Battle Ransomware (KnowBe4) vs 10 AVs

[Shadowra]

With Norton

 

[miguelang611]

Kaspersky proves once again its performance against Ransomware!

Too bad, no Norton in your test, I would have liked to see the SONAR in activity

With Norton

When I first did these tests in the past Kaspersky was already the most advantaged pupil, both Kaspersky and BD improved however! And as far as I see as you tested, Norton does a pretty fair job as well!!

AVAST/AVG protect from ransomware only folders that have been specified by the user (excluding folders: documents, images, videos etc that are included by default)

Correct! I tried KnowBe4 on Documents folder and avast would prevent anything to run not trusted, so would have worked!

I have repeated the tests (Windows 10 Home 21H2), but now I started from Default settings and removed dynamic signatures after each test:

View attachment 265938

1. Defender Default ---> 12 vulnerable, 2 false positives.
2. Defender Default + Cloud Block Level = Highest ----> 5 vulnerable, 2 false positives.
3. Defender Default + Cloud Block Level = Block ----> 0 vulnerable, 2 false positives.

Microsoft recommends Cloud Block Level = Highest, as a strong anti-ransomware protection.
As I wrote in my previous test, it is very probable that Defender learned much from post-execution telemetry compared to the test done by @miguelang611. This confirms my opinion that the results do not show the real capabilities of tested AVs, but rather show if someone else used KnowBe4 in the past to test the particular AV.

Well wow, that is a huge increase in protection from what I got. However I gotta say that I repeated these tests with 12 days between my first tests and when I took these with screenshots. They were pretty much equal between both timestamps... However I didn't try Defender (neither stock or hardened) on my first test (just the other 8 options) so that might be the reason!

Very useful comment!

 

[Andy Ful]

I have repeated the tests (Windows 10 Home 21H2), but now I started from Default settings and removed dynamic signatures after each test:

View attachment 265938

1. Defender Default ---> 12 vulnerable, 2 false positives.
2. Defender Default + Cloud Block Level = Highest ----> 5 vulnerable, 2 false positives.
3. Defender Default + Cloud Block Level = Block ----> 0 vulnerable, 2 false positives.

...

I am not sure if the results included in this thread for tested AVs are truly correct.

I repeated the test 25 times for Defender at default settings and the results were as follows:
12, 12, 12, 11, 10, 6, 9, 8, 7, 5, 7, 7, 7, 7, 3, 6, 7, 18, 17, 20, 16, 18, 20, 16, 16 ~ on average 11 vulnerables per 1 test.

So, it is possible that in a single test one could get the result 20 vulnerables and also 3 vulnerables.

To be sure, one should repeat the test several times for each AV.

 

[miguelang611]

I am not sure if the results included in this thread for tested AVs are truly correct.

I repeated the test 25 times for Defender at default settings and the results were as follows:
12, 12, 12, 11, 10, 6, 9, 8, 7, 5, 7, 7, 7, 7, 3, 6, 7, 18, 17, 20, 16, 18, 20, 16, 16 ~ on average 11 vulnerables per 1 test.

So, it is possible that in a single test one could get the result 20 vulnerables and also 3 vulnerables.

To be sure, one should repeat the test several times for each AV.

Wew, that is so much of a change!! Defender I just tested once, but the others there was like 10/15 days between my first test and when I did it properly for uploading it here and nothing really changed... But well, that's 2/3 times, not 10 hehe

By the way, thanks to the mod who edited my OP and added spoilers. It is so much better now!

See you!