For raw performance against malicious software, we use data from multiple testing houses: AV-Test, SE Labs and AV-Comparatives. Of these tests, we prioritise ‘real-world’ performance, in which antivirus detection engines are exposed to live threats.  We also draw on system performance data captured by AV-Test and we inventory and compare features on an application-by-application basis, highlighting both useful tools and unexpected sticking points in the workflow and interfaces.