because a product that only reports and never acts is a diagnostic tool rather than a protective one.

The word antivirus is now a historical label rather than a description. It was coined when the dominant threat was a self-replicating program that attached itself to executable files and spread when those files were copied. Those still exist, but they are a minority of what a scanner is built to find. The industry's own term is endpoint protection, which is more accurate and less familiar, and vendors continue to use the older word on consumer products because that is what people search for.

The three jobs a scanner performs

Strip away the marketing around any consumer product and the same three functions remain underneath.

Identification

The product must decide whether a given file, process or network request is harmful. It does this with several methods at once: exact matching against known malicious files, rules that describe suspicious characteristics, models trained on large collections of files, observation of what a program does once it runs, and queries to the vendor's servers about files the local engine has not seen. How detection works takes each of these apart, because the differences between them explain most of what people notice in daily use, including why products sometimes disagree about the same file.

Action

Once something is identified, the product does something about it. The usual escalation is to block execution, then attempt to clean the file by removing the malicious portion, then move the whole file into quarantine, and finally delete it. Quarantine matters more than it sounds: it is a reversible state. A file in quarantine has been rendered inert but not destroyed, so a wrong decision can be undone. Products that delete aggressively without a recoverable step are making a trade that favours certainty over recoverability, and the cost of that trade lands on the person whose file it was.

Reporting

The third job is to tell someone what happened, in terms that support a decision. A notification that names a file, states what was detected and says what action was taken is useful. A notification that says a threat was handled and offers an upgrade is not, and the difference is visible after a week of ordinary use. On a family or business device, the reporting function is often the one that matters most, because it is the only record of what the software has been doing.

Real-time protection and scheduled scanning

These are two different modes and they fail in different ways.

Real-time protection, sometimes called on-access scanning, hooks into the operating system so that the scanner is consulted whenever a file is created, opened, written or executed. It is the part that stops something before it runs, and it is the part that costs performance, because it inserts a check into operations that happen thousands of times a minute. When a product noticeably slows a machine, real-time scanning is usually where the cost is.

A scheduled or on-demand scan reads through storage systematically, checking files whether or not anything is touching them. Its value is retrospective: today's definitions are applied to files that arrived last month, when the malicious ones among them were not yet recognised. This is why a scan sometimes finds something that was present and quiet for weeks. It is not evidence that real-time protection failed in a simple sense; it is evidence that identification improved after the file arrived.

What already ships with the operating system

A buying decision made without knowing what is already installed is guesswork. Every mainstream platform includes security functions that overlap substantially with what consumer antivirus products sell.

• Windows includes Microsoft Defender Antivirus, with real-time scanning, cloud-assisted identification and a controlled folder access feature aimed at ransomware. It is enabled by default and steps aside automatically when a third-party engine registers itself.
• macOS includes XProtect, which blocks known malicious files, Gatekeeper, which checks that applications are signed and notarised before they run, and system integrity protection, which prevents even an administrator from modifying protected system areas.
• Android includes Google Play Protect, which scans applications on the device and those submitted to the Play Store, alongside a permission model that requires an app to ask before reaching the camera, microphone, location or files.
• iOS and iPadOS take a structural approach instead: each app runs in a sandbox and cannot read another app's data. This prevents malware from roaming, and it equally prevents a security app from scanning anything beyond its own container.
• Linux distributions rely on signed package repositories and access controls, and scanners are typically deployed on machines that serve files to other systems rather than to protect the Linux machine itself.

Coverage by operating system works through the consequences of each. The Australian Cyber Security Centre publishes platform guidance for individuals and families at cyber.gov.au, which is a reasonable place to confirm what a given device already does.

Where a scanner's reach ends

The clearest way to understand the category is to be specific about what falls outside it.

None of this makes a scanner pointless. It places it accurately: one control among several, strongest against files and programs, silent about judgement and configuration.

How the products are packaged

Consumer security software is rarely sold as a scanner alone. A vendor typically offers a low tier containing the scanning engine, and higher tiers that add a virtual private network, a password manager, a data breach alert service, parental controls, cloud storage or identity monitoring. The bundle is a commercial construction rather than a technical one, and the components are frequently separate products sharing an account.

Two consequences follow. First, comparing two products by their feature lists compares bundles, not protection, and a longer list is not a stronger scanner. Second, a person who already uses a standalone password manager or a separate VPN may be paying twice for the same function. Comparing antivirus products deals with this in the section on what a subscription actually contains.

Reading a vendor's description carefully

Three habits make vendor material easier to read accurately.

1. Separate the measurable from the promotional. Supported operating systems, device counts, subscription length and renewal terms are verifiable facts. Adjectives describing protection are not, and no product can promise that nothing will get through.
2. Check which tier a feature belongs to. Feature lists on a marketing page often cover the whole product family. The comparison table on the vendor's pricing page is the one that says what a specific subscription includes.
3. Find the platform footnote. Where a feature is unavailable on iOS, or works differently on macOS, the vendor usually says so in a footnote rather than in the headline. That footnote is frequently the most useful sentence on the page.

The same habits apply to this site. Where a claim here has a source, it is linked. Where something is not known, it says so, which is why the entry on the product this site links to is shorter on specifics than a promotional page would be.