SE Labs Report for Oct-Dec 2020

[fabiobr]

SE Labs's Protection Accuracy vs Total Accuracy always looks misleading at first glance. But I appreciate that they provide details on how/at what stage threats were detected.
This is the main and most important chart of any SE Lab test.
View attachment 252174

Someone knows why McAfee did so well? They improved that much?

It's doing good on AV test and know this too.

 

[Andy Ful]

I am afraid that the results of several AVs are pretty much random and one cannot really say anything interesting about their protection in the wild in the period of October-December 2020. For example, the missed samples for McAfee (8 last SE Labs Consumer tests) are as follows: 0,1,1,4,3,0,2,0.
So, the results change randomly around the average value close to 1. The most probable values are 0 and 1, but the chances for other values are also far from 0.
This randomness inevitably follows from choosing 100 malware samples from the pule of samples in the wild which is several thousands times greater. So, there is no real basis for thinking that McAfee had worse protection in Q1 2020 (3 missed samples) than in Q4 2020 (0 missed samples).

 

[Andy Ful]

If we take the last 8 tests for Avira free: 3,1,2,3,1,4,3,4 , then we can see similar randomness around the value close to 3. So, it is rather obvious that McAfee has a better protection level as compared to Avira Free.

Edit.
The above conclusion is about the protection related to web & email threats. SE Labs testing does not include some other infection vectors like threats delivered via USB drives, network drives, etc. Furthermore, SE Labs tests Avira Free (Avira Pro has got better results) and all AVs are tested on default settings.

 

[Andy Ful]

We will see if these rules are effective (as compared to other AVs) after the tests made in the first half of the year 2021. So far, the results are non-conclusive:

AV-Test widespread samples (11 last tests for home users)
---------------------Missed samples
----------------------2019----2020
McAfee.............0.........0
Avira Pro...........5.......10

AV-Comparatives Malware Protection samples (four last tests, Consumer Area)
---------------------Missed samples
----------------------2019----2020
McAfee ..........30..........7
Avira Pro..........4..........7

In both cases (AV-Test and AV_Comparatives) the samples were a few weeks old.
It seems that malware protection based on rule 65756 is in the advantage of Avira, except if McAfee introduced this rule in the year 2020. Anyway, even in the year 2020 only, the McAfee protection for such threats is average.

 

[Andy Ful]

The above rule can be tested in Real-World tests:

AV-Test (Real-World data from 11 last tests, home users)
---------------------Missed samples
----------------------2019----2020
Avira Pro...........6.........11
McAfee............19........17

AV-Comparatives (four last tests, Consumer Area)
---------------------Missed samples
----------------------2019----2020
Avira Pro...........0.........8
McAfee............10.......19

SE Labs (8 last tests, Consumer Reports)
---------------------Missed samples
----------------------2019----2020
Avira Free..........9........12
McAfee..............6........5

This rule also does not give an advantage (so far) as compared to Avira technology (except for Avira Free).

 

[nico_be_rocky]

trend micro just ver. 16?
ver. 17 was released months ago if i remember correctly

 

[ErzCrz]

These lab tests ar why I kept bouncing around between products. I like the default deny approach. Comodo did well as anything that didn't get caught by detection got caught by containment, sandboxed and didn't do the system any harm. On the otherhand WD with H_C locks down the system and protects against infection and decent detection combined. Although I'll always test out new features and stable versions, I end up back at WD,H_C for less of a headache

 

[Andy Ful]

Although I'll always test out new features and stable versions, I end up back at WD,H_C for less of a headache

You probably do not need H_C any more.

 

[ErzCrz]

You probably do not need H_C any more.

Not if I'm using Comodo, I agree but with WD on it's own, I think I'd still need a hardened system. Ugh, I'm so indecisive at times.