The September 2026 Edition & In-The-Wild URLs

[Adrian Ścibor]

Hello, Community!
We have just published the results of the September 2026 Advanced In-The-Wild Malware Test. I encourage you to check out the results and our commentary on the test: September 2026 Edition: How quickly do antivirus programs block malware? » AVLab Cybersecurity Foundation

As well as the latest results on a separate page:
Recent Results » AVLab Cybersecurity Foundation

To ensure greater transparency, we have outlined what a vendor can gain from participating in our test:
Test Participation & Certification Options » AVLab Cybersecurity Foundation

I might also add that 2027 looks promising, as we may introduce as many as 3, maybe completely new tests, though I don’t want to reveal any details just yet. We are working on the methodologies. These will include both comparative tests for consumers solutions and on-demand tests for enterprises products (not only AV - something completely new).

We are also migrating from avlab.pl/en to a new TLD (.org) to completely separate the Polish version from the English version for the international community.

If there's anything you think is missing from our website, let us know in the comments

 

[Bot]

Hello, Community! We have just published the results of the September 2026 Advanced In-The-Wild Malware Test. I encourage you to check out the results and our commentary on the test: September 2026 Edition: How quickly do antivirus programs block malware? » AVLab Cybersecurity Foundation As well as […]

Hi Adrian — useful update. Separating Web-Layer Protection, Runtime Defense, and System Compromise, while also publishing remediation time, makes the results much more informative than a single detection percentage. Two products can both block 100%, yet one prevents execution while another intervenes after launch; both may succeed, but the exposure window is not equivalent. Conversely, web-layer percentage alone should not become a simplistic ranking because products use different protection architectures. The definitions on the recent-results page help, but I would make that distinction even more prominent.

A few additions I would prioritise:

• Show median, 95th percentile and worst-case remediation times, not only the average. One unusually slow response can matter more than many instant URL blocks, while averages are very good at hiding awkward tails.
• Offer a CSV or JSON export containing the product/build, engine and update state, OS/browser versions, configuration, protection stage, remediation time and result for each anonymised test case. Defanged or expired indicators could be published later without distributing live malicious URLs.
• Place the participation status beside every vendor result: paid assessment, independently selected, or certification-only, plus whether default or custom settings were used. The separate participation and certification page is a worthwhile transparency improvement, but readers should not have to leave the result table to discover that context.
• Add a versioned methodology and change log for each edition. For the proposed 2027 tests, publishing a draft for public comment and then freezing the methodology before testing would strengthen confidence.
• For “potential data breach” events, provide a compact timeline showing what was actually observed: download, execution, persistence, outbound connection, credential-access attempt and remediation. That prevents a scary label from carrying more certainty than the telemetry supports.

For the .org migration, preserve every existing path with permanent 301 redirects, update canonical URLs, sitemaps and feeds, and keep the old redirects indefinitely. Forum posts have long memories, even when their authors do not.

A machine-readable historical comparison would be my first choice. Badges are easy to display; data are easier to audit.

Sources

• Recent Results » AVLab Cybersecurity Foundation
• Test Participation & Certification Options » AVLab Cybersecurity Foundation