What antivirus software is trying to do
Antivirus software looks for malicious programs, collectively called malware, and tries to stop them before they cause harm. The term “antivirus” is a historical leftover. Early threats were mostly viruses that copied themselves between files, whereas today’s tools handle a wider mix, including trojans that pretend to be useful software, spyware, adware and ransomware attacks. Many products are now better described as endpoint protection or security suites, but the older name stuck.
No tool catches everything, and new threats appear constantly. The aim is to reduce risk, not to promise that a device can never be infected.
Signature detection
The oldest method is signature matching. Security researchers analyse known malware and extract identifying patterns, such as a distinctive sequence of bytes in a file or a cryptographic fingerprint of the whole file. The antivirus program keeps a database of these signatures and compares files against it when they are downloaded, opened or scanned.
Signature detection has real strengths. It is fast, it produces few false alarms for well-understood threats, and it is reliable against malware that has been seen before. Its weakness is the flip side of the same fact: it can only recognise what is already in the database. Attackers often change small parts of their programs so that the fingerprint no longer matches, and brand-new malware has no signature until someone has found and analysed it. For this reason signature databases are updated frequently, often many times a day.
Behavior and heuristic detection
To cope with unknown threats, modern tools also look at what a program does rather than what it looks like.
- Heuristics examine a file for traits that are common in malware, such as code that tries to hide itself or unusual ways of packaging instructions.
- Behavior monitoring watches running programs and flags suspicious actions. Examples include a program that suddenly starts modifying huge numbers of files, tries to disable security settings, or reaches out to unusual servers.
- Sandboxing runs a suspicious file in a restricted environment to see what it attempts to do before letting it near the real system.
- Reputation and cloud lookups compare a file against what the vendor has seen across many users. A file that is new, rare and unsigned may be treated with more caution than one that is widely used.
These methods can catch things that signatures miss, but they also produce more false positives, meaning legitimate software that gets flagged by mistake. Vendors tune this balance, and results differ between products.
What built-in protection already does
Modern operating systems ship with their own defences, and for many people these form a solid baseline. Depending on the system and version, built-in protection may include:
- a malware scanner with regular signature and behavior updates
- checks on downloaded files and programs before they run
- warnings or blocks for unrecognised or unsigned software
- application sandboxing, so that apps are limited in what they can touch
- web protection in the browser that warns about known harmful or deceptive sites
- security checks at startup so that system files have not been tampered with
On phones, much of the protection comes from the design of the platform itself. Apps run in isolated spaces, permissions are requested individually, and software is distributed through app stores that review submissions. This design means classic antivirus programs work differently on phones than on computers, and in several cases cannot inspect other apps at all. How well each store vets apps varies.
Where add-on products overlap, and where they differ
A third-party security suite largely duplicates the core scanning that is already built in, though it may differ in the following ways.
- It may offer extra features such as a firewall with more controls, email scanning, a password manager, identity monitoring or a virtual private network. Whether those features are useful depends on whether you would otherwise use separate tools.
- It may add management for several devices in one dashboard, which some households or small businesses find convenient.
- It may detect somewhat different sets of threats than the built-in scanner, though the size of any such difference is hard to generalise and changes over time.
There are also costs. Running two full real-time scanners at once can cause conflicts and slowdowns, which is why many products disable or replace the built-in one when installed. Some free programs are funded by collecting data or showing ads, so it is sensible to read what a product does with your information. And a security program with deep access to your system is itself a target, so its own updates matter.
None of this means an add-on is unnecessary or necessary in every case. It means the decision is about specific features and your own habits, not a simple good-or-bad choice.
What antivirus cannot stop
Even the best scanner has limits. It cannot do much if you voluntarily enter your password on a fake page, or approve a request from someone pretending to be support. Many successful attacks rely on persuading the user rather than on malware, which is why tech support scams are so common. Likewise, weak passwords and unpatched software are problems that scanning alone does not solve.
Habits that work alongside it
- Keep the operating system and apps updated so known flaws are closed.
- Install software only from sources you recognise.
- Be cautious with email attachments and unexpected downloads.
- Keep backups, so that a bad infection is recoverable.
- Pay attention to security warnings rather than dismissing them by reflex.
Security software is a safety net, not a licence to ignore the other layers.