How I Test Antivirus Software

Last updated: May 19, 2026

Author: Neil Brown, cybersecurity advocate

My plain-English testing promise

I write for people who want safer devices without jargon. Most readers do not want a lab report. They want to know what works, what costs too much, and what may confuse them after signup.

I do hands-on checks from the point of view of an everyday user. I look at setup, scans, features, plan limits, support, and how clearly the product explains itself. I also review independent lab results from organizations such as AV-TEST, AV-Comparatives, and SE Labs when they are available. I do not claim to run a full malware laboratory.

That wording matters. A home review site should not pretend to be a malware research lab. I do not test thousands of live threats. I do not promise perfect protection. Instead, I combine practical use with current public product data and trusted lab context.

What I check myself

I start with the parts a normal buyer will see first. I look at the signup process, installation flow, first scan, dashboard, alerts, renewal messages, and account screens. A product can have strong protection and still be a poor fit if it is hard to understand.

I also check plan clarity. Antivirus companies often sell several plans with similar names. Some include a VPN, password manager, parental controls, backup, or identity tools. Others reserve useful features for higher tiers. I explain those limits in plain English.

Support also matters. I look for help articles, chat, phone options, refund pages, and clear billing information. Many users only need support when something has already gone wrong. The best products make help easy to find.

Hands-on area	What I look for	Why it matters
Setup	Download, install, account setup, first scan	Beginners should not feel lost before protection starts.
Dashboard	Status messages, warnings, scan buttons, settings	A good dashboard explains risk in simple words.
Plan clarity	Device limits, renewal notes, add-ons, trials	Readers should know what they are buying.
Features	VPN, password manager, firewall, backup, identity tools	Extras help only when they are useful and clear.
Support	Help center, chat, phone, refund information	Support should be reachable when users need help.

What I do not test

I do not run a full malware laboratory. I do not collect large live malware sets. I do not test every threat sample. I also do not guarantee that any product will stop every attack.

No antivirus product can promise perfect safety. Good security uses layers. Updates, backups, careful browsing, strong passwords, and scam awareness still matter. Antivirus is one part of a safer setup.

I also do not provide personal security, legal, or technical support through product reviews. The site gives practical education and buying opinions. If you face a serious security incident, contact a qualified local professional or the product’s support team.

How I use independent lab results

Independent labs add useful context. They test products at a scale that a small review site cannot match. I use lab results as a check on my practical findings, not as the only ranking factor.

AV-TEST publishes home-user antivirus results with separate scores for protection, performance, and usability. Each category is scored out of 6 points, for a maximum of 18 points. AV-Comparatives publishes consumer tests, including real-world protection tests that are designed to reflect everyday attack conditions. SE Labs publishes security evaluation reports and describes its work as testing products against real-world attack methods.

Lab results can change over time. A product may perform well in one period and less well later. For that reason, I note the test period when lab data is used. I also avoid treating one lab result as the whole story.

Source	How I use it	What I avoid
AV-TEST	Protection, performance, and usability context.	I do not copy scores without date context.
AV-Comparatives	Real-world and performance context where available.	I do not treat one chart as a full review.
SE Labs	Attack-chain and home anti-malware report context.	I do not claim I repeated its lab work.

The scoring system

Each main review uses a 10-point score. The score is not a gut feeling. It is a weighted score based on the categories below. The overall score is rounded to one decimal place.

Category	Weight	What it measures
Protection	30%	Malware, ransomware, web protection, phishing defense, and lab context.
Performance	15%	Slowdown, scan impact, background use, and daily responsiveness.
Ease of use	15%	Setup, dashboard clarity, alerts, renewal clarity, and beginner fit.
Features	15%	VPN, password manager, firewall, parental controls, identity tools, and backup.
Privacy and trust	10%	Ownership clarity, data practices, regional restrictions, and transparency.
Support	5%	Help center quality, contact options, refund support, and clarity.
Value	10%	Price, device limits, renewal terms, included features, and fit.

Overall score	Label	Meaning
9.0 to 10.0	Excellent	A strong choice for the stated use case.
8.0 to 8.9	Very good	Worth considering, with clear caveats.
7.0 to 7.9	Good	Useful for some users, but not a top pick.
6.0 to 6.9	Fair	Limited fit. Consider only in narrow cases.
Below 6.0	Not recommended	Avoid for most readers or use only with strong caution.

Affiliate links and review independence

Some links on this site are affiliate links. If you buy through those links, Neil Brown Reviews may earn a commission. This helps keep the site running.

Affiliate relationships do not decide review scores. They also do not decide whether I mention drawbacks. If a product is confusing, expensive, restricted, or a poor fit for some readers, the review should say that clearly.

I also avoid inventing affiliate links. If a product does not already have an affiliate relationship on this site, I may link to an internal review or provide a normal informational link. I do not label ordinary links as affiliate links.

How I keep pages current

Core commercial pages are checked at least quarterly. Pricing, plan names, product ownership, and regional restrictions can change. When I find a material change, I update the relevant page.

Major reviews are retested or revalidated at least once a year. A revalidation may include a new install check, updated plan review, lab-result refresh, and link check. Each review should show a visible last updated line.

Some topics need faster updates. Kaspersky is one example because U.S. restrictions affect whether U.S. readers should consider it. Ownership changes also matter. McAfee, for example, should be described by its current ownership context, not old Intel-era wording.

Corrections policy

If you spot a factual error, please use the contact route on the About page. I aim to correct clear factual mistakes promptly. I also update pages when important product facts change.

Readers should include the page URL and the exact point that needs review. This makes corrections faster and more useful for everyone.

Evidence standards

Each maintained review should use current evidence. That means date-stamped pricing checks, current public product pages, recent lab context when available, and notes on regional restrictions. Screenshots should be current when they are used.

I prefer plain evidence over hype. A review should help you decide whether a product fits your home, family, or small office. It should not scare you into buying more software than you need.

Sources I check

I use public product pages, support pages, independent lab results, ownership announcements, and official government notices where relevant. For lab context, I commonly check AV-TEST test procedures, AV-TEST home-user results, AV-Comparatives test methods, and SE Labs reports.

Those sources do not replace judgment. They help check whether my practical impressions match broader testing evidence.

Where to go next

If you are choosing antivirus now, start with the best antivirus guide. If you want to compare maintained reviews, visit the antivirus reviews page after it launches. You can also read more about Neil on the About page.