Antivirus and device security, term by term

AgileBase is a reference to the vocabulary consumer security software is sold in, written for readers in Australia. Look up a word, see what it actually commits a vendor to, and find the question worth asking next.

• Real-time protection
• Signature
• Heuristic analysis
• False positive
• Quarantine
• Device licence
• Auto-renewal
• Potentially unwanted program
• Zero-day
• Sandbox
• Full glossary →

What a reference like this is for

Consumer security software is sold in a vocabulary that the buyer is assumed to already understand. A product page promises real-time protection, heuristic detection, a firewall, a password vault and coverage for five devices, and expects the reader to work out which of those matter to them, which overlap with what their computer already does, and which are simply names for the same mechanism described twice.

AgileBase takes the vocabulary one word at a time. Each entry says what the term means, what it does not mean, and what question it should prompt you to ask before you pay for anything. The entries are cross-linked, because the terms are: you cannot understand a false positive without understanding a signature, and you cannot judge a device licence without knowing how the vendor counts a device.

This is a reference, not a testing laboratory. AgileBase does not run malware samples, does not score products, and does not publish detection rates. Where a number would be needed to answer a question properly, the page points to the organisation that publishes it rather than inventing one.

Ten words that decide most antivirus purchases

These are the terms that most often separate what a buyer thinks they are getting from what they have actually bought. Each links to its full entry in the glossary.

Real-time protection

Scanning that happens as files are opened, written or downloaded, rather than only during a scan you start. Almost every paid product includes it; the useful question is what it inspects and what it leaves alone.

Signature

A pattern that identifies a known piece of malicious software. Signature matching is exact and cheap, which is why it is fast, and why it is blind to anything written after the last update.

Heuristic analysis

Judging a file by its structure and instructions rather than by a known pattern. It catches variants that no signature covers, and it is the main reason false positives happen.

False positive

A clean file flagged as malicious. The cost is rarely the alert; it is the quarantined file that some other program needed.

Device licence

The unit a subscription is sold in. Vendors differ on whether a phone counts as a device, whether a licence moves between machines, and what happens when you exceed the count.

Auto-renewal

The default on most security subscriptions. The renewal price and the introductory price are separate numbers, and the gap between them is the single most common source of complaint in this category.

Potentially unwanted program

Software that is not malicious but that most people would not knowingly install — toolbars, bundled utilities, aggressive adware. Whether a product removes these by default varies.

Zero-day

A weakness being exploited before a fix exists. The term describes the timing of a flaw, not a category of product feature, though it is frequently used as one in marketing copy.

Quarantine

A holding area for files the product has judged unsafe. Knowing how to look inside it and restore from it matters more than most buyers expect.

VPN

A tunnel that hides your traffic from the network you are using and your address from the site you visit. It is bundled with many security suites and answers a different question from malware detection.

A worked example: reading a vendor's feature list

Take a typical line from a product page: real-time protection with cloud-based threat detection across all your devices. Three separate claims are packed into eleven words, and each of them has a question attached.

1. Real-time protection tells you the scanning is continuous. It does not tell you which file types are inspected, whether archives are opened, or whether scripts running in memory are covered. Those are separate capabilities.
2. Cloud-based threat detection means an unknown file's fingerprint is checked against the vendor's servers. That makes reaction time faster, and it means the product is less useful without an internet connection. It also means data about what you run leaves your machine, which is a privacy question the vendor's own privacy policy should answer.
3. All your devices means all the devices your licence covers. The number, the platforms and the counting rule are in the subscription terms, not the headline.

None of this makes the sentence dishonest. It makes it compressed. The way to read a vendor page is to expand each phrase back into the question it answers, then check the vendor's own documentation for the part the phrase left out.

TotalAV is the product AgileBase covers in this way, and it is an advertiser here. Its own site is the authoritative source for what its subscriptions currently include, which platforms are supported and what the renewal terms are — figures that change, and that this site therefore does not restate.

Visit the TotalAV website

Paid link. AgileBase receives a commission if a subscription is purchased after you follow it. The price you pay is set by the vendor and is the same either way.

What this site covers, and what it leaves out

The glossary is general: it explains the category, and the definitions apply to any product in it. The product coverage is narrow, and deliberately so. AgileBase writes about TotalAV because the publisher has a commercial relationship with it, and it says so on every page where that product appears. There is no second product being quietly ranked below it, and no comparison table in which the advertiser happens to come first.

What that means in practice: treat this site as a way to understand the category and to arrive at a vendor's page knowing what to look for, not as a survey of the market. For a broader picture you will want more than one source, and the products covered page explains exactly where the boundary sits.

Where the pages fit together

• Glossary

  The core of the site: around fifty terms, defined and cross-linked, from adware to zero-day.

• How detection works

  What happens between clicking a file and seeing an alert, method by method.

• Choosing software

  The comparison questions worth asking, and the billing terms worth reading before you agree to them.

• Device coverage

  How licences are counted across desktops, phones and tablets, with a worked household example.

• Products covered

  What AgileBase can and cannot tell you about TotalAV, and how to verify the rest.

• Scams and your rights

  Australian reporting routes, consumer guarantees, and the regulators behind them.

• Questions

  Short answers to the questions people actually type, each pointing back to the relevant entry.

Australian services worth knowing about

Several public bodies publish free guidance in this area, and they are the right first stop for anything this site treats as general information.

• The Australian Cyber Security Centre, part of the Australian Signals Directorate, publishes practical guidance for individuals and families and operates the ReportCyber service for reporting cybercrime.
• Scamwatch, run by the National Anti-Scam Centre at the ACCC, collects scam reports and describes current scam types, including the fake technical-support calls and pop-ups that borrow the language of antivirus software.
• The ACCC is the national competition and consumer regulator and administers the Australian Consumer Law, which applies to software sold to Australian consumers.
• The Office of the Australian Information Commissioner regulates the Privacy Act 1988 and handles privacy complaints.
• The eSafety Commissioner is Australia's independent regulator for online safety and handles complaints about cyberbullying, image-based abuse and seriously harmful online content.

How the definitions are written