Comparing security software without the marketing
The short answer
Comparison in this category is difficult because the thing being compared — how well a product detects things — cannot be observed by an ordinary buyer. You cannot test it at home, and the vendor’s own figures describe tests the vendor designed. What you can do is judge the cost of ownership, the terms, the licence coverage and the support, and take detection performance from independent laboratories that publish their methods.
Why the obvious approach does not work
With most purchases, a trial tells you something. Install two products, use them for a fortnight, keep the better one. Security software defeats that method: if neither product reports anything during your fortnight, you have learned nothing about which would have caught the file you never encountered. Absence of alerts is the expected state for both a good product and a useless one.
This is why the marketing in this category leans so heavily on impressions of thoroughness — dashboards, counters, scan animations, tallies of items checked. Those are interface decisions, not measurements. A product with a quiet interface may be doing more than a noisy one.
The method used on this site
StrataSpace does not test security products. We have no laboratory, no malware collection and no means of running a controlled comparison, and publishing scores we could not defend would be worse than publishing nothing. What this library does instead is set out the questions that can be answered from documentation a buyer can read, and point to the organisations that do test.
Where a product-specific fact cannot be verified from material we have, the entry says it is not verified rather than repeating the vendor’s wording as though it were established. That is the rule applied in the Norton AntiVirus Plus entry, which is the one product on this site with a commercial arrangement behind it.
Where independent testing comes from
A small number of laboratories test consumer security products on a regular schedule and publish both their results and their methodology. The methodology is the part that matters. A result is only interpretable if you know how many samples were used, how fresh they were, whether the products were connected to their cloud services, how false positives were counted, and who paid for the test.
Read any test with three questions in mind. Over what period, since a single month is noise and a year of results is a trend. Against which competitors, since a favourable field is easy to assemble. And with what false-positive rate, since detection figures alone can be inflated by a product willing to block anything unfamiliar — a point covered in the entry on how detection works.
Be sceptical of any award badge presented without a link to the underlying report. A badge is an image; the report is the evidence.
What you can assess yourself, before buying
| Question | Why it matters | Where the answer is |
|---|---|---|
| What is the renewal price, in AUD? | Introductory pricing and renewal pricing are frequently different figures, and the second is the one you pay repeatedly | Vendor’s pricing page and subscription terms |
| Does it renew automatically, and how is it cancelled? | Determines whether a decision is required from you each year, or a charge simply occurs | Subscription terms; account settings after purchase |
| How many devices, and which platforms? | A licence count means little if the protection on one of those platforms is thin — see the platform entry | Product specification page |
| What is the refund position? | Sets what happens if the product is unusable on your machine, alongside your rights under Australian Consumer Law | Refund policy; consumer rights entry |
| What data does the product send to the vendor? | Reputation lookups involve sending information about files on your device | Vendor’s privacy policy, not its marketing pages |
| What support exists, and in which time zone? | Determines whether help is available when a problem occurs in Australian hours | Support pages; published hours |
Performance, which is the cost people actually notice
Detection is invisible; slowness is not. A real-time scanner inspects files as they are opened, written and executed, which adds work to ordinary operations — starting applications, copying folders, installing updates, building software. On a recent machine with a solid-state drive the difference is usually small. On an older machine, or one with a mechanical drive, it can be the difference between tolerable and irritating.
The independent laboratories measure this alongside detection, and their performance figures are worth as much attention as their detection figures, because a product that makes a computer unpleasant to use tends to get disabled — at which point it protects nothing. If you are choosing for a machine that is already slow, weight this heavily.
A worked example of the reasoning
A household has a five-year-old Windows laptop, a current Mac, two Android phones and an iPad. A suite is advertised as covering five devices. Applying the questions above: the iPad gains no file scanning at all, because iOS sandboxing prevents it; the Mac gains mainly grey-zone detection on top of what it already has; the phones gain something if applications are ever installed from outside the Play Store, and little if they are not; the Windows laptop is the device where a substitution for Defender is a genuine question, and also the device most affected by the performance cost.
That is one clear candidate out of five devices, not five. The conclusion might still be to buy, if the bundled password manager or backup storage is wanted in its own right. The point is that the licence count was never the measure.
Common reasoning traps
- Comparing an introductory first-year price against another product’s ongoing price. Compare renewal against renewal.
- Counting bundled extras as value without asking whether you would otherwise buy them. A password manager you will not use adds nothing.
- Treating a longer feature list as better protection. Detection quality and feature count are unrelated measures.
- Reading a review site’s ranking without checking how it is funded. Most are affiliate-funded, this one included, which is why the funding is disclosed.
- Assuming the same product is equally appropriate on every device you own.
- Buying additional software while the operating system on the device is out of support. The order of operations is wrong.
Questions readers ask
No law requires it, and no Australian regulator states that a consumer must buy security software. Whether it is worthwhile depends on the platform, how software reaches the device, and whether the built-in protection is enabled and current. The Australian Cyber Security Centre publishes vendor-neutral guidance for individuals and small business.
Two products doing real-time scanning simultaneously tend to conflict, because each treats the other’s file access as suspicious. The usual result is instability and slowness rather than double protection. On Windows, installing a third-party product generally causes Microsoft Defender’s real-time protection to stand down for this reason.
No. They address different things. A VPN affects who can observe your network traffic in transit; it does not inspect files, block malicious downloads, or remove anything already on the device. Products are often bundled together, which encourages the confusion.
Because most rankings reflect a mixture of testing data, feature weighting and commercial arrangements, and the weighting is a choice rather than a finding. A ranking is interpretable only when the site states its method and its funding. Ours are on the about page and the affiliate disclosure page.
Check the quarantine before reinstalling anything, since the file is usually recoverable from there. Confirm the file came from the developer’s own source, then restore it and add an exclusion if you are confident. Reporting the false positive to the vendor is how the classification improves for everyone.
Claims that should lower your confidence in a source
- “Complete”, “total” or “guaranteed” protection. No detection method supports the claim.
- A rank ordering with no stated method beside it.
- Award imagery that does not link to a published report.
- A table in which one product wins every row. Genuine products trade capabilities against each other.
- Urgency attached to a security decision — a price that expires, a discount that ends tonight.