How antivirus actually works, explained in plain English
"Antivirus" is a slightly old-fashioned name. Modern security software doesn't just compare files against a list of known viruses. It layers four different methods on top of each other, because each one catches things the others miss. Understanding them makes it much easier to see through marketing claims.
1. Signatures: recognizing known threats
Security companies maintain huge databases of "signatures", which are digital fingerprints of files already known to be malicious. When a file arrives on your device, it's checked against that database. If it matches, it's blocked.
Strength: fast and very accurate for known threats.
Weakness: it can only recognize threats someone has already found and cataloged. Brand-new malware slips past.
2. Heuristics: spotting suspicious features
Heuristic analysis looks at how a file is built rather than looking for an exact match. It searches for features common in malicious software, such as code that tries to disguise itself, or instructions to disable security tools.
Strength: can catch new variations of known threats.
Weakness: legitimate software sometimes shares those features, which causes false alarms, where safe files get flagged.
3. Behavior monitoring: watching what programs do
Instead of judging a file before it runs, behavior monitoring watches what programs actually do. Is something suddenly encrypting hundreds of your files? That's how ransomware behaves. Is a program quietly changing startup settings, or trying to use the webcam with no window open?
Strength: the best defense against genuinely new threats, because it doesn't need to have seen them before. It's also what powers ransomware "rollback" features that can restore encrypted files.
Weakness: by definition, it acts once something has started to run.
4. Cloud checks: asking a live database
When a file or website is unfamiliar, most modern products check it against the company's constantly updated online database, drawing on reports from millions of other devices.
Strength: new threats can be blocked worldwide within minutes of being spotted anywhere.
Weakness: it needs an internet connection. This is why independent testers find that protection is weaker when devices are offline.
Why nothing catches 100%
Each layer has blind spots, and attackers constantly adapt to them. Layering all four narrows the gap considerably, which is why the best products block over 99% of threats in independent testing. But none reliably reaches 100% across large, real-world test sets.
That has two practical consequences:
- Be skeptical of absolute claims. "Guaranteed protection" or "blocks all threats" is marketing language, not a test result.
- Habits still matter. Keeping software updated, using unique passwords and being careful with links close gaps that no software can. See the six habits that matter most.
What about false alarms?
The more aggressively a product hunts for new threats, the more likely it is to flag innocent files by mistake. That's why the independent labs report false alarms alongside detection rates. In their 2026 testing, some products with near-perfect detection also produced 19 or 20 false alarms, while Microsoft Defender produced none. Both numbers matter when you choose. See the 2026 comparison.