AV-Comparatives APT Detection Coverage Test 2026

Disclaimer
  1. This test shows how an antivirus behaves with certain threats, in a specific environment and under certain conditions.
    We encourage you to compare these results with others and take informed decisions on what security products to use.
    Before buying an antivirus you should consider factors such as price, ease of use, compatibility, and support. Installing a free trial version allows an antivirus to be tested in everyday use before purchase.

Important disclaimer: this is one specific test, made on a specific lab, to test a specific scenario. Take it with a grain of salt. Do not ditch your current antivirus if it suits you and works well, just to switch for an antivirus that performed slightly better on this datasheet.
 
In a way, that is what I was thinking. Are some going to jump ship from what they were using because of the information, including Panda for a home user, which has had sub par, if not below par reviews in the past?
What makes me think of Panda is that some members, like @oldschool and @TairikuOkami, thought it was good.
 
Scored great for "on-execution"! I need some explanation 🤨
Comparing to other solutions it did not perform that great. Their online execution detection rate of original file was second lowest, although it was 99.91%. Most vendors scored 100%.
With modified files it performed better and it took 4th place.
 
And I guess no one really had any thoughts regarding Avira, in this test?
It performed great IMO. I also like that it's not too dependent on cloud, but cloud still improves it's detection rate - similar as Kaspersky.

1773937419978.png
 
Something is not right with the testing. They are also using very old samples which are irrelevant at present. The AV's who dropped the signatures for the old ones will surely miss it.
how else would you test a solution against an unknown APT? If I want to know that my soultion K will prevent any future event Y how would I go about it? You do it the same way you develop new vaccines. You take the known component, strip out the malicious part but leave the surface proteins intact. Then you watch if an immune system mounts a defense against it and which parts of the immune system mount the defense against it. If the protein goes through unaffected then your test failed and your immune system won't protect you against this specific strain of the virus. However let say the protein bypasses your innate barrier (skin / firewall) and enters the organism (network), there it bypasses macrophages and neutrophils and it goes unnoticed (first layer of the defense at depth), then it moves on adaptive response (heuristics / AI / ML whatever new shiny term exists) here T cells, Antigens and B cells take over analyzing the protein and it's payload. If the adaptive immune system discovers that the payload is malicious then it's destroyed else the payload proceeds down the line.

As is during this test. You take known payload that's unknown to the solution and introduce it. You know how the payload will work, you have seen it in action so you just wait and see if it deploys. If the payload deploys without any of the fancy defense at depth picking it up then you are done for, no need to test against some new fancy unknown payload since this one failed. As with everything, you can only test what you know, you can't test a solution against an unknown method of infection else you would have already mitigated it.


edit: after reading through the thread

I agree that the method of infection is extremely imortant hence the defense at depth. However, I do like the fact that it was tested that way; this test basically shows what would happen if you had insider threat...will your soultuion protect you. But that's goes more towards vetting your employees than anything else.

The age of samples yes, that's an issue and yes many vendors unhook themselves from the old methods in order to stay ahead of the new ones, however this openes up a vulnerbility.....it allows the threat actors to start exploring old attack vectors.
 
Last edited:
In a way, that is what I was thinking. Are some going to jump ship from what they were using because of the information, including Panda for a home user, which has had sub par, if not below par reviews in the past?
If I were a corporation I would consider this data point and await more data. One point does not solution make.

If I were a home users I wouldn't care, those methods are not used against home users unless you are being spearfished and by then you have more things to worry about than your antivirus solution. I would assume that APT actors would go to great lengths to prevent their tools from infecting home users; why expose your toolkit to a broader audience from which you don't want anything?
 
What makes me think of Panda is that some members, like @oldschool and @TairikuOkami, thought it was good.
We have said this in a certain context: it's good in that it's light weight, like having no AV at all. ;) Which is why @TairikuOkami has used it in the past when he didn't uninstall MS Defender.

OTOH, Panda is probably fine for regular users if they're not happy clickers. Even better it they enable SAC.

Some (many?) forum members would never touch it as they prefer layered, overkill security.
 
Once again, Kaspersky and ESET have shown why they’re so highly regarded in our forum. Many people choose Kaspersky for personal or corporate use, even if they don’t openly discuss it here, as some members have pointed out Outside the United States, it remains a top option and often the first logical choice for both personal and corporate needs. As for ESET, it continues to win people over simply by working well, delivering strong performance and reliable detection. Both have proven why the pros trust them.

the K is actually the you know who of this forum :) people use it but do not mention it.
 
Once again, Kaspersky and ESET have shown why they’re so highly regarded in our forum. Many people choose Kaspersky for personal or corporate use, even if they don’t openly discuss it here, as some members have pointed out Outside the United States, it remains a top option and often the first logical choice for both personal and corporate needs. As for ESET, it continues to win people over simply by working well, delivering strong performance and reliable detection. Both have proven why the pros trust them.

the K is actually the you know who of this forum :) people use it but do not mention it.
I agree with your first paragraph :) but, is it a bit of a sad commentary that members here wouldn't mention what they use, i.e. Kaspersky? or anything other than **** AV for concern of being questioned, called out for using it? Fortunately, most of the members here get it, of what we, they, use and why :)
 
Last edited:
I agree with your first paragraph :) but, is it a bit of a sad commentary that members here wouldn't mention what they use, i.e. Kaspersky? or anything other than **** AV for concern of being questioned, called out for using it? Fortunately, most of the members here get it, of what we, they, use and why :)
I went back to K. :) It suits me best. It’s a fateful love, and I can’t get rid of it. ;)
 
I don't understand why the hashes were given to everybody. That's just asking for the participants to fake it.

Anyways, one can't detect APTs with hashes unless the APT is extremely lazy and re-use stuff without improving it.

I would have more faith in their detections if they don't weigh it with multiple factors. For example, lets say mshta is not used in the company, so just one touch of mshta should get you whacked. But AVs have to be so careful and consider multiple indicators lest they quarantine the wrong thing. I am waiting for the day that AV's' would let you pick out things not in use by the company so they can do the job confidently.
 
Last edited:
We have said this in a certain context: it's good in that it's light weight, like having no AV at all. ;) Which is why @TairikuOkami has used it in the past when he didn't uninstall MS Defender.
+1 I also like Panda because it’s a super lightweight antivirus, followed by Webroot. It’s a shame it isn’t very effective. If I had no other choice, I’d use Panda. But since there are other, more robust products on the market to choose from, I decided to go with a different one. :)
 
According to the table in the report, a few hundred samples were tested in the last phase (file execution), and this phase is crucial for protection in the wild. The statistical error for this sample size (modified samples) is roughly a few samples per a few hundred total samples (0.5% - 1%). So, all AVs that scored above 99.5% should probably be counted as equally effective in this test.
Only a few AVs scored significantly worse: Quick Heal, Sophos, Trend Micro, and Dr. Web.
Two AVs (K7 and McAfee) got inconclusive results.

Post updated and corrected. The last table with hashes has probably some errors. It gives information inconsistent with the scoring table.
 
Last edited:

You may also like...