If an antivirus utility cleans up existing malware infestations on installation and then prevents future attacks, it’s doing the job. Most software in this field also try to keep you safe by helping you steer clear of malicious or fraudulent websites. BullGuard Antivirus sticks to those basics, for the most part, though it does add a scan for vulnerable security settings. It had some troubles at the time of our previous review, including a total miss on one nasty ransomware attacker. Things are looking a bit better this time around, though it tanked our phishing protection test.
How Much Does Bullguard Antivirus Cost?
At $29.99, a yearly BullGuard subscription costs less than many competing products. Bitdefender Antivirus Plus, Kaspersky, and Webroot all cost 10 dollars more. However, Bitdefender and Kaspersky give you three licenses for $59.99, and Webroot charges just $49.99 for a three-pack. At the antivirus level, BullGuard doesn’t offer any similar volume discount. McAfee also costs $59.99 per year, but a McAfee subscription lets you install protection on every device you own, so it’s not truly comparable.
A modern, attractive installer displays information about the program while it’s doing its job. Once it finishes, you create or log in to your online BullGuard account. I like the fact that it automatically downloads the latest antivirus definitions, rather than setting that as a task for the user.
BullGuard’s main window contains nine square panels in two rows, but only the Antivirus, Vulnerabilities, and Game Booster panels are enabled. The other six (Firewall, Backup, PC Tune-up, Parental Control, Secure Browser, and BullGuard VPN) require an upgrade to one of BullGuard’s security suite products. Don’t confuse Secure Browser with Safe Browsing. The latter protects against malicious and fraudulent URLs and appears in all the BullGuard Products. Secure Browser is a separate hardened browser designed to isolate your most sensitive transactions.
In a nice design touch, BullGuard does as much as possible without leaving this main window. For example, when you run a full scan, the progress bar appears inside the Antivirus panel. In testing, a full scan took 75 minutes, a bit longer than the current average of 66 minutes. Oddly, the progress bar sat at 6% for almost the entire time, then shot up to 100% at the very end.
Like many competing products, BullGuard uses the first full scan to optimize for future scans. A repeat scan finished in just 13 minutes, about a fifth the time taken by the first scan. Some products show an even more prominent speedup. Avira Antivirus Pro, for example, took 105 minutes for the first scan but just five for the second.
One more thing about that main window. On installation the main window is wide enough to display four panels across, with a slider that brings the last item into view. You can click to expand the window to show all nine panels or shrink it to show just three and a half panels. Yes, the latter is an odd view. And there’s no clear way to get back to the original four-panel width.
Good But Sparse Lab Results
We look to four independent antivirus testing labs around the world for evidence that the antivirus under testing is (or isn’t) effective. BullGuard appears in the latest results from just one of these, though the scores it does have are good.
Accurate detection of malware is important, but an antivirus also must avoid quarantining valid programs, and must not put a drag on system performance. Experts at AV-Test Institute assign antivirus programs up to six points each for protection, performance, and usability—where usability means that it doesn’t flag valid programs or websites as malicious. BullGuard earned the full six points in all three categories, for a perfect 18-point total. Eight other products reached that perfect score in the latest test, among them Kaspersky, McAfee, Norton, and Microsoft Windows Defender Security Center.
Researchers at AV-Comparatives regularly report on a wide variety of security product tests. We closely follow three of these. A product that does well enough to pass a test receives Standard certification, while those that go beyond the necessary minimum can reach Advanced or Advanced+ certification. In past years, BullGuard has taken a range of scores in these tests. Sometimes it reached Advanced+, others it didn’t even achieve Standard certification. The latest reports from this lab don’t include BullGuard.
Each of the testing labs has its own scoring methods. We’ve developed an algorithm to map them all onto a 10-point scale and derive an aggregate score, for those tested by at least two labs. With just one lab report, BullGuard doesn’t have an aggregate score. Eight products appear in the latest reports from all four labs, among them Kaspersky, Norton, McAfee, and Trend Micro Antivirus+ Security. Kaspersky Anti-Virus tops the list, with a perfect 10 points.
Multiple results aside, BullGuard’s perfect score from AV-Test is a very good sign. We look forward to more lab tests.
Improved Malware Protection
The big testing labs have resources far beyond our own, but we do like to get a hands-on experience of each product’s malware protection abilities. We use a collection of several dozen real-world malware samples that have gone through our analysis. This analysis lets us confirm how thoroughly the antivirus blocked the installation.
When we opened the folder full of samples, BullGuard’s on-access scanner quickly started knocking them off, displaying a small pop-up alert when it detected something amiss. If additional alerts occurred, they all shared the same pop-up, with a note indicating how many more were pending. You can click through to view and close the alerts one at a time or check a box to close them all at once. BullGuard detected nearly 80% of the samples at this point.
We maintain another folder containing hand-modified versions of the same samples. For each sample, we rename the file, append nulls to change its size, and overwrite a few non-executable bytes. When last tested, BullGuard missed a modified version of a nasty ransomware sample. Launching the sample mods isn’t usually part of this test, but because it was ransomware we made an exception. The ransomware ran to completion, encrypted the test system’s documents, and demanded its ransom, all without a peep from BullGuard. In the current round of testing, it immediately wiped out both our dozen ransomware samples and their modified versions, which is a big improvement.
To complete the test, we launched each of the regular samples that survived BullGuard’s initial onslaught. It caught quite a few of them at or soon after launch. One way or another, it detected 93% of the samples and scored 9.3 points, the same as TotalAV Antivirus Pro and Kaspersky. That’s a significant improvement since its last test, in which it earned just 8.2 points.
BullGuard’s score is respectable, but six products have earned even more points in their own tests. Topping this list is Webroot SecureAnywhere AntiVirus, which managed a perfect defense and earned the maximum score, 10 points.
For a test using the very latest malware, we start with a feed of recently detected malware-hosting URLs supplied by London-based MRG-Effitas. Typically, these are no more than a day or two old. We launch each URL and note how the antivirus reacts. Does it steer the browser away from the dangerous website? Does it identify and eliminate the malware download? Or does it sit idly, twiddling its thumbs while malware downloads pile up? We keep testing until we reach 100 data points, and then analyze the results.
BullGuard’s Safe Browsing component blocked all access to 82% of the URLs, diverting the browser to a warning page. The real-time antivirus iced another 11% during download. BullGuard’s total detection rate of 93% is decidedly better than the current average, 79%. However, 11 other products have scored even higher. McAfee and Vipre are the big winners here, each with 100% protection.
Multi-Layered Protection
This year’s BullGuard product line promises multi-layered protection against malware. The six layers are: Safe Browsing, to keep you away from dangerous pages; Dynamic Machine Learning, to detect malicious behaviors; Sentry Protection for Zero-Day Malware; an On-Access Antivirus Engine; a Firewall (in the suite-level products); and a Vulnerability Scanner.
I don’t have access to zero-day malware—anything I’ve collected is necessarily past the possibility of a zero-day attack. But I did get to see the multi-layered protection in action. When I test protection against malware-hosting URLs, I use a small, hand-coded program that launches each URL in turn and lets me record how the antivirus handled it. Shortly after I started that test, BullGuard decided that this tool’s behavior, repeatedly launching dangerous URLs in the browser, was suspicious enough to merit quarantine.
That’s a completely reasonable conclusion. I wasn’t thrilled that I had to rescue the program from quarantine and start my test all over again, but I can’t blame the antivirus. The same thing happened when I ran my phishing protection test, described below. After perhaps a half-dozen instances where the phish-test utility launched a dangerous URL, BullGuard threw it into quarantine.
Phishing Protection Fiasco
P. T. Barnum famously opined that there’s a sucker born every minute. Creators of phishing websites get rich betting on Barnum’s belief. They create fraudulent websites that look exactly like PayPal, or your bank, or your email login. Some even try to steal logins for game sites and dating sites. If you fall for the impostor and enter your username and password, the fraudsters own your account. These fake sites quickly get blacklisted, but their creators simply build new ones, trolling for a new batch of suckers.
For testing purposes, we gather the very latest reported frauds from online sites that track such things. We make sure to include plenty of URLs that are so new they haven’t gone through analysis. Detecting these is both more difficult and more important than blocking those that already hit the blacklist.
Next, we launch each of the collected URLs in four browsers. One relies on the product under test for protection, naturally. The other three depend on the phishing protection built into Chrome, Edge, and Firefox. If any URL doesn’t load correctly in all four browsers, we toss it. Likewise, if the URL points to a page that doesn’t actively try to steal login credentials, it gets the boot.
When BullGuard detects a fraudulent page, it displays the same warning screen it uses for malware-hosting URLs. BullGuard’s performance in this test has had its ups and downs over time. Several versions ago it exhibited a high detection rate, better than all three browsers. Next time around, though, it scored poorly, worse than two of the three browsers. In our previous review it was back to the heights. And with the current test…it’s totally in the cellar.
With a detection rate of just 5%, BullGuard isn’t at the very bottom, but it’s awfully close. All three browsers not only beat its performance, they beat it by more than 80 percentage points. The lesson is clear—don’t turn off phishing detection in the browser.
At the top you’ll find F-Secure and McAfee, both of which achieves 100% detection in their latest phishing protection tests. Bitdefender and Norton are close behind, with 99%.
For advice on what you can do to keep yourself safe, you can read How to Avoid Phishing Scams.
Safe Browsing
Safe Browsing is the BullGuard feature that steers your browser away from dangerous and fraudulent websites. It also marks up links in Google, Bing, Yahoo, and Facebook, so you don’t even click dangerous ones.
A check mark in a green circle means the site is safe, while a red stop sign denotes a site you shouldn’t visit. Pointing to the icon displays a small pop-up listing the website’s categories and threat level. However, you can’t click for a full-page site analysis the way you can with Norton’s Safe Web feature.
Vulnerability Scan
Hackers just love finding security vulnerabilities in your favorite programs, things that let them execute arbitrary code on your computer. The best defense against this kind of attack is to apply all security patches as soon as they become available. Many security tools, among them McAfee AntiVirus Plus and Bitdefender, include a module to check for unpatched security vulnerabilities.
However, the vulnerability scan in BullGuard is different. It looks for vulnerable security settings and related problems. As with the antivirus scanner, when you click to scan for vulnerabilities the progress bar appears right in the panel on the main window. On scan completion, you get a list of found security problems. It warns you if you’ve allowed Autorun from removable drives, flags insecure Wi-Fi connections, lists unsigned device drivers, and more. When possible, it leads you to fix the configuration problem.
Game Booster
Many security products include a feature that suspends notifications and scheduled scans when you’re playing a game or using another full-screen program. BullGuard’s Game Booster feature does that, but also promises to “protect your gaming experience from framerate drops caused by other programs.”
Initially I couldn’t enable this feature, because it requires at least four CPU cores. Fortunately, virtual machines are flexible. I had no trouble reconfiguring this one to use four virtual CPU cores. When a full-screen game starts, it optimizes the system for gameplay and displays a small widget stating that the game is being optimized. You can dismiss the widget, of course, or turn it off altogether. Avid gamers should appreciate this feature. They might also want to read our roundup of the top gaming VPNs, too.
You Can Do Better
BullGuard Antivirus sticks to the task of protecting your system against malware. One independent testing lab certifies its protection, giving it a perfect score. In our hands-on malware protection tests it scored better than when last tested. However, its phishing protection score, which fluctuates quite a bit, hit a new low in our latest tests.
You’ll pay a little more for our Editors’ Choice antivirus products, but the extra cost is worth it. Bitdefender Antivirus Plus and Kaspersky Anti-Virus get top scores from multiple labs, not just one. McAfee AntiVirus Plus protects all your devices, on multiple platforms. And the unusual behavioral-analysis detection system used by Webroot SecureAnywhere AntiVirus makes it the lightest and tiniest antivirus of all. With all these to choose from, there’s little reason to opt for BullGuard.
