Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 913359" data-attributes="member: 32260">I suspect that there can be no measurable difference between most of the popular AVs, except for targetted attacks. If one takes a look at AVLab reports, all AVs have the same protection (differences are less than measurement errors). This can follow from the fact that AVLab honeypots catch mostly the large scale attacks (with a little delay). The biggest AV testing labs have a much larger infrastructure and can catch more 0-day malware used in targetted attacks - so we can see more missed samples in the reports.If so, then the results of most AV tests are not relevant for home users.I also suspect that the stellar results of Norton can come from corporate honeypots. Simply, Norton catches the malware used in targetted attacks on the Norton protected enterprises before AV testing labs do. So, Norton has an advantage because it has the biggest market share. This is an advantage for the test results, independently of the number of endpoints that were infected in the targetted attacks. Of course, the Norton protection is probably one of the best, even if the test results are slightly distorted.One can say that WD/MSD has a bigger advantage, but it is not true because the popularity of WD/MSD is not the same as MSD ATP (paid).Anyway, the above thoughts &amp; speculations are far from something that could be proved.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Andy Ful, post: 913359, member: 32260"] I suspect that there can be no measurable difference between most of the popular AVs, except for targetted attacks. If one takes a look at AVLab reports, all AVs have the same protection (differences are less than measurement errors). This can follow from the fact that AVLab honeypots catch mostly the large scale attacks (with a little delay). The biggest AV testing labs have a much larger infrastructure and can catch more 0-day malware used in targetted attacks - so we can see more missed samples in the reports. If so, then the results of most AV tests are not relevant for home users. I also suspect that the stellar results of Norton can come from corporate honeypots. Simply, Norton catches the malware used in targetted attacks on the Norton protected enterprises before AV testing labs do. So, Norton has an advantage because it has the biggest market share. This is an advantage for the test results, independently of the number of endpoints that were infected in the targetted attacks. Of course, the Norton protection is probably one of the best, even if the test results are slightly distorted. One can say that WD/MSD has a bigger advantage, but it is not true because the popularity of WD/MSD is not the same as MSD ATP (paid). Anyway, the above thoughts & speculations are far from something that could be proved.(y) [/QUOTE]

Verification