To judge whether a security product is worth your money, it helps to know how it does its job. The good news is that the core ideas are not complicated. An antivirus program is essentially a very diligent inspector: it looks at the files and activity on your device and tries to tell the harmless from the harmful. It does this in a few different ways at once, because no single method catches everything.
Signature-based detection
The oldest method compares files against a list of known threats. Every known piece of malicious software has recognisable characteristics — a kind of fingerprint, called a signature. The antivirus keeps a large, frequently updated database of these fingerprints and checks the files on your device against it. If something matches, it is flagged.
This approach is fast and accurate for threats that are already known, which is why keeping the program updated matters so much: an out-of-date signature database cannot recognise something discovered last week. Its weakness is equally clear. Brand-new malicious software, which nobody has catalogued yet, has no signature to match, so signatures alone will miss it. That is why modern products do not rely on them alone.
Heuristic and behaviour-based detection
To catch the unknown, security software also looks at how a program behaves and how it is built. Heuristic analysis examines a file’s structure and code for characteristics that tend to appear in malicious software, even without an exact fingerprint match. Behaviour-based monitoring goes further and watches what a program actually does once it runs: Is it trying to modify system files it has no reason to touch? Is it quietly encrypting large numbers of documents? Is it attempting to contact a suspicious address on the internet?
These methods can catch genuinely new threats, which is their great strength. The trade-off is that judging intent from behaviour is inexact, so they can occasionally raise a false alarm about a legitimate program — what is called a false positive. Vendors spend a great deal of effort tuning this balance, and it is one of the things independent testing labs measure.
Real-time protection versus on-demand scanning
There are two moments at which checking can happen. On-demand scanning is when you (or a schedule) ask the program to examine the device and report back — useful for a periodic sweep. Real-time protection runs continuously in the background, checking files as they are opened, downloaded or executed, so that something dangerous is caught at the moment it tries to act rather than hours later during a scheduled scan. Real-time protection is the more important of the two for day-to-day safety, and it is a standard feature in both built-in and paid products.
What the built-in protection already does
On Windows, Microsoft Defender provides real-time, signature and behaviour-based protection out of the box, and it updates automatically. Apple’s macOS includes comparable built-in defences. In other words, most modern computers arrive with several of the mechanisms described on this page already switched on. Microsoft documents how Defender works on its own support pages.
Cloud lookups and reputation
Many products now supplement local checks with cloud-based lookups. When the software encounters a file or website it is unsure about, it can query the vendor’s servers, where far larger and more current data can inform the decision within moments. Reputation systems work on a similar principle: a file downloaded by millions of people over a long period is treated differently from one that has been seen only a handful of times. This is helpful for speed and accuracy, but it does mean the software communicates with the vendor about what it is checking — something worth being aware of, and something a good vendor explains in its own privacy documentation.
Quarantine and removal
When the software decides a file is dangerous, it usually does not delete it outright. Instead it moves the file to quarantine — an isolated holding area where the file cannot run or cause harm. This matters because detection is not infallible. If the program was wrong and the file was actually legitimate, quarantine lets you restore it. If it was right, you can delete it permanently. This cautious, reversible approach is a sign of software that respects the possibility of its own mistakes.
Why layers matter
No single technique is complete. Signatures are precise but blind to the new; behaviour monitoring catches the new but is less precise; cloud reputation adds context but needs a connection. Effective protection combines them, so that a threat missed by one layer is likely to be caught by another. This is the same “defence in depth” idea that security professionals apply everywhere, and it is a useful lens when you read a product’s feature list: you are really asking how many independent layers it brings, and how well they are tuned.
What to watch out for
Be sceptical of any product or advertisement that promises “100% protection”, being “completely undetectable” to threats, or a guarantee that you will never be infected. No responsible vendor makes those claims, because no software can honestly back them. Detection is a moving target, and the honest framing is always about reducing risk, not eliminating it.
Sandboxing: testing in a safe room
Some products add another technique for dealing with the unknown: they run a suspicious file in a sandbox, an isolated, tightly controlled environment separated from the rest of your system. Inside that sealed room the software can watch how the file behaves — whether it tries to alter system settings, contact the internet, or encrypt files — without letting it touch anything real. If it behaves maliciously, it is stopped and never allowed out; if it behaves normally, it can be released. Sandboxing is powerful precisely because it judges by observed behaviour rather than by a fingerprint, though it costs some time and computing effort, which is why it tends to be used selectively.
What actually happens during a scan
When a scan runs — whether you started it or it runs on a schedule — the software works through the files it has been asked to check, comparing each against its signatures, applying heuristic rules, and consulting cloud reputation where relevant. A quick scan looks only at the places threats most commonly hide, such as memory and system folders, and finishes in minutes. A full scan examines everything on the drive and can take much longer, which is why it is usually best left to run when you are not using the device. Anything flagged is moved to quarantine, and you are shown a summary. None of this requires you to understand the internals; it simply helps to know that a long scan is normal and not a sign that something is wrong.
Why updates matter more than scans
It is tempting to think of the periodic scan as the main event, but for most people the quieter work matters more: the constant updates to the signature database and the software itself, and the real-time protection running in the background. A device that updates promptly and keeps real-time protection on is defended continuously, whereas a scheduled scan is only a periodic double-check. If you ever have to choose where to spend attention, keep updates and real-time protection healthy first.
The takeaway
Antivirus software works by inspecting files and behaviour through several complementary methods, updating constantly, and isolating what it judges to be dangerous. Understanding this makes the next step far easier, because the features vendors advertise are, for the most part, particular applications of these same ideas — plus some extras that have little to do with detection at all. That is exactly what we untangle next.