What antivirus software actually does on your device
Detection engines, scanning modes, quarantine, and the reasons the same product behaves so differently on a Windows laptop and an iPhone.
Quick answer
A security product sits between incoming data and the rest of your device. It inspects files as they arrive or execute, checks addresses your browser tries to reach, and watches for programs behaving in ways that resemble malicious software. Anything it flags is blocked or moved into quarantine. It handles code well and conversation badly: nothing in that description stops you from typing your banking password into a convincing copy of your bank's login page.
Four jobs, bundled into one purchase
Modern security suites bundle several distinct functions under one name, which is part of why comparing them is awkward. Separating them helps.
- File inspection
- Examining files on disk and files as they are created, downloaded or opened, to decide whether each one is safe to leave alone.
- Execution monitoring
- Watching what running programs do — which files they modify, which system settings they touch, whether they start encrypting documents in bulk — and intervening when the pattern looks like an attack rather than ordinary use.
- Network and web filtering
- Checking the addresses a browser or app tries to reach against lists of known malicious or fraudulent destinations, and blocking the connection before the page loads.
- Ancillary tools
- Password managers, breach notification, VPN clients, file shredders and tune-up utilities. These are packaged with antivirus products but are separate products in function. They are worth judging separately.
When two products are described as antivirus software, they may be doing quite different proportions of these four. A product that is strong at file inspection and absent at web filtering will feel unremarkable right up to the moment it matters.
Three ways of deciding something is malicious
Detection is the core of the product, and there are broadly three techniques in use. Almost every commercial engine runs all three at once, weighting them differently.
| Approach | How it decides | Strength | Weakness |
|---|---|---|---|
| Signature matching | Compares a file's contents against a database of fingerprints taken from known malicious files. | Precise and cheap. A match is close to certain, and false alarms are rare. | Blind to anything not yet in the database, and attackers alter files specifically to break the fingerprint. |
| Heuristic analysis | Looks for structural traits associated with malicious code — obfuscated sections, unusual packing, suspicious instruction sequences — without needing an exact match. | Catches variants of known families and some genuinely new samples. | Judgement-based, so it produces more false positives, particularly on small or unusual legitimate programs. |
| Behaviour monitoring | Observes what a program does once running, and stops it when the sequence of actions matches an attack pattern. | The only approach with a realistic chance against software nobody has seen before, including ransomware. | Acts after execution has begun, so some damage can occur before the intervention. Costs more system resources. |
Cloud lookups sit alongside all three. Rather than shipping an enormous local database, the product sends a hash — a short mathematical summary of a file — to the vendor's servers and receives a verdict. This keeps local updates small and verdicts current, at the cost of a constant, low-volume conversation between your device and the vendor. What that conversation contains is described in the vendor's privacy policy, which is worth reading for any product you install.
Real-time protection versus scheduled scans
These two modes get confused constantly, and the difference matters when you are deciding whether a product is doing its job.
Real-time protection runs continuously. It hooks into the operating system so that file operations pass through the engine before they complete. A downloaded attachment is inspected as it lands. A program is checked as it launches. This is the component that prevents infection, and it is the one that has to be running for the product to be useful at all.
On-demand scanning is the full sweep of the disk you start manually or on a schedule. It finds things that were already present — files that arrived before the product was installed, or samples that were unknown at the time and have since been added to the database. It takes a long time, it uses the processor heavily, and it is a cleanup mechanism rather than a preventive one.
A weekly or fortnightly scheduled scan, set to run when the machine is on but idle, is a reasonable default for a home computer. Daily full scans are rarely worth the disruption; real-time protection is what carries the load day to day.
Quarantine, and what to do about a false positive
When a product flags a file, it usually does not delete it. Quarantine moves the file into an encrypted holding area where it cannot execute, and records where it came from. This exists because detection is probabilistic, and occasionally the engine is wrong.
False positives cluster around a few types of legitimate software: niche utilities from small developers, programs that modify other programs, older installers, and anything using compression or obfuscation for licensing reasons. If a tool you installed deliberately and obtained from its genuine source is flagged, the sensible sequence is:
Leave it in quarantine
Do not restore it reflexively. Nothing is lost while it sits there, and the file cannot run.
Check where it came from
Trace the download back to its origin. A file from a developer's own site is a different proposition from the same name obtained through a download portal that wraps installers in bundled extras.
Get a second opinion
Most vendors provide a submission channel for suspected false positives. Submitting the file gets it reviewed and, if the verdict was wrong, corrected for everyone.
Restore only with an exclusion you understand
If you restore the file, the product will usually ask you to add an exclusion. Keep exclusions specific to that file. Excluding a whole folder — particularly a downloads folder — removes protection from everything that lands there afterwards.
Why the same product is a different product on each platform
A subscription advertised as covering several operating systems does not deliver the same capability on each, because the platforms do not permit the same access. This is the single most common surprise for people buying a multi-device licence.
| Platform | Typical scope of a third-party security product |
|---|---|
| Windows | The fullest version. Deep file-system access, execution monitoring, network filtering and boot-time scanning are all available, and Windows ships with its own built-in protection that third-party products replace or sit beside. |
| macOS | Substantial but more constrained. File inspection and web filtering work; deeper system hooks require explicit permissions that macOS prompts you to grant, and some require restarting into a specific mode. |
| Android | Apps can inspect other installed applications, scan storage and filter web traffic, within the permission model. Capability is real but narrower than on a desktop. |
| iOS and iPadOS | The most restricted. Apple's application sandbox prevents any app from inspecting other apps or scanning the file system, so security apps on iOS provide web filtering, breach alerts and VPN features rather than virus scanning in the conventional sense. |
| Linux | Usually file scanning, often positioned to catch malicious files passing through a Linux machine towards Windows systems rather than to protect the Linux host itself. |
None of this means a subscription covering phones is worthless. It means the iOS component should be judged on the features it can actually provide, not on the word "antivirus" appearing beside the platform name.
What antivirus software does not do
- It does not prevent you from being talked into a payment. Scam losses in Australia overwhelmingly come from persuasion, which is why the National Anti-Scam Centre runs Scamwatch as a reporting and education service rather than a technical one.
- It does not replace operating system and browser updates. Applying patches promptly is the measure the Australian Cyber Security Centre puts at the front of its personal security guidance.
- It does not protect an account that reuses a password already exposed in someone else's data breach. That is what a password manager and multi-factor authentication address.
- It does not make a device anonymous. A bundled VPN changes which network sees your traffic; it does not remove the identifiers you hand over by logging in.
- It does not recover encrypted files after ransomware has run. Only a backup that was disconnected at the time does that.
The performance question
Security software has a resource cost, because inspecting every file operation means doing work every time a file is touched. On a machine with a solid-state drive and a reasonable amount of memory, that cost is usually unnoticeable during normal use and obvious during a full scan. On an older machine with a mechanical hard drive, it can be noticeable throughout.
Two settings make most of the practical difference: when the scheduled scan runs, and whether the product's optional extras are installed. Suites default to installing everything they offer. Declining the components you will not use — a browser toolbar, a tune-up module, a bundled VPN you already have elsewhere — reduces the footprint without touching the protection you paid for.
Running two real-time antivirus products at once is the one configuration to avoid outright. Each inspects the other's activity, which produces conflicts, duplicated scanning and occasionally files locked by both.
Common questions
Does a modern operating system already include enough protection?
Windows and macOS both ship with built-in protection that has improved substantially. Whether it is sufficient depends on how the device is used and who uses it. A shared family computer and a single-user work laptop present different risks. A paid product generally adds web filtering, cross-platform coverage under one subscription, and support you can contact — which are worth different amounts to different households.
How often does the detection database update?
Commercial engines update frequently through the day, and cloud lookups mean some verdicts are current the moment the vendor issues them. The specific cadence is a vendor detail; if it matters to you, it is a question for the vendor's documentation rather than something this site can state.
Is a free version enough?
Free tiers usually include the core detection engine and withhold the extras — web filtering, multi-device coverage, support, sometimes ransomware-specific protection. The engine being the same is the important part. What you are buying with the paid tier is scope and support, not usually a better scanner.
Should I run a scan after visiting a suspicious website?
It does no harm, and it will settle the question. Visiting a page is not the same as running a file, so the usual outcome is that nothing is found. If you entered credentials on the page, changing that password is far more useful than any scan.
Related reading
- Choosing security softwareTurning the mechanics above into the questions to ask before you pay.
- Fake alerts and scam callsTelling a genuine product notification from an imitation of one.
- Device checklistsThe settings that matter more than the software choice itself.
- Questions answeredShorter answers to the questions that come up most often.