Serious Discussion F-Secure Antivirus – Solid Finnish Security or Overhyped and Overpriced?

[bazang]

YouTube can be the worst for this type of dramatic presentation.

This is why Wilders banned security software testing and videos long ago. The owner believes that such testing is highly flawed and misleading. Plus he never wanted the whole "What is best AV?" debate there.

A person can do better than any AV simply by uploading malware to multiple analysis sandboxes such as any.run and Hybrid Analysis and then studying the results. But of course that's too much because the person doing it has to understand what they are reading. My response to that is that it is trivial nowadays to obtain explanations for free online. It just takes putting in the time.

Anyways, due to a bunch of reasons, targeted testing of behavior blockers that produces reliable findings is very difficult. For one, a BB cannot be tested if the vendor does not reveal its coverage (scope), how it works, and expected behaviors for in-scope scenarios and testing.

A lot of BB is marketing and media hype. What the BB actually is are the cobbling-together of features that are already present within a security software, adding a couple of additional features, and then marketing the entire bucket of goods under the terminology "Behavior Blocker."

Emsisoft's behavior blocker is one of the few that can be tested with other features off in a way that one observes the heavy limitations of a behavior blocker in isolation. Alone, it does not block a lot of actions because it is not capable of doing so. However, when combined with real-time protections enabled then the overall software protection layers do well.

 

[Divergent]

Vendors often take several distinct, unrelated technologies, like AMSI (Script Scanning), ETW (Event Tracing), and Exploit Protection, and bundle them all under the single flashy name "Behavior Blocker." Marketing implies there is a single, smart "Brain" inside the antivirus that understands all malware behavior. It is often just a collection of independent sensors. If a vendor says "Our Behavior Blocker stopped this," they might actually mean "Our script scanner caught a PowerShell command," which is very different from analyzing a program's behavior in real-time.

Because vendors rarely document exactly what their Behavior Blocker covers (e.g., "Does it monitor registry changes? Does it watch memory injection?"), users cannot know what they are actually buying. This lack of transparency allows vendors to claim their "Behavior Blocker" is superior without providing any way to prove it, turning the feature into a marketing buzzword rather than a verifiable security layer.

True Behavior Blockers do exist. While bazang is correct that the term is often abused by marketing, the actual technology, Dynamic Heuristic Analysis, is real, distinct from signature scanning, and available in specific products.

What Defines a "True" Behavior Blocker?

A "true" behavior blocker does not care who made the file, what the file is named, or if it has been seen before. It cares only about Actions and Sequences.

Fake/Marketing BB. Blocks a file because the cloud says "This hash is bad" but calls it "Behavioral Detection" because it happened during execution.

True BB. Blocks a file because it observed a specific sequence of API calls.

Opened a connection to the internet.

Downloaded an encrypted string.

Attempted to inject code into explorer.exe.

The Verdict, "I don't know what this file is, but no legitimate calculator app injects code into Windows Explorer. BLOCK."

While almost every modern AV has some behavioral rules, a few are recognized for having distinct, heavy-duty behavioral engines that function even if you cut the internet cord (proving they aren't just cloud lookups)

Emsisoft

As bazang noted, Emsisoft is unique because its Behavior Blocker is a distinct module. It is famous for its "alert" style, giving power users the choice to allow or block specific actions (like a program installing a global hook).

Kaspersky (System Watcher)

One of the most advanced "true" BBs. It maintains a rolling log of system changes. If a program starts encrypting files (Ransomware behavior), System Watcher doesn't just kill the process,it uses that log to roll back the encrypted files to their previous state.

Bitdefender (Advanced Threat Defense / ATC)

Uses a "scoring" system. It doesn't just look for one bad action; it watches a process over time. If a process does 5 "suspicious but okay" things in a row, the score tips over the threshold, and it is killed.

Why They Are Rare (The False Positive Trap)

If "True" Behavior Blockers are so good, why doesn't everyone use only them?

The Noise. Legitimate software often acts like malware. Game Anti-Cheat drivers inject code into game processes (looks like a trojan). Software Installers drop files and modify the registry (looks like a dropper). Backup Tools read thousands of files rapidly (looks like ransomware).

A "True" Behavior Blocker is paranoid. Without the "Cloud" or "Allow-lists" to tell it, "Relax, that's just Steam," it would block half the software on your computer. This is why vendors "water down" the BB with cloud whitelists,to keep it usable for the average human.

 

[Trident]

It’s all tangled and interwinded, usually through decision matrixes, lambda calculations and so on.

Different engines provide verdict before execution and then finally, one sequence of operations is the trigger.

Some behavioural blocks are purely the result of command line or connection analysis.

Most of the behavioural blockers are policy based, the antivirus will hook a bunch of API calls and potentially memory operations (those that have kernel monitoring too). Usually a universal translator layer operates grouping a sequence of API calls into one single intent and a policy contains several intents.

 

[Jonny Quest]

Some of the posts on the previous page and all the ones on this page should be included in a thread, "Understating, the truth about Behavior Blockers"?
I'd start it, but wouldn't be able to answer a challenge post like some of you could. But, a lot of those possible challenges have been answered in some of the posts.

 

[Trident]

The Verdict, "I don't know what this file is, but no legitimate calculator app injects code into Windows Explorer. BLOCK."

This sounds miraculous and marvellous but in real world it is not that straight forward. Yes, surely the built in Windows Calc is easy to identify. But user downloads Sybrandura Calculator (on the web page), the file is named SybCalc.exe

How will the behavioural blocker know this is “a calculator”?
It can look for visible window, there could be a window, not necessarily a calculator though. Could be an installer with a “Next” button.
It could look at the metadata, the metadata may be missing or it may be saying Best Windows Optimiser.

So, I hope this helps to illustrate the challenge with “calculator doesn’t need to inject code”.
Whilst it is technically true, the reality is very different.

 

[Trident]

That’s again all technically correct, but the hard truth is that most of the code injection is not performed by 30 kb C++ binaries, it is performed typically by injectors which use syscalls and bypass the hook. Also, it is most often performed by processes which are associated with JIT and it is expected for these processes to have code not backed up by disk.

 

[LinuxFan58]

In the Netherlands F-secure is branded as Ziggo and offered free (one license per household). I understand that F-secure most important business income is targeting ISPs with white label Antivirus. Maybe F-secure was better in the past, but for most people this freebie offers premium features like Avira engine with BullGaurd behavior blocker and Gen Digital fed reputation scoring. IMO people should not complain about something when it is offered (seemingly) free. The saying in Dutch is the same as in English ""don't look a gift horse in the mouth". Not a true BB? So what?

 

[Trident]

In the Netherlands F-secure is branded as Ziggo and offered free (one license per household). I understand that F-secure most important business income is targeting ISPs. Maybe F-secure was better in the past, but for most people this freebie offers premium features like Avira engine with BullGaurd behavior blocker and Gen Digital fed reputation scoring. IMO people should not complain about something when it is offered (seemingly) free. The saying in Dutch is the same as in English ""don't look a gift horse in the mouth". Not a true BB? So what?

That’s true as well, but there is hardly free lunch anywhere in life, so the “freebie” is included in the price of the service

Virgin Media in the UK also heavily pushes F-Secure, whilst BT/EE rely on Norton/Gen Digital and some other providers rely on McAfee. Norton appears to be most aggressive with these partnerships.

F-Secure is not “bad”. The limitations discussed above apply not only to F-Secure, they apply to the entire industry.

 

[LinuxFan58]

That’s true as well, but there is hardly free lunch anywhere in life, so the “freebie” is included in the price of the service

Norton appears to be most aggressive with these partnerships.

F-Secure is not “bad”. The limitations discussed above apply not only to F-Secure, they apply to the entire industry.Ag

Agree hence the (seemingly) free annotation. Norton being aggressive in this markt is interesting because F-Secure relies on Gen Digital technology. So either Gen Digital takes all egs (when Norton wins the contract), half an egg (when F-secure wins the contract) or empty shell (when McFee wins the contract). Saying does not translate wel, but allowing their (Gen Digital) technology to be white labelled raises their win chance from 33% to 50% interesting move.

 

[Jonny Quest]

View attachment 294227

That’s true as well, but there is hardly free lunch anywhere in life, so the “freebie” is included in the price of the service

Virgin Media in the UK also heavily pushes F-Secure, whilst BT/EE rely on Norton/Gen Digital and some other providers rely on McAfee. Norton appears to be most aggressive with these partnerships.

Exactly, it's not free if you're paying for the service, in my case Spectrum internet that offers its rebranded version of F-Secure. I would still need to confirm all the updates and build numbers are the same compared to the paid version. I would have to wait until May when my Total expires and get a single I.S. subscription to compare, as that's what Spectrum is providing.

But for the average user, I'm sure it's good enough. Spectrum (and the other ISP providers) isn't looking to hitch their wagon with a AV that is going to give them more grief (support calls) than it's worth for them to promote that feature as an option for their internet. They've been using F-Secure since around 2011 if not earlier, so if it wasn't doing it's job, I'm sure they would have moved on to another vendor, like McAfee?

 

[Divergent]

That’s again all technically correct, but the hard truth is that most of the code injection is not performed by 30 kb C++ binaries, it is performed typically by injectors which use syscalls and bypass the hook. Also, it is most often performed by processes which are associated with JIT and it is expected for these processes to have code not backed up by disk.

@Trident I think we need to stop splitting hairs here. You are focusing entirely on the Exceptions to try and disprove the Rule.

You are effectively arguing that because advanced evasion techniques (Syscalls, JIT, Memory Hollowing) exist, my definition of a "True Behavior Blocker" is invalid. That is a logical fallacy.

I defined the Mechanism. A system that judges API sequences rather than file reputation.

You are defining the Failure State. That this mechanism can be bypassed by kernel-level evasion.

Both are true, but your point doesn't invalidate mine. By your logic, "Antivirus" doesn't exist because encrypted payloads bypass signatures. By your logic, "Firewalls" don't exist because tunneling encapsulates traffic.

The reality is simple. A "True Behavior Blocker" (Dynamic Heuristic Analysis) exists. It analyzes sequences. Does it have blind spots? Yes. (As you correctly noted with Syscalls). Does that mean the technology is a "myth" or "marketing"? No.

It just means the technology isn't magic. Let’s agree that the methodology exists, even if the efficacy isn't 100% against advanced threats.

 

[Trident]

Agree hence the (seemingly) free annotation. Norton being aggressive in this markt is interesting because F-Secure relies on Gen Digital technology. So either Gen Digital takes all egs (when Norton wins the contract), half an egg (when F-secure wins the contract) or empty shell (when McFee wins the contract). Saying does not translate wel, but allowing their (Gen Digital) technology to be white labelled raises their win chance from 33% to 50% interesting move.

Yes, Avira offers everything from full stack (white label) to an engine that is still doing a good job, cloud detonation, mobile SDKs, behavioural blocking and so on. Avira itself does not compete with its OEM partners, but it is part of the Gen Digital behemoth which destroys competition.

Either way, Gen Digital wins.

In the cases when partners go for Sophos, Bitdefender or other OEMs or when consumers turn to McAfee, this is when Gen Digital loses revenue.

Trelix continues to offer threat intelligence APIs and sunscriptions, with prices going up to half a million a year. Check Point and Sophos also offer Threat Intelligence as a service.
There are some minor players as well like Fortinet and so on.

 

[Trident]

The reality is simple. A "True Behavior Blocker" (Dynamic Heuristic Analysis) exists. It analyzes sequences. Does it have blind spots? Yes. (As you correctly noted with Syscalls). Does that mean the technology is a "myth" or "marketing"? No.

It just means the technology isn't magic. Let’s agree that the methodology exists, even if the efficacy isn't 100% against advanced threats.

It does exist, nobody is saying that it doesn’t exist…

Behavioural Blocking still accounts for a sheer number of real malware neutralisation.

 

[Jonny Quest]

Agree hence the (seemingly) free annotation. Norton being aggressive in this markt is interesting because F-Secure relies on Gen Digital technology. So either Gen Digital takes all egs (when Norton wins the contract), half an egg (when F-secure wins the contract) or empty shell (when McFee wins the contract). Saying does not translate wel, but allowing their (Gen Digital) technology to be white labelled raises their win chance from 33% to 50% interesting move.

Which you bring up a really good point, or at least had me thinking. Was F-Secure maybe pursued by Gen Digital to use their Avira SDK, to help increase their market share in that way?

I always considered it was a cost effective, labor effective move on F-Secure's part, to no longer have to maintain their own main scanning engine(s), unless it's a 6 of one 1/2 dozen of another, type of thing?

 

[Trident]

Which you bring up a really good point, or at least had me thinking. Was F-Secure pursued by Gen Digital to use their Avira SDK, to help increase their market share in that way, as far as use of the Avira SDK?

I always considered it was a cost effective, labor effective move on F-Secure's part, to no longer have to maintain their own main scanning engines(s), unless it's a 6 of one 1/2 dozen of another, type of thing?

F-Secure was one of the vendors that used and ditched Bitdefender engine. F-Secure like Check Point did not have a good luck with Bitdefender engine.

The truth about BD engine is that unless you spring a substantial amount of money, Bitdefender does not provide the Photon optimisations. The vendor is responsible for managing the caching algorithms, only Vipre from the OEMs uses Photon. Most of the OEMs do not achieve the BD-level performance and even the BD-level is not amazing.

F-Secure switched to Avira a number of years back, probably they were offered a discount to add Sentry to the contract as well.

It is not cheap and it is not super easy working with what is essentially a black box. The only thing that you get from the engine is a named pipe for inter-process communication.
You put the file in the box and you wait for the output from the pipe. In addition, as you can see the pictures above, prices are not really “pocket spending”.

It is what it is.

 

[bazang]

F-Secure switched to Avira a number of years back, probably they were offered a discount to add Sentry to the contract as well.

It is what it is.

F-SECURE's split from WithSecure was done predominantly to become a publicly traded company and thereby present itself as a potential acquisition target. Same strategic thinking at WithSecure.

F-SECURE used to be a boutique, niche player that did quite well for itself, but when it went public the priorities and dynamics of the company changed. This is to be expected.

Honestly, analyzing the overall context and facts - for example a prior F-SECURE executive now works for AVIRA and he has pushed for F-SECURE to adopt as much AVIRA SDK and backend as possible.

I cannot imagine that GenDigital has not at least considered tendering an offer to F-SECURE. But it appears that GenDigital is taking a "Wait-and-See" approach to any such offer. The de-merger or split of F-SECURE and WIthSecure have not gone as well as they could - and I think analysts are skittish about F-SECURE's balance sheet and other numbers.

Whatever the case might be, F-SECURE, AVIRA, Emsisoft, Bitdefender, Kasperseky, and so on - if we had a 1 million Euro budge to have each pentested to death, then the findings in the reports would disappoint a lot of people.

Behavior Blocking and other valuable features are great, but in my experience no matter what the user decides, they need to supplement the AV with a default deny solution. Absolutely necessary? Of course not. Does that combo greatly increase the probability of local host being protected better than the 99.5% level - why yes. Certainly.

 

[bazang]

But for the average user, I'm sure it's good enough.

It's "good enough" for a user that is inclined to research and know better than average the topics related to cybersecurity and the realities and limitations of AVs.

It's "well suited" for any user that just wants simplicity.

If I had crypto wallet infos on localhost, and the amount of digital currency parked in the wallets was substantial, then I think F-SECURE alone would not be enough - and neither would most other AVs.

There's that dumbass out there that had 17.5 million Euros of cryptos in various wallets. They used some "Tier 1" AV and it did not protect them. Mind you this was a very highly experience developer with best security practices, and yet still they got shanked by cybercriminals. Why? Because they made mistakes of various kinds - particularly just being too busy to pay close attention and scrutinize things that were suspicious. Overconfidence too. "I'm top company ace with strong cybersec knowledge and very secure habits." That's all fine and does work, until it doesn't.

 

[Divergent]

If F-Secure, Norton, Avira, and BullGuard all effectively run on the same backend logic (GenDigital/Avira SDK), we lose Genetic Diversity in defense. The Impact would be a bypass developed for Avira becomes a bypass for F-Secure. The "boutique" value of F-Secure was its divergence, losing that makes it a commodity.

Bazang is absolutely correct. If you throw a dedicated Red Team with a massive budget against any sensor-based AV (EDR included), they will find a bypass. AVs operate on Probabilistic Detection (Is this likely bad?).

The Default Deny advantage (Application Control/SRP) operates on Deterministic Execution (Is this allowed?). It is infinitely easier to list what is allowed (50-100 binaries) than to list what is bad (1 billion+ hashes). A "Default Deny" policy stops the "Tier 1" pentest bypass because the payload simply never runs, regardless of whether the AV detected it.

The loss of €17.5M by a "top company ace" highlights a cognitive vulnerability, Normalization of Deviance. Experts often bypass their own safety rails because they "know what they are doing." Attackers exploit this by crafting social engineering that appeals to technical authority (e.g., a fake GitHub dependabot alert or a compiled binary from a "trusted" repo). The AV didn't fail, the Process failed. The malware likely ran with the user's explicit consent.

For those reading this thread who want to move beyond "Good Enough" to the "Default Deny" posture @bazang suggests, use Software Restriction Policies (SRP) or AppLocker (Windows Pro/Enterprise) to block execution from user-writable directories (%AppData%, %Temp%). Tools like SimpleWindowsHardening (SWH) or Hard_Configurator provide a GUI for these policies.

For high-value assets (Crypto/IP), the goal is not "Better Detection," it is Reduced Surface.

Final thought, "Default Deny" is uncomfortable. It breaks things. But as @bazang noted, for high-value targets, comfort is a vulnerability.

 

[Divine_Barakah]

Fake/Marketing BB. Blocks a file because the cloud says "This hash is bad" but calls it "Behavioral Detection" because it happened during execution.

I believe Emsisoft "BB" does this.

 

[Divergent]

As per the title and to stay on topic.

F-Secure Antivirus, Solid Finnish Security or Overhyped and Overpriced?

My Take. It is Solid Finnish Security, but it is Overpriced if you don't care about privacy. It is almost certainly Not Overhyped, in fact, it’s practically invisible in the broader market compared to the "loud" brands like Norton or McAfee.

Here is the breakdown of why the title is a false dichotomy.

The "Finnish" part isn't just marketing, it’s a legal framework. Operating out of Helsinki subjects them to strict EU/Finnish privacy laws. Unlike Avast (which sold user data via Jumpshot) or Kaspersky (geopolitical risk), F-Secure has a clean ledger. As discussed in this thread, F-Secure isn't just a re-skinned Avira. They license the Avira SDK for static file signatures. This is the "boring" part. Avira Sentry aka Behavior Detection is their in-house behavioral engine. This is what you are actually buying, the logic that spots a process acting like ransomware even if Avira doesn't know the hash yet.

"Overhyped"? NO. F-Secure is anti-hype.

You rarely see F-Secure scream about "AI-Powered Blockchain Defense" or other buzzwords. They are engineering-led, often to a fault. Because they are often given away for free by ISPs (Virgin Media, Ziggo, etc.), enthusiasts often dismiss them as "bloatware." This isn't hype, it's the opposite, underrated competence masked by a boring delivery channel.

"Overpriced"? YES (At Retail).

If you buy F-Secure purely for malware detection, you are paying a premium for the same detection engine found in the free version of Avira. You aren't paying for better detection than Avira, you are paying for Silence and Privacy.

Free AVs (Avira Free, Avast) pay the bills by harvesting data or showing pop-ups. F-Secure charges you money so you become the customer, not the product.

The thread title implies you have to choose between "Quality" and "Value." The truth is more nuanced. For the Average User, It is Solid. It’s quiet, effective, and hard to break. For the Power User, It feels Overpriced. You can get similar protection for free (Microsoft Defender + ConfigureDefender) if you know how to tweak settings.

For the Paranoid, It is Priceless. It’s one of the few Western AVs that doesn't feel like spyware itself.

The "Safe" Choice. Not the sharpest tool (Bitdefender/Kaspersky often score higher in raw labs), but the handle won't cut your hand.