Quick answer. "Antivirus" is now a label for four largely separate mechanisms sold together: matching known-bad files, judging unknown files by their characteristics, watching what running programs do, and blocking dangerous web addresses before the browser loads them. They fail in different ways, which is why products bundle all four rather than perfecting one.
The word is a historical accident. Products in this category have not been mainly about viruses for a long time, and the file-scanning most people picture is now the least interesting part of what they do. Understanding the four mechanisms separately makes product pages much easier to read, because each advertised feature is an implementation of one of them.
Four mechanisms in one box
| Mechanism | Catches | Typical failure |
|---|---|---|
| Signature matching | Malicious files that have been seen and catalogued before | Misses anything new or modified enough to change its pattern |
| Heuristics and static analysis | Files that resemble known-bad ones without being identical | Flags harmless software that shares those characteristics |
| Behaviour monitoring | Programs that begin acting maliciously after they are running | Only intervenes once something has started; some damage may precede it |
| Web and email filtering | Dangerous addresses and attachments before they reach you | New addresses are unknown until reported; blocks legitimate sites occasionally |
Signature matching
The oldest approach and the simplest to describe. When a malicious file is identified, analysts extract a pattern that identifies it — historically a hash or a distinctive byte sequence — and distribute that pattern to every installation. The scanner compares files it encounters against its catalogue and quarantines matches.
Its strength is precision. A signature match is close to certain, which is why signature detections rarely produce false alarms. Its weakness is structural and cannot be engineered away: a signature can only describe something already discovered. Malicious software that is generated afresh for each campaign, or altered slightly between victims, does not match anything in the catalogue on the day it arrives.
This is why update frequency matters more than catalogue size in vendor marketing, and why a scanner that has not updated for weeks is substantially less useful than the same scanner updated this morning.
Heuristics and static analysis
Heuristic analysis asks a different question: not "have I seen this exact file before" but "does this file have the characteristics of things that turned out to be malicious". It inspects structure, packing, the system functions the code refers to, and dozens of other traits, then scores the result.
This catches variants and some genuinely new material, which signatures cannot. The cost is the false positive. A legitimate program that compresses itself, modifies files in bulk or asks for unusual permissions can score like malware, and every scanner occasionally quarantines something harmless. That trade-off is permanent: tuning heuristics to catch more inevitably catches more of the wrong things, and tuning them to complain less inevitably misses more.
If something you trust is quarantined
Do not immediately create an exclusion. Check that you obtained the software from its official source, and if you are confident, report the file to the vendor as a suspected false positive rather than switching the protection off. Broad exclusions — a whole drive, a whole folder that downloads land in — defeat the product you are paying for.
Behaviour monitoring
The mechanism that matters most against current attacks, and the one least visible to users. Rather than judging a file before it runs, behaviour monitoring watches processes while they run and intervenes when a sequence of actions looks like an attack: a document process spawning a command shell, a program enumerating and rewriting files across a drive, software attempting to disable protection or delete recovery points.
It exists because a growing share of attacks do not involve an obviously malicious file at all. They use legitimate system tools, stolen credentials, or the user's own authorisation. Nothing on disk is suspicious, so nothing on disk can be matched. What is suspicious is the pattern of activity.
The trade-off here is timing. Behaviour monitoring by definition acts after something has begun, so its value is measured in how early it intervenes and how much it can undo. This is also the mechanism that makes backups matter: protection that stops an encryption attack in progress still leaves whatever it encrypted first, and only a backup answers that. The Australian Cyber Security Centre's guidance for individuals treats regular backups as core practice rather than an extra; see cyber.gov.au.
Web and email filtering
Most consumer compromises now begin with a link or a message rather than an infected file, so filtering the request before the browser makes it has become the front line. The filter compares the address you are about to visit against reputation data and blocks or warns on the ones known to be harmful.
Browsers do a version of this themselves and have for years, which is worth knowing before paying for it twice. The distinction a security product usually claims is coverage beyond the browser — links opened from a messaging application or an email client, and filtering that applies system-wide rather than per browser.
The unavoidable limit is newness. A fraudulent site registered this morning has no reputation yet, and the first people to receive the link are not protected by reputation data. That is why the advice to check the address yourself never becomes obsolete, and why recognising the approach remains more reliable than any filter.
The bundled extras
Modern subscriptions include tools that are not antivirus at all, and it helps to price them separately in your head.
- VPN
- Encrypts your traffic to a server operated by the provider and presents that server's address to sites you visit. Useful on untrusted networks and for keeping your traffic from your network operator. It does not stop malware, does not make you anonymous, and moves your trust to the VPN operator rather than removing the need to trust anyone.
- Password manager
- Generates and stores unique passwords so that one leaked credential does not unlock everything else. For most households this closes a larger gap than any scanner does, because credential reuse is how a single breach becomes several.
- Breach or identity monitoring
- Watches for your email address or other details appearing in published breach data and alerts you. Useful as a prompt to change a password. It cannot remove your data from anywhere, and it does not prevent a breach.
- Tune-up and cleaning tools
- Delete temporary files and adjust startup items. Modern operating systems maintain themselves adequately, and the security value of these tools is close to nil. Treat them as filler when comparing bundles.
What none of it does
No combination of these mechanisms protects against a person being persuaded. If someone rings, convinces you they are from your bank, and talks you through authorising a transfer yourself, no software in this category intervenes — the actions are yours and they are authorised. Scamwatch, at scamwatch.gov.au, publishes the approaches currently circulating in Australia, and reading them occasionally is worth more than any product feature.
Nor does any of it substitute for updates. Security software runs on top of an operating system; a system with unpatched flaws gives an attacker a route underneath the protection entirely. Updates first, backups second, unique passwords and multi-factor authentication third. Products come after that, not instead of it.
Terms you will meet
- Zero-day
- A flaw exploited before a fix is available. Relevant to this category because signatures cannot describe an attack nobody has catalogued.
- Quarantine
- Isolation of a suspect file so it cannot run, without deleting it, so a mistaken detection can be reversed.
- Potentially unwanted program
- Software that is not malicious but that most users would not knowingly install — toolbars, bundled extras, aggressive adware. Products differ on whether they flag these, which is one reason two scanners disagree about the same computer.
- Real-time protection
- Checking files as they are opened, written or executed, rather than only during a scheduled scan.
- Sandbox
- An isolated environment an application runs in without access to the rest of the system. Central to how mobile platforms work, and the reason phone security apps behave so differently.