Ask any moderately tech-savvy netizen to name a free antivirus program and you’ll probably get an answer beginning with the letters A and V. Avast, AVG, Avira—these three are known and loved all over the world, though not necessarily in the same parts of the world. Sure, all three companies also offer for-pay antivirus tools with even more protective features, and they’re thrilled by every free-level user who becomes a paying customer. But the free editions are effective and offer a welcome alternative to relying on Windows Defender. That rosy picture could potentially change when all three belong to Norton—or, more properly NortonLifeLock.
In truth, the free antivirus realm started to shrink several years ago, when Avast bought AVG. Avast has kept the AVG brand alive and separate because it’s popular in areas where Avast itself has lower market penetration. More recently, Norton bought Avira in 2020. At the time, there was a suggestion that branding might change to “Avira by Norton,” but there’s no sign of that in the latest Avira releases.
The pending merger of Norton and Avast is the capper. When the dust settles, Norton will own three of the best-known free antivirus brands. Just how will that affect you?
Cornering the Market? Not Likely
In the B-movie version of this story, evil mastermind Lex Luthor, secretly manipulating Norton, would choke off the supply of free antivirus protection, forcing everyone to buy from him. But this is the real world, and there are endless reasons that won’t happen. First, there are plenty of other free antivirus choices, and plenty of commercial antivirus products besides Norton. Consumers might just as well pay for Bitdefender, Kaspersky, McAfee, or dozens of others.
Second, and more important, it would be a public relations nightmare. Giving away free antivirus protection adds luster to the reputations of Avast, AVG, and Avira. Conversely, taking away that protection would totally give Norton a black eye. Consumers do consider our reviews when choosing an antivirus, but they also gravitate to companies that they just plain like. And nobody would like Norton if the company pulled a nasty trick like that.
I asked my Norton contacts if they could offer reassurance that these three beloved brands would continue. Completely reasonably, they responded, “At this time, we are declining to comment beyond the press release.” Still, I’m confident there’s no immediate danger to any of the three.
The Same Under the Hood?
Skimming the immense documentation describing the proposed merger, I found an interesting figure. After the merger, the combined company should have “a potential headcount reduction of approximately 25% … across all geographies, and from a broad range of job categories.” While some of the cuts might come from back-office services like HR and tech support, coders could also face the axe.
Security companies, more than other companies, need to constantly work on development, because they must keep up with new innovations by malware coders. And they need a team of researchers to spot those malware innovations. Trimming down to just one development team maintaining just one code base would certainly reduce the headcount.
There’s precedent. One of the first initiatives after Avast bought AVG was to merge the two antivirus code bases into a single shared protection engine. Avast and AVG earn identical scores in most tests now, because under the hood it’s the same code being tested.
Things will get interesting if Norton goes for a full-on code merger. When Avast, AVG, Avira, and Norton all have the same antivirus engine, will labs like AV-Test Institute and AV-Comparatives even bother to test them separately? Any comparison within that group of products will hinge on things like user interface differences and bonus features, if the core antivirus is the same.
Avast, Privacy, and History
The investor presentation describing the proposed merger of Norton and Avast characterizes what each company brings to the table. It repeatedly associates NortonLifeLock with identity protection and Avast with privacy protection. This is, of course, in addition to the antivirus protection for data and devices that both companies provide.
Those of us who follow security news might feel just a slight tremor at the association of Avast with privacy. Yes, in general the company does a fine job of protecting its customers from attacks on their privacy. But there was a time, not long ago, when a privacy attack came from within.
In January of 2020, PCMag and Motherboard jointly broke a story about Jumpshot, which at the time was a division of Avast. Briefly, Jumpshot harvested data from millions of devices and sold the depersonalized aggregate data to anyone who’d pay for it. But the data proved not to be depersonalized at all, meaning that personal data of all those involved was exposed.
Avast took appropriate action, going so far as to shut down Jumpshot entirely. Avast’s CEO Ondrej Vlcek stated publicly, “As CEO of Avast, I feel personally responsible and I would like to apologize to all concerned.” Note that after the merger goes through, Vlcek will be President of the new combined company.
So, there was a privacy problem, Avast fixed it, and the CEO even apologized. There’s been no sign of data misuse since then. PCMag has restored the Editors’ Choice designation for Avast Free Antivirus, which we retracted when the story first broke. But I still get a little uneasy when I hear Avast praised for privacy protection.
What Do Competitors Think?
I sent out queries to Norton’s biggest competitors asking for comment on the coming merger. Not surprisingly, almost all of them cited company policy against commenting on mergers and acquisitions. Marcin Kleczynski, CEO of Malwarebytes, was a rare exception.
“Consolidation in cybersecurity is natural, but not necessarily healthy for the industry or the end users,” said Kleczynski. ”The competition that exists in a diverse market landscape drives innovation and benefits all end users. The concern as large players like Norton begin to acquire free solutions is that truly free solutions may evaporate and many vulnerable populations will be forced to pay—or be left at the mercy of cybercriminals. This is why we always have offered a free solution for consumers.”
Indeed, Malwarebytes Free is very popular as a cleanup tool after a malware attack. I’ve even had tech support agents from other security companies recommend it. But the free Malwarebytes product is not a full-fledged antivirus system, because it doesn’t include a real-time component to protect against future infestations.
No Cause for Alarm
According to Norton documents, one aim of this merger is to “accelerate the transformation of consumer cyber safety.” I’m not precisely sure what that means, but it sounds positive. Perhaps a clearer aim is the intention to “provide greater geographic diversification and access to a larger global user base.” By taking on the wide-ranging user populations of Avast, AVG, and Avira, Norton won’t necessarily conquer the entire world, but it will certainly expand its reach. For fans of the previously separate companies, this is good news. Part of that global reach depends on the fact that each brand has areas where it’s more popular than the rest, so staying global means keeping all the brands.
Going forward, we may see the merging of antivirus code bases that I mentioned. It’s possible that the Norton name may get added to product branding. One or more of the independent brands might even disappear over time. But in the short run, I don’t expect users of Avast, AVG, Avira, or Norton to notice any significant changes.
