PS
EP

Endpoint Security

T

O
R

C

E

T

Home

IO
N

Oct - Dec 2023

selabs.uk

info@SELabs.uk

selabs.uk/newsletterblog.selabs.uk

SE Labs tested a variety of anti-malware (aka ‘anti-virus’; aka ‘endpoint security’) products
from a range of well-known vendors in an effort to judge which were the most effective.
Each product was exposed to the same threats, which were a mixture of targeted attacks
using well-established techniques and public email and web-based threats that were
found to be live on the internet at the time of the test.
The results indicate how effectively the products were at detecting and/or protecting
against those threats in real time.
2

Endpoint Security

Home Protection

Oct - Dec 2023

Management

Chief Executive Officer Simon Edwards
Chief Operations Officer Marc Briggs
Chief Human Resources Officer Magdalena Jurenko
Chief Technical Officer Stefan Dumitrascu

Testing Team

Nikki Albesa
Thomas Bean
Solandra Brewster
Gia Gorbold
Anila Johny
Erica Marotta
Luca Menegazzo
Jeremiah Morgan
Julian Owusu-Abrokwa
Joseph Pike
Georgios Sakatzidis
Dimitrios Tsarouchas
Stephen Withey

Publication and Marketing
Colin Mackleworth
Sara Claridge
Janice Sheridan

Contents
Introduction04
Executive Summary

05

1. Total Accuracy Ratings

06Home Endpoint Security Awards

07

2. Threat Responses

08

3. Protection Ratings

10

4. Protection Scores

12

5. Protection Details

13

6. Legitimate Software Ratings

14

6.1 Interaction Ratings 15

IT Support

6.2 Prevalence Ratings16

Danny King-Smith
Chris Short
Website selabs.uk
Email info@SELabs.uk
LinkedIn www.linkedin.com/company/se-labs/
Blog blog.selabs.uk
Post SE Labs Ltd,
55A High Street, Wimbledon, SW19 5BA, UK
SE Labs® is ISO/IEC 27001 : 2013 certified and
BS EN ISO 9001 : 2015 certified for The Provisionof IT Security Product Testing.
SE Labs is a member of the Microsoft Virus Initiative (MVI);
the Anti-Malware Testing Standards Organization (AMTSO);
the Association of anti Virus Asia Researchers (AVAR);
and NetSecOPEN.

6.3 Accuracy Ratings16
6.4 Distribution of Impact Categories17
7. Conclusions

17

Appendicies18
Appendix A: Terms Used18
Appendix B: FAQs18
Appendix C: Product Versions19
Appendix D: Attack Types20

Document version 1.0 Written 18th December 2023
1.01 Updated 8th January 2024 Corrected McAfee product’s name© 2023 SE Labs Ltd

3

Endpoint Security

Home Protection

Oct - Dec 2023

Introduction

Critical Endpoint Protection Evaluations
Realistic attacks for useful results
Endpoint protection is a critical component of any

scenarios that closely mimic the tactics, techniques, andorganisation's cybersecurity strategy. And if it's critical thenprocedures used by real-world cybercriminals. By doing so,

you should test it. And have others run assessments too.

we can determine how well the endpoint security solutions
perform in detecting and preventing these attacks.

Testing endpoint protection involves evaluating theeffectiveness of the security solutions that are deployed

At SE Labs, we are committed to helping organisations

on endpoint devices such as desktops, laptops andimprove their cybersecurity posture by providing

mobile devices. Endpoint protection testing is necessary

comprehensive and realistic endpoint protection

because endpoints are often the target of cyberattacks andtesting services. This report is the first step whencan be used as a gateway to gain access to sensitive data.

considering which products to use. For more in-depth

SE Labs has extensive experience in endpoint protection
testing, and we have found that it is essential to conduct

If you spot a detail in this report that you don’t understand,these tests regularly to ensure that the security vendors

or would like to discuss, please contact us. SE Labs uses

are keeping them up to date and effective. Our testing

current threat intelligence to make our tests as realistic

methodology involves replicating real-world cyberattack

as possible. To learn more about how we test, how wescenarios and evaluating how well the endpoint security

define ‘threat intelligence’ and how we use it to improve oursolutions perform in detecting, preventing, and mitigating

tests please visit our website and follow us on LinkedIn.

those attacks.
One of the key aspects of endpoint protection testing is
the use of realistic attack scenarios. Our team of experts
analyses the latest threat intelligence and creates attack4

testing, please get in touch for a more bespoke experience.

Endpoint Security

Home Protection

Oct - Dec 2023

Executive Summary
Product Names● The endpoints were generally effective at handling

It is good practice to stay up to date with the latest version of your chosen endpoint

general threats from cyber criminals …

security product. We made best efforts to ensure that each product tested was the very

All products were very capable of handling public email- andlatest version running with the most recent updates to give the best possible outcome.

web-based threats such as those used by criminals to attack
Windows PCs, tricking users into running malicious files or

For specific build numbers, see Appendix C: Product Versions on page 19.

running scripts that download and run malicious files.
● … but targeted attacks caused problems for some ofthe products.
Five of the nine products provided complete protection
against the targeted attacks used in this test. It only takes
one targeted attack to breach an organisation, so this isconcerning result.

Executive Summary

Products Tested

Protection
Accuracy
Rating (%)

Legitimate
Accuracy
Rating (%)

Total
Accuracy
Rating (%)

Avast Free Antivirus

100%

100%

100%

Kaspersky Plus

100%

100%

100%

Microsoft Defender Antivirus (consumer)

100%

100%

100%

NortonLifeLock Norton360

100%

100%

100%

Sophos Home Premium

98%

100%

99%

their ability to block malicious URLs, handle exploits andPanda Free Antivirus

97%

100%

99%

correctly classify legitimate application and websites.

McAfee Total Protection

96%

100%

99%

All products performed well enough to achieve AAA awards.

Webroot Antivirus

83%

100%

94%

Comodo Antivirus

78%

100%

92%

Products highlighted in green were the most accurate, scoring 85 per cent or more for Total Accuracy.
Those in yellow scored less than 85 but 75 or more. Products shown in red scored less than 75 per cent.

For exact percentages, see 1. Total Accuracy Ratings on page 6.

5Endpoint Security

Home Protection

Oct - Dec 2023

● False positives were not an issue for the products.

Most of the products were perfectly good at correctlyclassifying legitimate applications and websites.
● Which products were the most effective?

Products from Microsoft, Kaspersky, Norton and Avast
produced extremely good results due to a combination of

1. Total Accuracy Ratings
Judging the effectiveness of an endpoint security

Total Accuracy Ratings

product is a subtle art, and many factors are at play

Product

when assessing how well it performs. To make things

Total Accuracy Rating

Total Accuracy (%)

Awardeasier we’ve combined all the different results from thisKaspersky Plus

1,136

100%

AAA

report into one easy-to-understand graph.

Microsoft Defender Antivirus (consumer)

1,136

100%

AAA

NortonLifeLock Norton360

1,136

100%

AAA

product’s ability to detect and protect against threats,

Avast Free Antivirus

1,135

100%

AAA

but also its handling of non-malicious objects such as

Sophos Home Premium

1,129

99%

AAA

web addresses (URLs) and applications.

Panda Free Antivirus

1,122

99%

AAA

McAfee Total Protection

1,119

99%

AAA

equal. A product might completely block a URL, which

Webroot Antivirus

1,067

94%

AA

stops the threat before it can even start its intended

Comodo Antivirus

1,046

92%

AA

The graph below takes into account not only each

Not all protections, or detections for that matter, areseries of malicious events. Alternatively, the productmight allow a web-based exploit to execute but
prevent it from downloading any further code to thetarget. In another case malware might run on the target
for a short while before its behaviour is detected and its

Kaspersky Plus

code is deleted or moved to a safe ‘quarantine’ area for

Microsoft Defender Antivirus (consumer)

future analysis. We take these outcomes into accountwhen attributing points that form final ratings.

NortonLifeLock Norton360
Avast Free Antivirus

For example, a product that completely blocks a threat

Sophos Home Premiumis rated more highly than one that allows a threat to run
for a while before eventually evicting it. Products that

Panda Free Antivirus

allow all malware infections, or that block popular

McAfee Total Protection

legitimate applications, are penalised heavily.

Webroot Antivirus

Categorising how a product handles legitimate objects

Comodo Antivirus

is complex, and you can find out how we do it in
6. Legitimate Software Ratings on page 14.

6Endpoint Security

Home Protection

Oct - Dec 2023

0

284

568

852

1,136

Total Accuracy
Ratings combine
protection andfalse positives.

Home Endpoint Security Awards
The following products win SE Labs awards:

Oct - Dec 2023

ur

e

m

● NortonLifeLock Norton360

Ho● Microsoft Defender Antivirus (consumer)ity● Kaspersky Plus

ec
S
d
t
p
n
o
i
EP
ion
S
En

Protect● Avast Free Antivirus● Sophos Home Premium● Panda Free Antivirus● McAfee Total Protectionme

Oct - Dec 2023

ur

Ho

● Comodo Antivirus

ec
S
d
t
EP p o i n
ion
S
En

Protect

7

Endpoint Security

Home Protection

Oct - Dec 2023

ity

● Webroot Antivirus

2. Threat Responses
Full Attack Chain: Testing every layer of detection and protection
Attackers start from a certain point and don’t stop

website, and moving through many of the likely steps

If the test concludes before any ‘useful’ damage oruntil they have either achieved their goal or haveleading to actually stealing data or causing sometheft has been achieved, then similarly the productreached the end of their resources (which could

other form of damage to the network.

may be denied a chance to demonstrate its abilities
in behavioural detection and so on.

be a deadline or the limit of their abilities).
If the test starts too far into the attack chain, such as
This means, in a test, the tester needs to begin

executing malware on an endpoint, then many

Attack Stages

the attack from a realistic first position, such as

products will be denied opportunities to use the full

The illustration below shows some typical stages

sending a phishing email or setting up an infected

extent of their protection and detection abilities.

of an attack. In a test each of these should be

Attack Chain: How Hackers Progress
Figure 1. A typical attack starts with an
initial contact and progresses throughvarious stages, includingreconnaissance, stealing data andcausing damage.

01

Figure 2. This attack was initiallysuccessful but only able to progress
as far as the reconnaissance phase.

01

02

03

04

05

06

03

04

05

06

03

04

05

06

PDF

02
PDF

Figure 3. A more successful attack
manages to steal passwords butwholesale data theft and destruction
was blocked.

8

Endpoint Security

Home Protection

Oct - Dec 2023

01

02
PDF

attempted to determine the security solution’s

below. We broadly categorise these stages as:

systems to monitor for activities, slowly steal

effectiveness. This test’s results record detection

Access (step 2); Action (step 3); Escalation

information and other more subtle missions.

and protection for each of these stages.

(step 4); and Post-escalation (step 5).
In figure 3. the attacker has managed to

We measure how a product responds to the firstIn figure 1. you can see a typical attack running

progress as far as stage five. This means thatstages of the attack with a detection and/ orfrom start to end, through various ‘hacking’the system has been seriously compromised.

protection rating. Sometimes products allow

activities. This can be classified as a fully

The attacker has a high level of access and has

threats to run but detect them. Other times theysuccessful breach.

stolen passwords. However, attempts to exfiltrate
data from the target were blocked, as weremight allow the threat to run briefly before
neutralising it. Ideally they detect and block

In figure 2. a product or service has interfered

the threat before it has a chance to run. Productswith the attack, allowing it to succeed only as

may delete threats or automatically containfar as stage 3, after which it was detected and

The table below shows how a typical way

them in a ‘quarantine’ or other safe holding

neutralised. The attacker was unable to progressin which security testers illustrate attackers’

mechanism for later analysis.

through stages 4 and onwards.

behaviour. It is largely the same as our images

attempts to damage the system.

above, but more detailed.
Should the initial attack phase succeed we thenIt is possible that attackers will not cause

measure post-exploitation stages, which are

noticeable damage during an attack. It may

represented by steps two through to sevenbe that their goal is persistent presence on the

MITRE Example Attack Chain Details
Initial Access

Execution

Privilege Escalation

Spear Phishing via
ServiceCommand-Line Interface
PowerShell

Spear Phishing
Link

Credential AccessDiscovery

Collection

Command and Control

Input Capture

File and Directory
Discovery

Input Capture

Data Encoding

Process Discovery

Bypass UAC

Scripting

OS Credential Dumping

User Execution>/<
Spear Phishing Link

9

Endpoint Security

ScriptingHome Protection

Oct - Dec 2023

System Information
Discovery

Exfiltration

Exfiltration Over C2 Channel
Data from Local System

Data Obfuscation

C2********

Bypass UAC

OS Credential Dumping

Process Discovery

Data from Local System

Data Obfuscation

Exfiltration Over C2 Channel

3. Protection Ratings
The results below indicate how effectively thealerts the user, who may now take steps to securetarget system is successful this score is applied.

products dealt with threats. Points are earned

the system.

Examples of successful commands include listing
current running processes, exploring the file systemfor detecting the threat and for either blocking
or neutralising it.
Detected (+1)

Rating Calculations

and so on. If the first command is attempted andWe calculate the protection ratings using thethe session is terminated by the product without

following formula:

the command being successful the score of
Neutralised (see above) will be applied.

If the product detects the threat with any degreeof useful information, we award it one point.

Protection Rating =(1x number of Detected) +Blocked (+2)

Action (-1)(2x number of Blocked) +If the attacker is able to exfiltrate a document fromThreats that are disallowed from even starting their(1x number of Neutralised) +the target’s Desktop of the currently logged in user

malicious activities are blocked. Blocking products(1x number of Complete remediation) +then an ‘action’ has been successfully taken.

score two points.

(-5x number of Compromised)
Escalation (-2)

Complete Remediation (+1)

The ‘Complete remediation’ number relates to

The attacker attempts to escalate privileges to NT

If, in addition to neutralising a threat, the productcases of neutralisation in which all significant

Authority/System. If successful, an additional two

removes all significant traces of the attack, it

traces of the attack were removed from the target.

points are deducted.

gains an additional one point.
These ratings are based on our opinion of
Neutralised (+1)

how important these different outcomes are.

After escalation the attacker attempts actions

Products that kill all running malicious processes

You may have a different view on how seriouslythat rely on escalated privileges. These include‘neutralise’ the threat and win one point.

you treat a ‘Compromise’ or ‘Neutralisation without

attempting to steal credentials, modifying the filecomplete remediation’. If you want to create yoursystem and recording keystrokes. If any of theseown rating system, you can use the raw data fromactions are successful then a further penalty ofThis result occurs when a product continually

5. Protection Details on page 13 to roll your own

one point deduction is applied.

blocks a persistent threat from achieving its aim,

set of personalised ratings.

Persistent Neutralisation (-2)

while not removing it from the system.

Targeted Attack Scoring
Compromised (-5)

The following scores apply only to targeted attacks

If the threat compromises the system, theand are cumulative, ranging from -1 to -5.

product loses five points. This loss may be
reduced to four points if it manages to detect
the threat (see Detected, above), as this at least10

Post-Escalation Action (-1)

Endpoint Security

Home Protection

Oct - Dec 2023

Access (-1)
If any command that yields information about theEnterprise Security
Testing Services
for CISOs

Protection Accuracy
Product

Protection Accuracy

Protection Accuracy (%)

Kaspersky Plus

400

100%

Microsoft Defender Antivirus (consumer)

400

100%

NortonLifeLock Norton360

400

100%

Avast Free Antivirus

399

100%

Sophos Home Premium

393

98%

Panda Free Antivirus

386

97%

McAfee Total Protection

383

96%

Webroot Antivirus

331

83%

Comodo Antivirus

310

78%

Elevate your cyber security
strategy with SE Labs, theworld’s leading security
testing organisation.

Average 95%

SE Labs works with largeorganisations to support CISOs andtheir security teams:
 Validate existing combination of
security products and services.
 Provide expert partnership whenchoosing and deploying new
security technologies.

Kaspersky Plus
Microsoft Defender Antivirus (consumer)
NortonLifeLock Norton360
Avast Free Antivirus
Sophos Home Premium
Panda Free Antivirus
McAfee Total Protection
Webroot Antivirus
Comodo Antivirus
0

11

Endpoint Security

100

Home Protection200

Oct - Dec 2023

300

400

Protection Ratings
are weighted toshow that how
products handle
threats can be
subtler than just‘win’ or ‘lose’.

SE Labs provides in-depth
evaluations of the cyber security
that you are considering, tailored tothe exact, unique requirements ofyour business.

For an honest, objective andwell-informed view of the cybersecurity industry contact us now at

selabs.uk/contact

4. Protection ScoresThis graph shows the overall level of protection,

Protection Scoresmaking no distinction between neutralised andProduct

blocked incidents.

Protection Score

Avast Free Antivirus

100

For each product we add Blocked and Neutralised

Kaspersky Plus

100

cases together to make one simple tally.

Microsoft Defender Antivirus (consumer)

100

NortonLifeLock Norton360

100

Sophos Home Premium

100

McAfee Total Protection

98

Panda Free Antivirus

98

Comodo Antivirus

94

Webroot Antivirus

90

Avast Free Antivirus
Kaspersky Plus
Microsoft Defender Antivirus (consumer)
NortonLifeLock Norton360
Sophos Home Premium
McAfee Total Protection
Panda Free Antivirus
Comodo Antivirus
Webroot Antivirus
012

Endpoint Security

Home Protection

Oct - Dec 2023

25

50

75

100

Protection Scores
are a simple countof how many times
a product protected
the system.

5. Protection Details
These results break down how each productProtection Details

handled threats into some detail. You can see

Product

Detected

BlockedNeutralised

Compromised

Protected

Avast Free Antivirus

100

100

0

0

100

Kaspersky Plus

100

100

0

0

100

Products sometimes detect more threats than

Microsoft Defender Antivirus (consumer)

100

100

0

0

100

they protect against. This can happen when

NortonLifeLock Norton360

100

100

0

0

100

Sophos Home Premium

100

99

1

0

100

McAfee Total Protection

98

98

0

2

98

certain threats. Some threats abort on

Panda Free Antivirus

98

98

0

2

98

detecting specific endpoint protection software.

Comodo Antivirus

100

94

0

6

94

Webroot Antivirus

98

89

1

10

90

how many detected a threat and the levels ofprotection provided.

they recognise an element of the threat but
aren’t equipped to stop it. Products can also
provide protection even if they don’t detect

BlockedAvast Free Antivirus

Neutralised

Kaspersky Plus

Compromised

Microsoft Defender Antivirus (consumer)
NortonLifeLock Norton360
Sophos Home Premium
McAfee Total Protection
Panda Free Antivirus
Comodo Antivirus
Webroot Antivirus
013

Endpoint Security

Home Protection

Oct - Dec 2023

25

50

75

100

This data showsin detail how eachproduct handled
the threats used.

6. Legitimate Software
Ratings
These ratings indicate how accurately the products

Legitimate Software Ratingsclassify legitimate applications and URLs, while

Product

also taking into account the interactions that each

Legitimate Accuracy Rating

Legitimate Accuracy (%)

product has with the user. Ideally a product will

Avast Free Antivirus

736

100%

either not classify a legitimate object or will classify

Comodo Antivirus

736

100%

it as safe. In neither case should it bother the user.

Kaspersky Plus

736

100%

McAfee Total Protection

736

100%

Microsoft Defender Antivirus (consumer)

736

100%

in this part of the test, applying stricter penalties for

NortonLifeLock Norton360

736

100%

when products misclassify very popular software

Panda Free Antivirus

736

100%

and sites.

Sophos Home Premium

736

100%

Webroot Antivirus

736

100%

We also take into account the prevalence(popularity) of the applications and websites used

To understand how we calculate these ratings,
see 6.3 Accuracy Ratings on page 16.

Avast Free Antivirus
Comodo Antivirus
Kaspersky Plus
McAfee Total Protection
Microsoft Defender Antivirus (consumer)
NortonLifeLock Norton360
Panda Free Antivirus
Sophos Home Premium
Webroot Antivirus
0

14

Endpoint Security

Home Protection

Oct - Dec 2023

184

368

552

736

Legitimate Software
Ratings can indicate
how well a vendor
has tuned its
detection engine.

6.1 Interaction Ratings
It’s crucial that anti-malware endpoint products

None(allowed)

Click to Allow(default allow)

Click to Allow/Block(no recommendation)

Object is Safe

2

1.5

1

Object is Unknown

2

1

0.5

0

-0.5

B

Object is not Classified

2

0.5

0

-0.5

-1

C

Object is Suspicious

0.5

0

-0.5

-1

-1.5

D

to be classified as ‘malware’. More often it will be

Object is Unwanted

0

-0.5

-1

-1.5

-2

E

classified as ‘unknown’, ‘suspicious’ or ‘unwanted’

Object is Malicious

-2

-2

F

4

5

not only stop – or at least detect – threats, but thatthey allow legitimate applications to install and run
without misclassifying them as malware. Such anerror is known as a ‘false positive’ (FP).
In reality, genuine FPs are quite rare in testing. In our
experience it is unusual for a legitimate application(or terms that mean much the same thing).

1

2

3

Click to Block(default block)None(blocked)A

We use a subtle system of rating an endpoint’s
approach to legitimate objects, which takes into
account how it classifies the application and how
it presents that information to the user. Sometimes
the endpoint software will pass the buck andInteraction Ratings

demand that the user decide if the application issafe or not. In such cases the product may make a
recommendation to allow or block. In other cases,

Avast Free Antivirus

100

Comodo Antivirus

100

Kaspersky Plus

100

If a product allows an application to install and

McAfee Total Protection

100

run with no user interaction, or with simply a brief

Microsoft Defender Antivirus (consumer)100

notification that the application is likely to be safe,

NortonLifeLock Norton360

100

it has achieved an optimum result. Anything else

Panda Free Antivirus

100

Sophos Home Premium

100

Webroot Antivirus

100

the product will make no recommendation, whichis possibly even less helpful.

is a Non-Optimal Classification/Action (NOCA).
We think that measuring NOCAs is more usefulthan counting the rarer FPs.

15

None
(allowed)

Product

Endpoint Security

Home Protection

Oct - Dec 2023

Products that do not botherusers and classify mostapplications correctly earnmore points than those thatask questions and condemn
legitimate applications.

6.2 Prevalence Ratings
There is a significant difference between an
endpoint product blocking a popular application

6.3 Accuracy Ratings
Legitimate Software Prevalence Rating Modifiers

such as the latest version of Microsoft Word andImpact Category

Rating Modifiercondemning a rare Iranian dating toolbar for

Very High Impact

5Internet Explorer 6. One is very popular all over theHigh Impact

4

Medium Impact

3

Low Impact

2

Very Low Impact

1world and its detection as malware (or something
less serious but still suspicious) is a big deal.
Conversely, the outdated toolbar won’t have had
a comparably large user base even when it was new.
Detecting this application as malware may be

We calculate legitimate software accuracy
ratings by multiplying together the interaction
and prevalence ratings for each download
and installation:
Accuracy rating = Interaction rating x Prevalence
ratingIf a product allowed one legitimate, Medium impact
application to install with zero interaction with thewrong, but it is less impactful in the overall scheme

Applications were downloaded and installed

user, then its Accuracy rating would be calculatedof things.

during the test, but third-party download sites

like this:were avoided and original developers’ URLs
were used where possible. Download sites will

varying popularity and sorted them into fivesometimes bundle additional components into

separate categories, as follows:

applications’ install files, which may correctly

This same calculation is made for each legitimate

cause anti-malware products to flag adware.

application/site in the test and the results are

1. Very High Impact

We remove adware from the test set because it

summed and used to populate the graph and table

2. High Impact

is often unclear how desirable this type of code is.

shown under 6. Legitimate Software Ratings on

3. Medium Impact

page 14.

4. Low Impact

The prevalence for each application and URL is

5. Very Low Impact

estimated using metrics such as third-party
download sites and the data from Tranco.com’s

Incorrectly handling any legitimate application will
invoke penalties, but classifying Microsoft Word as
malware and blocking it without any way for theuser to override this will bring far greater penalties
than doing the same for an ancient niche toolbar.
In order to calculate these relative penalties, weassigned each impact category with a rating
modifier, as shown in the table above.

16

Accuracy rating = 2 x 3 = 6

With this in mind, we collected applications ofEndpoint Security

Home Protection

Oct - Dec 2023

global traffic ranking system.

7. Conclusions

6.4 Distribution of
Impact Categories

Attacks in this test included threats that affect the

Indeed, Sophos Home Premium was able to neutralise

Endpoint products that were most accurate inwider public and more closely targeted individuals

the single threat that it did not block outright.

handling legitimate objects achieved the highest

and organisations. You could say that we tested the

Panda Free Antivirus and McAfee Total Protection only

ratings. If all objects were of the highest prevalence,

products with ‘public’ malware and full-on

missed two targeted attacks each. Comodo Antivirus

the maximum possible rating would be 1,000 (100hacking attacks.

detected all of the targeted threats but did

incidents x (2 interaction rating x 5 prevalence
rating)).

not block six of them. Webroot Antivirus neutralised
We introduced the threats in a realistic way such that

one threat but was compromised by ten.

threats seen in the wild on websites were downloaded

In this test there was a range of applications withfrom those same websites, while threat caught

All the products handled legitimate applications anddifferent levels of prevalence. The table below

spreading through email were delivered to our target

websites correctly, with no mistakes. The installationshows the frequency:

systems as emails.

and execution of legitimate applications were allowed,
with no ambiguous warnings.

Legitimate Software Category Frequency

All of the products tested are well-known and should

Prevalence Rating

Frequency

do well in this test. While we do ‘create’ threats by

Almost all the products in this test win AAA awards.

Very High Impact

32

using publicly available free hacking tools, we do not

The strongest, from Norton, Microsoft, Kaspersky

High Impact

32

write unique malware so there is no technical reason

and Avast stopped all threats and allowed all

why any vendor being tested should do poorly.

legitimate applications. Also outstanding were

Medium Impact

16

Low Impact

12

The results were generally strong, particularly inpercentage point shy of a perfect total accuracy score.

Very Low Impact

8

the way that the products handled public threats.

Webroot and Comodo received total ratings of 94%

These are threats that are live on the Internet on theand 92% respectively, making them AA awardees.

Sophos, Panda and McAfee which were only a single

day that the products are tested. Excellent resultsfrom all the products indicate both familiarity with
common threats and frequent updates to keep
databases current.
Four of the nine products stopped all of the attacks,
including those that are targeted. Targeted attacks
are usually more of a challenge because they are notwidely known. The products that achieved 100%
Protection Accuracy Ratings belonged to Norton,
Microsoft, Kaspersky and Avast. The products from
Sophos, Panda and McAfee came in strongly behind,each missing only one or two targeted attacks.

17

Endpoint Security

Home Protection

Oct - Dec 2023

Appendices
Appendix A: Terms Used

Appendix B: FAQs
A full methodology for this test is available from our website.

Term

Meaning

Compromised

The attack succeeded, resulting in malware running
unhindered on the target. In the case of a targeted attack,the attacker was able to take remote control of thesystem and carry out a variety of tasks without hindrance.

● The products chosen for this test were selected by SE Labs.

BlockedThe attack was prevented from making any changes tothe target.

False positive

When a security product misclassifies a legitimate
application or website as being malicious, it generates a‘false positive’.

Neutralised

The exploit or malware payload ran on the target but was
subsequently removed.

Complete
Remediation

If a security product removes all significant traces of an
attack, it has achieved complete remediation.

Target

The test system that is protected by a security product.

ThreatA program or sequence of interactions with the target
that is designed to take some level of unauthorised
control of that target.

UpdateSecurity vendors provide information to their products inan effort to keep abreast of the latest threats. These
updates may be downloaded in bulk as one or more files,
or requested individually and live over the internet.

● The test was unsponsored.
● The test was conducted between 19th September and 21st November 2023.
● All products were configured according to each vendor’s recommendations,when such recommendations were provided.
● Malicious URLs and legitimate applications and URLs were independently

located and verified by SE Labs.
● Targeted attacks were selected and verified by SE Labs.
● Malicious and legitimate data was provided to partner organisations once

the test was complete.
● The web browser used in this test was Google Chrome. When testing Microsoft

products Chrome was equipped with the Windows Defender Browser Protection
browser extension (https://browserprotection.microsoft.com). We allow otherbrowser extensions when a tested product requests a user install one or more.

Q
A

What is a partner organisation? Can I become one to gain access to thethreat data used in your tests?
Partner organisations benefit from our consultancy services after a test has
been run. Partners may gain access to low-level data that can be useful inproduct improvement initiatives and have permission to use award logos, whereappropriate, for marketing purposes. We do not share data on one partner with otherpartners. We do not partner with organisations that do not engage in our testing.

Q
A

I am a security vendor and you tested my product without permission.
May I access the threat data to verify that your results are accurate?
We are willing to share a certain level of test data with non-partner participants
for free. The intention is to provide sufficient data to demonstrate that theresults are accurate. For more in-depth data suitable for product improvement
purposes we recommend becoming a partner.

18

Endpoint Security

Home Protection

Oct - Dec 2023

Appendix C: Product Versions
The table below shows the service’s name as it was being marketed at the time of the test.
Product Versions

19

VendorProduct

Build Version (start)

Build Version (end)

Avast

Free Antivirus

Program Version: 23.8.6078 (build 23.8.8416.762)
Virus Definitions Version: 230831-0
UI Version: 1.0.774

Program Version: 23.8.6078 (build 23.8.8416.794)
Virus Definitions Version: 231123-12
UI Version: 1.0.788

ComodoAntivirus

Product Version: 12.2.2.8012

Product Version: 12.2.2.8012

Kaspersky

Plus

21.14.5.462

21.15.8.493

McAfeeTotal Protection

McAfee Total Protection Version: 1.10.231
Antivirus Version: 1519.0
Secure VPN Version: 1.10
Tracker Remover Version: 1.10
Shredder Version: 1.10
Advanced Firewall Version: 1.10

McAfee Total Protection Version: 1.11.279
Antivirus Version: 1604.0
Secure VPN Version: 1.11
Tracker Remover Version: 1.11
Shredder Version: 1.11
Advanced Firewall Version: 1.11

Microsoft

Defender Antivirus (consumer)

Antimalware Client Version: 4.18.23080.2006
Engine Version: 1.1.23080.2005
Antivirus Version: 1.397.89.0
Anti-spyware Version: 1.397.89.0

Antimalware Client Version: 4.18.23100.2009
Engine Version: 1.1.23100.2009
Antivirus Version: 1.401.1093.0
Anti-spyware Version: 1.401.1093.0

NortonLifeLock

Norton360

22.23.6.5

22.23.10.10

Panda

Free Antivirus

22.00.01

22.00.01

SophosHome Premium

4.3.1.2

4.3.1.2

Webroot

Antivirus

9.0.34.54

9.0.34.54

Endpoint Security

Home Protection

Oct - Dec 2023

Appendix D: Attack Types
The table below shows how each product protected against the different types of attacks used in the test.
Attack Types
Product

20

General Attack

Targeted Attack

Protected (%)

Avast Free Antivirus

75

25

100%

Kaspersky Plus

75

25

100%

Microsoft Defender Antivirus (consumer)

75

25

100%

NortonLifeLock Norton360

75

25

100%

Sophos Home Premium

75

25

100%

McAfee Total Protection

75

23

96%

Panda Free Antivirus

75

23

96%

Comodo Antivirus

75

19

88%

Webroot Antivirus

75

15

80%

Endpoint Security

Home Protection

Oct - Dec 2023

Understand cybersecurity andother security issues. Practical andinsightful, our experts have experiencein attacking and defending in thephysical and digital worlds.
Peek behind the curtain with the
Cyber Security DE:CODED podcast.

SE Labs Report Disclaimer
1.	The information contained in this report issubject to change and revision by SE Labs
without notice.
2.	SE Labs is under no obligation to update
this report at any time.
3.	SE Labs believes that the information
contained within this report is accurate andreliable at the time of its publication, which
can be found at the bottom of the contents
page, but SE Labs does not guarantee thisin any way.
4. All use of and any reliance on this report, or
any information contained within thisreport, is solely at your own risk. SE Labs
shall not be liable or responsible for any
loss of profit (whether incurred directly
or indirectly), any loss of goodwill orbusiness reputation, any loss of data
suffered, pure economic loss, cost of
procurement of substitute goods orservices, or other intangible loss, or any
indirect, incidental, special or consequential
loss, costs, damages, charges or expenses
or exemplary damages arising his report inany way whatsoever.
5. The contents of this report does notconstitute a recommendation, guarantee,
endorsement or otherwise of any of the
products listed, mentioned or tested.
6.	The testing and subsequent results do notguarantee that there are no errors in the
products, or that you will achieve the sameor similar results. SE Labs does notguarantee in any way that the products willmeet your expectations, requirements,
specifications or needs.
7.	Any trade marks, trade names, logos orimages used in this report are the trade
marks, trade names, logos or images of
their respective owners.
8. The contents of this report are provided onan “AS IS” basis and accordingly SE Labs
does not make any express or implied
warranty or representation concerning its
accuracy or completeness.