You have a lot of choices when you go shopping for antivirus protection. How do you know which to select? We put them to the test for you, rank them according to our findings, and honor the best with our Editors’ Choice designation. The field is wide enough that we’re not limited to a single Editors’ Choice, and each top product has its own merits.
In this arena, both Bitdefender Antivirus Plus and Kaspersky Anti-Virus are 4.5-star Editors’ Choice winners. Previously, we put those two up against each other in a head-to-head comparison and declared Bitdefender the winner.
Bitdefender and Kaspersky are a lot alike, with top lab scores, similar scores in our hands-on tests, and the same third-party VPN licensor. Webroot SecureAnywhere AntiVirus, which is also a 4.5-star Editors’ Choice pick, is quite different from those two, and from most competitors. How does it stack up against Bitdefender, the winner of the previous round?
The Trouble With Lab Tests
Modern antivirus tools use many different methods for detecting malware. Signature-based detection is the oldest. The antivirus simply scans files for patterns of data that identify known malware. Malware coders try to foil that detection by making each copy of an attack slightly different. And the antivirus coders try to catch these polymorphic attacks using fuzzy or heuristic signatures.
Then there’s behavior-based detection, which looks not at what programs are but at what they do. If it acts exactly like malware, it’s malware! You’ll also find statistical systems that analyze all facets of a malware attack such as where the file came from, when it was first seen, and more.
One thing these techniques have in common is that they act quickly. Signature-based detection just takes a simple scan. Behavior-based detection must wait for the malware app to do something, but it’s also typically quick. The independent testing labs known this, and their tests reflect an expectation of speed.
But Webroot is different. It does recognize some files right away, letting known good ones run unhindered and relegating bad ones to quarantine. Any unknowns run under Webroot’s monitoring system, which journals every program action and prevents irreversible actions like exfiltrating data to an external source. Webroot also sends details about unknown to Webroot HQ for analysis. That analysis can take just minutes, or it can be longer. If the verdict is guilty, your local Webroot terminates the process and rolls back everything it did.
Because of this uncommon protection technique, Webroot is a poor fit for most lab tests. Of the four labs I follow, only one has included Webroot in recent tests. SE Labs certifies products at five levels: AAA, AA, A, B, and C. Webroot came in with a respectable AA rating.
Bitdefender, on the other hand, routinely takes excellent scores from multiple labs. It currently boasts perfect or near-perfect scores from AV-Test Institute, AV-Comparatives, and MRG-Effitas. My aggregate lab-score algorithm assigned Bitdefender 9.8 of 10 possible points. Alas, one score isn’t enough for an aggregate, so Webroot has no corresponding number.
Winner: Bitdefender.
Hands-On Testing
Webroot boasts a rating from just one independent lab, while some products don’t show up in reports from any labs. We necessarily perform our own malware protection tests to supplement lab tests when they’re available and to stand alone when they’re not. Webroot routinely aces our hands-on malware protection test, with 100 percent detection and 10 of 10 possible points. Despite its great lab scores, Bitdefender just as routinely fares poorly in these tests. When last tested it detected 89 percent of samples and scored a disappointing 8.6.
For another look at protection, we use a feed of malware-hosting URLs recently discovered by the experts at London-based MRG-Effitas. The antivirus gets equal credit if it steers the browser away from the dangerous URL or if it wipes out the malware download. In its latest such test, Bitdefender managed an impressive 99 percent protection.
Webroot scored 80 percent in its own test, but that’s in part due to its different protection model. Webroot’s full protective abilities don’t come into play until a program launches. Launching the downloaded malware isn’t normally part of this test, but we tried it in this case. When we launched the 20 percent of samples that initially got past Webroot, its score rose to 97 percent.
Why go to the trouble of laboriously coding malware to steal login credentials when you can just dupe the user into handing them over? That’s the idea behind phishing sites. These frauds impersonate banks, shopping sites, even dating sites, and harvest the credentials of anyone who foolishly logs in. Both Bitdefender and Webroot scored very well in our antiphishing test, with 99 and 97 percent respectively.
Results in the phishing and malicious URL tests are just a few points different, but Webroot clearly wins the simple malware protection test.
Winner: Webroot.
Subscriptions and Per-Device Pricing
You’ll find a ton of antivirus products that cost $39.95 or $39.99 per year for a single license. It’s no surprise, then, that Bitdefender and Webroot both run you $39.99.
It’s also common for antivirus companies to offer volume discounts. You can get a three-license Bitdefender subscription for $59.99, and a five-license one for $69.99. Paying $79.99 per year gets you 10 Bitdefender licenses. The price per license just goes down and down, from about $40, to $20, to $14, to $8.
With Webroot, a three-license subscription costs $49.99, where Bitdefender asks $59.99. However, that’s the extent of Webroot’s volume discount. The price per license hits about $16.67 and sticks there. If you want more than three licenses, Bitdefender is a better deal.
Winner: Bitdefender.
Fearless Ransomware Fighters
If a brand-new malware attack gets past your antivirus, you can be confident that within a short while an antivirus update will wipe out the intruder. But if the attacker was ransomware, your files remain encrypted and inaccessible. Because a ransomware attack can be so damaging, many antivirus tools now come with components specifically designed for ransomware protection. Webroot and Bitdefender take rather different approaches to this task.
Bitdefender’s Advanced Threat Defense watches for programs that behave like ransomware. If there’s even a whiff of ransomware activity, Ransomware Remediation backs up important files, restoring them after Bitdefender terminates the attacker.
To test Bitdefender’s ransomware protection, we turned off all real-time protection components except those devoted to ransomware. Then we released a dozen real-world ransomware samples. This collection included one whole-disk ransomware and one screen locker—the rest were standard file-encrypting ransomware. Bitdefender detected and eliminated all but the whole-disk encryptor. Alas, that one managed to totally disable our virtual machine test system.
Webroot handles ransomware just as it does other types of malware, by journaling activity of unknown programs and rolling back any damage if the program proves malicious. With no separation of ransomware-specific protection we took a different tack for testing, repeating the process specifically for this comparison. First, we launched each of the same dozen samples. Webroot caught them all at launch, identifying about half by name.
Next, we created brand-new modified versions of those samples, changing the filenames, appending nulls to change file size, and overwriting some non-executable bytes. The whole-disk encrypting sample got past Webroot in this contrived scenario, just as got past Bitdefender when we turned off Bitdefender’s standard real-time protection.
Webroot detected and eliminated all but one of the remaining modified samples. That last one, a variation on the virulent Ryuk ransomware, encrypted important files on the test system and deposited a ransom note.
Rather than wait for Webroot HQ to condemn the sample, I opened the list of running processes. Sure enough, exactly one was marked as unknown, subject to monitoring. I clicked to block that one and ran a scan. Impressively, the scan restored all the encrypted files. It did leave a mess of encrypted .RYK files lying around, but cleanup was simple.
Both products handled all but one of the samples. Webroot’s impressive ability to recover from a malware attack make it the winner here.
Winner: Webroot.
VPN Support
An antivirus utility can protect your files and data on your local computer, but once those files depart for the internet it has no power. That’s why you also need a Virtual Private Network, or VPN. When the VPN is active, your communications travel in encrypted form to the VPN server. Nobody, not even the owner of the network you’re using, can snoop. Your traffic seems to come from the VPN server, which both defeats snoops trying to track you and lets you spoof your location to access region-locked content.
Like Kaspersky and a few others, Bitdefender licenses VPN technology from Hotspot Shield. You get VPN support with your antivirus subscription, but there’s a catch. You can only protect 200MB per day of traffic per day, and you don’t get to choose a server location. If you want to lift those limits, you must pay another $39.99 per year for the full-scale VPN.
You can get an antivirus plus VPN bundle from Webroot, but there’s no VPN component included in the basic antivirus. Webroot Wi-Fi Security VPN lists for $59.99 per year separately, though it’s often discounted to $39.99. While our VPN expert Max Eddy hasn’t separately reviewed Bitdefender’s VPN, he gives Hotspot Shield four stars and Webroot’s VPN just three.
Winner: Bitdefender.
Super Fast and Super Small
Hard drives keep getting bigger, and we keep finding ways to fill them up. If your drive is nearly full, you’d probably rather use the remaining space on games and videos than devote it to a boring old antivirus. But just how much space are we talking about?
Neither of the downloaded installers is huge. Webroot weighs in at 4.7MB, Bitdefender at 11.9MB. More important, though, is the amount of disk space occupied by the full installation.
Checking the free disk space on a test system before and after installing Bitdefender, I found that free space went down by well over 2GB. That’s darn big—many full-blown security suites take less space on disk.
As for Webroot, it’s files occupied less than 20MB of disk space. That’s less than one percent of Bitdefender’s on-disk footprint.
After any antivirus installation, a full scan is essential, to clean up any lurking malware. Thereafter, the real-time protection systems should catch any new attacks. Even so, the occasional full scan is comforting, especially if it doesn’t take forever. Just as you’d rather not devote more disk space than necessary to your antivirus, you don’t want it to spend a lot of time on scans.
To compare scanning speeds, I ran full scans on identical virtual machines with no malware present. Webroot blazed through its scan, finishing in just five minutes. The average among current products is over an hour, so that’s quite a feat. To be fair, Webroot clearly defines a full scan differently from most.
Bitdefender, on the other hand, took two hours and five minutes to complete a full scan. A notification does point out that repeated scans will get faster as the product optimizes itself for your system. But wow, that’s a long first scan.
Winner: Webroot.
Bountiful Bonuses
Every antivirus must clear out any existing malware infections and stand guard to prevent new attacks. Most also apply protection at the browser level, saving their users from accidentally visiting dangerous or fraudulent sites. Beyond those basics, the features sets vary wildly.
Bitdefender comes laden with a wealth of bonus features that other companies reserve for their security suites. With Bitdefender you get, among other things: a basic password manager; a vulnerability scanner; a rescue environment to clear out persistent malware; browser isolation to protect your online banking sessions; network protection against exploits; a secure deletion file shredder; and an active Do Not Track system to keep advertisers and others from tracking your online activity.
Webroot isn’t so open-handed. Most of the Bitdefender features I mentioned don’t show up in the Webroot product line at all. You do get password management at the suite level, but that’s about it.
Bitdefender’s Network Threat Prevention aims to fend off exploit attacks, a job often associated with firewall protection, but for an actual firewall component you must upgrade to a Bitdefender suite. Webroot offers firewall protection even in the standalone antivirus, which is a nice plus.
You will find a handful of tools in Webroot that don’t have an equivalent in Bitdefender. However, most of these are tech-oriented, not for the average user. For example, you can run a suspect process in the sandbox, remove malware threats manually, or undo system changes malware might have left behind such as changing the desktop wallpaper or screensaver.
Bitdefender offers more and more useful bonus features.
Winner: Bitdefender.
And the Winner Is…
Clearly, these two products take quite different approaches to antivirus protection. Bitdefender is mainstream, with kudos from many testing labs and a veritable cornucopia of useful security bonuses. Webroot’s uncommon detection style makes it unsuited to many lab tests, but it’s the smallest and fastest around, and it demonstrably can reverse the effects of ransomware. Bitdefender costs less if you’re protecting more than a few computers. But Webroot regularly matches or outperforms Bitdefender in our hands-on testing.
It’s a close call, but Bitdefender wins. For the average user, its excellent lab scores and wealth of bonus features make it irresistible. Webroot is also very worthy of consideration, especially if you’re more tech-savvy than the average bear. You can’t beat it for size and speed, and our testing shows that its journal-and-rollback system really works.
