Most tested. Most awarded. Kaspersky protection.*
In 2022 Kaspersky products participated in 86 independent tests and reviews.
Our products were awarded 69 firsts and received 73 top-three finishes.

* Notes:• According to summary results of independent tests in 2022 for corporate, consumer and mobile products.
• Summary includes independent tests conducted by: AV-Comparatives, AV-TEST, ICSA Labs, MRG Effitas, SE Labs, Testing Ground Labs, Virus Bulletin.
• Tests performed in these programs assess all protection technologies against known, unknown and advanced threats.
• The size of the bubble reflects the number of 1st places achieved.
• Most tested over the period 2013 to 2022.

1

2022 TOP3 metric description

2

TOP3 metric reflects how successful a vendor was inindependent comparative tests within a calendar year.

Noof tests
enteredNo
of TOP3
placesScoreof TOP3
places (%)

No of 1st
places

Kaspersky

86

73

85%

69

The main characteristic of success is a TOP3 score that shows how many times a vendor with its products gained thefirst, second, or third place in independent tests they participated in within a reported period. The TOP3 score is
calculated by dividing a vendor’s TOP3 counter by a vendor’s Participation counter.

AVG

46

38

83%

36

Avast

78

63

81%

55

The TOP3 score is determined for each participating vendor separately and then compared to each other.

Avira

48

35

73%

32

1.

NortonLifeLock

46

33

72%

32

G DATA

47

32

68%

32

Microsoft

57

38

67%

31

Bitdefender

86

55

64%

54

Trend Micro

54

32

59%

31

AhnLab

41

23

56%

23

ESET

42

23

55%

21

Trellix (McAfee)

63

31

49%

30

Malwarebytes

46

15

33%

15

Broadcom (Symantec)

24

13

54%

13

2.

Depending on a test, final test results may vary from giving awards for participating vendors to providing only a listof their detection rates and false positives.
A vendors’s TOP3 counter is incremented either for winning an award or ranking in the first three places in a test. It
cannot be incremented both for receiving the award and one of the first three places.
Several vendors can achieve equal results in detection rates, or summary results, or win awards of the same grade.
In this case, the vendors share the same place in the same test.
In case of detection rates or summary results, the place of a vendor with the lower result is calculated as “numberof higher ranked vendors + 1”. For instance, the sequence “1,1,2,3” is not possible, whilst “1,1,3,4”, or “1,2,2,4”, or“1,1,1,1,1,6” are . In the latest sequences TOP3 counter will be incremented for bolded vendors only.
In regards with awards, refer to rule clarifications listed in the tests description below.
A vendor’s Participation counter is incremented each time one of its products participates in a
test/review/overview.
In some tests several products of one vendor can participate in the same test. In those cases, since all products
increment the vendor’s Participation counter, the Participation counter can be higher than a total number of tests.

Only those who participate in 35% or more of the total number of tests have their results represented in the chart.
The deadline for submitting scores attained during period 2013-2022 was February 1st, 2023, with no option to add any
test/review after this date.
Among the security vendors participating in the TOP3 measurements are: Avast, AVG, Avira, Bitdefender, Broadcom(Symantec), BullGuard, Crowdstrike, ESET, F-Secure, G DATA, Kaspersky, Microsoft, NortonLifeLock, Palo Alto, Panda,
Sentinel One, Sophos, Trellix (McAfee), Trend Micro, Quick Heal and VMWare (Carbon Black). A complete list ofparticipants appears at the end of this document.

* Broadcom (Symantec) participated only in 21% of the total number of tests, but weconsider valuable to have the vendor’s results represented in the chart .

2022 TOP3 metric description

3

These tests were performed against various types of malware, including advanced threats, aswell as false positives
SPECIFIC THREATS
APT• AV-Comparatives. Advanced Threat Protection Test: Consumer
and Business• AV-Comparatives. Endpoint Prevention and Response (EPR) test
• AV-Comparatives. LSASS credential-dumping security test
• AV-TEST. Advanced Threat Protection Test: Consumer andBusiness• ICSA. Advanced Threat Detection Certification• SE Labs. Enterprise Advanced Security (EDR) Test – Detection
RANSOMWARE• AV-Comparatives. Advanced Threat Protection Test: Consumer
and Business• AV-Comparatives. Business Security Test
• AV-Comparatives. Malware Protection Test
• AV-Comparatives. Real-World Protection Test
• AV-TEST. Advanced Threat Protection Test: Consumer andBusiness• AV-TEST. Bi-Monthly Certification: Consumer and Business• MRG Effitas. 360 Assessment & Certification• SE Labs. Enterprise Advanced Security (EDR) Test - Detection• SE Labs. Enterprise Endpoint Protection Test
• SE Labs. Home Anti-Malware Protection Test
• SE Labs. Small Business Endpoint Protection Test
FILELESS• AV-Comparatives. Endpoint Prevention and Response (EPR) test

• AV-Comparatives. Advanced Threat Protection Test: Consumer
and Business• MRG Effitas. 360 Assessment & Certification• SE Labs. Enterprise Endpoint Protection Test
• SE Labs. Home Anti-Malware Protection Test
• SE Labs. Small Business Endpoint Protection Test
EXPLOITS• AV-Comparatives. Advanced Threat Protection Test: Consumer
and Business• MRG Effitas. 360 Assessment & Certification• SE Labs. Enterprise Advanced Security (EDR) Test - Detection• SE Labs. Enterprise Endpoint Protection Test
• SE Labs. Home Anti-Malware Protection Test
• SE Labs. Small Business Endpoint Protection Test
PHISHING• AV-Comparatives. Anti-Phishing Test

REAL-WORLD TESTS• AV-Comparatives. Advanced Threat Protection Test: Consumer
and Business• AV-Comparatives. Business Security Test
• AV-Comparatives. Real-World Protection Test
• AV-TEST. Advanced Threat Protection Test: Consumer andBusiness• AV-TEST Bi-Monthly Certification Consumer and Business• CyberRatings. Endpoint Protection Comparative Test

• MRG Effitas. 360 Assessment & Certification• SE Labs. Enterprise Endpoint Protection Test
• SE Labs. Home Anti-Malware Protection Test
• SE Labs. Small Business Endpoint Protection Test

ANDROID TESTS• AV-Comparatives. Mobile Security Review• AV-TEST. Android Mobile Security Products Test: Consumer andBusiness• MRG Effitas. Android 360 Assessment Programme• Testing Ground Labs. Android Malware Detection Test: Consumer
and Business

MAC TESTS• AV-Comparatives. Mac Security Test & Review• AV-TEST. Mac Detection & Performance Test: Consumer andBusiness

DEDICATED TESTS• AV-Comparatives. Parental Control Certification• AV-TEST. Parental Control Certification• AV-TEST. VPN Test

FALSE POSITIVES (FP)• All the tests mentioned above include FP measurements

2022 TOP3 metric description

4

The following tests were performed in 2022 and used to calculate the metric. The test labs
and tests are listed in alphabetical mode.
AV-Comparatives• Product of the YearAt the end of the year, this annual award is given to the Consumer
related product which attained the highest awards in an entire
year’s testing cycle, involving the following tests: two Malware
Protection Tests (MPT) + two Real-World Protection Tests(RWPT) + two Performance Tests + Advanced Threat Protection
Test (ATP, formerly known as Enhanced Real-World Test).
According to AV-Comparatives’ rules, in cases where two or moreproducts receive the same maximum score, the award goes tothe product which gained the highest individual scores and did notreceive it the previous year. The seal is counted as a first place in
the TOP3 metric.
Products which were nominated, but did not receive the ‘Productof the Year’ award, are given the ‘Outstanding Product’ rank fortheir vendors, which counts as a second place in the TOP3
metrics. Products which achieved at least 90 points across theentire test cycle are awarded the ‘Top Rated’ rank for theirvendors, which counts as a third place in the TOP3 metric.
Products that fail to score any points in, at least, one of the tests
are excluded.
At the end of the year, medals ('Gold’, ‘Silver’, ‘Bronze’) are also
given for the best results in specific tests: MPT, RWPT,
Performance, ATP . As these test results have already contributed
to overall TOP3 metrics, the medals themselves do not counttowards it since 2015.
Only awards can contribute towards TOP3 counters in AVComparatives tests.

• Malware Protection Test
This test is a successor of the File Detection Test and includes
execution of the tested files. It is conducted twice a year and,correspondingly, is counted two times in the metrics. The test
consists of two parts: Detection Rate and False Positives.
Products receive the following awards: “Advanced+”, “Advanced”,“Standard” or “Tested”. Only products with “Advanced+” gain an
increment of TOP3 counters for their vendor.

• Real-World Protection Test
The test lasts for four months and is finalized in a half-year reportusing mainly current, visible, and relevant malicious
websites/malware. The test is conducted twice a year and,correspondingly, counted two times in the metrics. Because all
product components contribute a significant role in overall
protection, results achieved in this category are a good indicatorof anti-malware product efficiency in real-world scenarios.
Products receive the following awards: “Advanced+”, “Advanced”,“Standard” or “Tested”. Only products with “Advanced+” gain an
increment of TOP3 counters for their vendor.

• Advanced Threat Protection Test: Consumer
and BusinessThis test uses hacking and penetration techniques that allow
attackers to target specific external computer systems, andevaluates how well security products protect against suchattacks. This test checks protection against targeted advanced
threats, such as exploits and fileless attacks.
Despite all products from consumer Main-Test-Series are
expected to be tested by default, the vendors were given theopportunity to opt out of this test before the test started, which
is why not all vendors are included in this test. This test is
conducted and counted in the metrics once a year. Consumer
and Business related products are assessed separately.
Consumer products receive the following awards: “Advanced+”,“Advanced”, “Standard” or “Tested”. Only products with“Advanced+” gain an increment of TOP3 counters for theirvendor.
Business products which block at least 8 of the 15 attacks used in
the test, without blocking non-malicious operations, are certified
by the test lab and gain an increment of TOP3 counters for theirvendor.

• Endpoint Prevention & Response (EPR) Test
This test is performed and counted once a year and evaluates
security solutions response capabilities (active response, passive
response) to targeted attacks, ability to take remedial action,
investigate the nature of an attack, collect and show information
on indicators of compromise in an easily accessible form. The
effectiveness of each product at preventing breaches, thecalculated savings resulting from this, the purchase costs of the
product, and the product’s accuracy costs are factored byEnterprise EPR CyberRisk Quadrant.
Products receive one of the following three certification levels:“Strategic Leaders”, “CyberRisk Visionaries”, and “Strong
Challengers”, or they are not certified. Only products with
“Strategic Leader” gain an increment of TOP3 counters for theirvendor.

2022 TOP3 metric description

5

The following tests were performed in 2022 and used to calculate the metric. The test labs
and tests are listed in alphabetical mode.
• LSASS Credential-Dumping Security Test
This test is performed and counted in the metrics one time a year.
It evaluates how well business security products determine theirhardening measures protected against attacks on Windows’ Local
Security Authority Subsystem Service (LSASS).
Products placing in the highest three positions based on theProtection Rate gain an increment of TOP3 counters for theirvendor.

• Business Security Report
This report is published twice a year. Correspondingly, it iscounted two times in the metrics. The report includes a review ofvarious business security products and evaluates the protection
efficiency in categories such as Protection Rate on different
malware sets, websites, and exploits, and a False Positive level.
Products achieving, at least, 90 percent Protection Rate with noFalse Positives on common business software in the Malware
Protection Test and, at least, 90 percent Protection Rate with lessthan 100 False Positives on any clean software/websites in theoverall Real-World Protection Test, with no major performanceissues, are certified by the test lab, and gain an increment of TOP3
counters for their vendor.

• Anti-Phishing Test
This test is performed and counted in the metrics once a year andsimulates a common situation: users rely on the anti-phishingprotection provided by their security products while browsing theweb. The test consists of two parts: Detection Rate and False
Positives.
If all products achieve zero False Positives, the products achieving

the highest three places based on Protection Rate, gain an
increment of TOP3 counters for their vendor.
If any of participating products achieve any False Positives, only
certified products gain an increment of TOP3 counters for theirvendor.

• Mobile Security Review
This review is done and counted in the metrics once a year andincludes a malware protection test along with an overview ofadditional features (theft protection, battery consumption, etc.).
If all products achieve zero False Positives, the products achieving
the highest three places based on Protection Rate, gain an
increment of TOP3 counters for their vendor.
If any of participating products achieve any False Positives, only
certified products gain an increment of TOP3 counters for theirvendor.

• Mac Security Test & Review
This review is done and counted in the metrics once a year andevaluates various Mac protection products against a productfeature list and measures protection levels in categories such as
Detection Rate on separate Mac- & Windows-related malware
sets and a False Positive level.
If all products achieve zero False Positives, the products achieving
the highest three places based on Protection Rate, gain an
increment of TOP3 counters for their vendor.
If any of participating products achieve any False Positives, only
certified products gain an increment of TOP3 counters for theirvendor.

• Parental Control Certification
This test is performed and counted in the metrics once a year andevaluates efficiency of security products to prevent children fromvisiting unwanted web sites.
Only products blocking at least 98% of pornographic websites
with zero False Positives on child-friendly websites, and having nosevere unresolved bugs (or design flaws) discovered during thereview, are certified and gain an increment of TOP3 counters fortheir vendor.

2022 TOP3 metric description

6

The following tests were performed in 2022 and used to calculate the metric. The test labs
and tests are listed in alphabetical mode.
AV-TEST• Best Protection Award: Consumer andBusiness
This annual award is given once a year for perfect results in theProtection category over the course of an entire year, during
which bi-monthly certification takes place. Consumer andBusiness related products are assessed separately.
Only products that receive this award gain a TOP3 counterincrement for their vendor.

• Best Usability Award: Consumer andBusiness
This annual award is given once a year for perfect results in theUsability category over the course of an entire year, during which
bi-monthly certification takes place. Consumer and Business
related products are assessed separately.
Only products that receive this award gain a TOP3 counterincrement for their vendor.

• Best Android Security: Consumer
This annual award is given once a year for perfect results in the
Android security testing over the course of a whole year.
Consumer and Business related products are assessed
separately.
Only products that receive this award gain a TOP3 counterincrement for their vendor.

• Best Mac Security: Consumer and BusinessThis annual award is given once a year for perfect results in the
Mac security testing over the course of a whole year. Consumer
and Business related products are assessed separately.
Only products that receive this award gain a TOP3 counterincrement for their vendor.

• Best Advanced Threat Protection: Consumer
and BusinessThis annual award is given once a year for perfect results in the
Advanced Threat Protection testing over the course of a wholeyear. Consumer and Business related products are assessed
separately.
Only products that receive this award gain a TOP3 counterincrement for their vendor.

• Bi-Monthly Certification: Consumer andBusiness
This year-long certification series consists of Consumer andBusiness segments, each divided into six separate, two-monthlong tests, which results are published every even months, i.e. thistest is counted 6 times in the metrics. Consumer and Business
related products are assessed separately. All participatingproducts are evaluated and receive points in Protection,
Performance and Usability categories. The sum of the points
gained in each category makes up the overall score; products inthe top three have their TOP3 counters incremented.

• Advanced Threat Protection Test: Consumer
and BusinessThis test is counted six times in the metrics (November,
December, February, April, June, August). Consumer andBusiness related products are assessed separately. It assesses
detection and threat prevention capabilities of end-point
solutions against APT attacks deploying ransomware without
generating False Positives on normal operations. The executed
attack chains are split into separate stages attributed to different
TTPs from MITRE ATT&CK. The sum of the points gained in eachstage makes up the overall score; products in the top three havetheir TOP3 counters incremented.

• Android Mobile Security Products Test:
Consumer and BusinessThis year-long certification series evaluates various security
protection products for Android and consists of Consumer andBusiness segments, each divided into six separate tests. Theirresults are published every odd months, i.e. this test is counted 6
times in the metrics. Consumer and Business related products areassessed separately. All participating products are evaluated andreceive points in Protection, Performance and Usability
categories. The sum of the points gained in each category makes
up the overall score; products in the top three have their TOP3
counters incremented.

2022 TOP3 metric description

7

The following tests were performed in 2022 and used to calculate the metric. The test labs
and tests are listed in alphabetical mode.
• Mac Detection & Performance Test:
Consumer and BusinessThis test evaluates various security protection products for Mac
OS X and consists of Consumer and Business segments, which
results are published and counted in the metrics four times a year.
Consumer and Business related products are assessed
separately. All participating products receive points in Protection,
Performance and Usability categories. The sum of the points
gained in each category makes up the overall score; products inthe top three have their TOP3 counters incremented.

• VPN Test
The test is performed and counted in the metrics once a year. It
assesses and compares VPN solutions by separate topics ofusability, security, privacy, speed, and transparency.
Each product that passes the certification gains an increment of
TOP3 counter for their vendor.

CyberRatings

MRG Effitas• Endpoint Protection Comparative Test

• 360 Assessment & Certification

This test is performed once a year and evaluates eachparticipated product’s ability to block malware as quick as
possible. Products placing in the highest three positions based on
the Average Block Rate (Over Time) gain an increment of TOP3
counters for their vendor.

ICSA Labs• Advanced Threat Defense Certification1
This assessment is performed every quarter, i.e. four times a year,
and aims to evaluate the efficiency of security solutions to detect
new and little-known threats while minimizing false positives. Each
product that passes the certification gains an increment of TOP3
counter for their vendor.

This test is conducted and published four times a year andevaluates both the ability to block initial infection and time taken
to detect and remediate malware on a compromised system. This
test replaces the older “Time to Detect & Remediate Assessment”
test and includes Online Banking part since second quarter of2020 that assesses the efficiency of products against financial
malware. Only certified products gain an increment of TOP3
counters for their vendor.

• Android 360 Degree Assessment ProgrammeThis test is conducted and published four times a year andevaluates both the ability to block initial infection while copying itto the device, so called the Early Stage Detection, and whilerunning it, the Installation Stage. The test also includes a false
positive subtest.
Products placing in the highest three positions based on the
combined of two stages Detection Rate gain an increment of
TOP3 counters for their vendor.

• Parental Control Certification
This vendor-comissioned test is performed and counted in themetrics once a year and evaluates protection efficiency of
security products on Windows, Android and iOS platforms toprotect children from visiting unwanted web sites.
Only certified products gain an increment of TOP3 counters fortheir vendor.
1 In the fourth quarter of 2022 Verizon Inc. have made decision to close
ICSA Labs on December 31st 2022, so only first three quarter reports
are published and taken into account in TOP3 metric.

2022 TOP3 metric description

8

The following tests were performed in 2022 and used to calculate the metric. The test labs
and tests are listed in alphabetical mode.
SE Labs (formerly known as Dennis
Technology Labs)• Enterprise Endpoint Protection Test
• Small Business Endpoint Protection Test
• Home Anti-Malware Protection Test
These quarterly-long tests are published and counted in themetrics four times a year. These tests aim to compare theeffectiveness of anti-malware products provided by well-known
security companies. Enterprise, Home, and Small Businessproducts are evaluated separately. The products are exposed tolive Internet threats during the test period. This exposure is carriedout in a very realistic way, closely reflecting the customer
experience. The results reflect how products perform under reallife, customer-use-case scenarios, i.e. what happens when a user
visits an infected website. The tests include a detection subtest
and a false positive one.
Three products with the highest Total Accuracy Rating scores(calculated as a combination of points of the two subtests) gain
an increment of TOP3 counters for their vendor.

• Enterprise Advanced Security (EDR) Test Detection
This test is published and counted in the metrics one time thisyear. It is also known as Breach Resonse Test and evaluates
effectiveness of a tested product against a range of hacking
attacks designed to compromise systems and penetrate target
networks in the same way as criminals and other attackers breachsystems and networks. The tests include a detection subtest anda false positive one.

Three products with the highest Total Accuracy Ratings scores(calculated as a combination of points of the two subtests) gain
an increment of TOP3 counters for their vendor.

• Email Security Services Protection Test
This test is performed and counted in the metrics one time a year
and assesses how effectively the email hosted protection
services for the Office365 platform are at detecting and/or
protecting against threats in real time, including phishing, BEC(business e-mail compromise), social engineering and real world
spam. The test includes a detection subtest and a false positiveone.
Three products with the highest Total Accuracy Rating scores(calculated as a combination of points of the two subtests) gain
an increment of TOP3 counters for their vendor.

Testing Ground Labs
• Android Malware Detection Test: Consumer
and BusinessThis test evaluates how effectively mobile products can protect
users’ Android-based devices from threats. It includes a detection
subtest and a false positives one. Consumer and Business related
products are assessed separately and are published four and twotimes this year, correspondingly. Starting from June 2022, eachtest of the testing lab is complient with the AMTSO Testing
Protocol Standard and confirmed by AMTSO.
Three products with the highest Total Scores (calculated as a
combination of the two subtests results) gain an increment of
TOP3 counters for their vendor.

VirusBulletin• VB100 Certification
These tests are held every month to evaluate different types of
products (before that, these tests were held every even months);
the reports are published twelve times this year.
Each product that passes the certification gains an increment of
TOP3 counter for their vendor.

2022 TOP3 metric description

9

A complete list of participants in tests registered in TOP3-2022.
•

1E

•

Comodo•Hammock•

Qi-ANXIN•

Trellix (McAfee)•

Acronis•CrowdStrike•

Ikarus•Quick Heal•

Trend Micro•

AhnLab•Cybereason•

Intego•

RevBits•

Tweaking Technologies•

Anonimous

•

Cynet

•

IronNet•Rising•Vendor A (AVC-EPR)•

Antiy Labs•

CyRadar•Juniper•

Sangfor•

Vendor B (AVC-EPR)•

ArcaBit•

Data443•

K7•

Scanguard•

Vendor C (AVC-EPR)

•

Avast

•

Deep Instinct•

Kaspersky•

Securion•

Vendor D (AVC-EPR)

•

AVG

•

Defenx•Lavasoft•

SentinelOne•

Vendor E (AVC-EPR)

•

Avira

•

Dr.Web

•LINE•

Seqrite•Vendor A (AVC-PC)•

Bitdefender•

Elastic•

Malwarebytes•

Sequretec•

Vendor B (AVC-PC)•

BlackBerry (Cylance)•

EmsiSoft•

Microsoft•

Shield Antivirus•

Vendor C (AVC-PC)•

Broadcom (Symantec)

•

ESET

•

Microworld•

SonicWall•

Vendor D (AVC-PC)•

Bullguard•

ESTsecurity•

NortonLifeLock•

Sophos•Viettel Security•

Check Point•

Exosphere

•

NSHC

•

Surfshark

•

VIPRE

•

CHOMAR•

Faronics•

Palo Alto•

Tabidus•

VMware (Carbon Black)

•

Cisco

•

Fortinet

•

Panda

•

Tencent•

Webroot•

ClamXav•

F-Secure•

PC Pitstop•

TGSoft•WithSecure•

Clario•G DATA•

PCProtect•

ThreatBook•

Zemana•

CMC Cyber Security•

Google•Perception-Point•

Total Defense

•

Zoner

•

Combo

•

GoSecure•

Private Internet Access Inc.

•

TotalAV