Guide

How antivirus software actually works

By Elizabeth JonesPublished 22 September 2026Last reviewed 22 September 2026

Three different techniques are doing the work, they fail in different ways, and knowing which is which tells you what the product can realistically do for you.

No partner links on this page. This guide is reference material and carries no commercial links. The site as a whole is funded by partner links on our buyer's guides — see the affiliate disclosure.

The three layers

Every mainstream engine combines signature matching, behavioural analysis and cloud reputation. They are not alternatives; a file has to get past all three.

Three stacked layers of malware detection: signature matching against known fingerprints, behavioural analysis of what a running program does, and cloud reputation based on how common and how well-behaved a file is elsewhere. — **Figure 1.** The layered structure common to mainstream engines. Original diagram drawn by us.

Signature matching: precise, and permanently behind

A signature is a fingerprint — historically a hash of the file, in practice something more flexible that survives minor edits. The engine hashes what arrives and looks it up in a database that is refreshed many times a day. When it matches, the verdict is certain and the cost is near zero.

The weakness is structural, not fixable: a signature can only describe something that has already been analysed. Attackers repack or recompile a payload for each campaign, which produces a file nobody has ever seen. Signature matching alone has not been sufficient for roughly two decades, which is why no serious product relies on it alone.

Behavioural analysis: the layer that catches the new thing

Here the engine stops asking what the file is and starts watching what the process does. Characteristic sequences are things like: enumerating the documents folder and rewriting every file; deleting Windows shadow copies so recovery is impossible; writing itself into a startup location; injecting code into another running process; contacting a freshly registered domain on an unusual port.

None of those actions is malicious by itself. A backup tool reads all your documents. An installer writes to startup. The judgement is about the combination, and that is why behavioural analysis produces false positives: an unusual but legitimate tool can look exactly like the thing the engine is trained to stop. This is a trade-off, not a defect. An engine tuned to never flag anything legitimate would also miss the real thing.

Cloud reputation: prevalence as evidence

The engine sends a fingerprint, not the file itself, to the vendor and asks what is known about it: how many machines have seen it, how long it has existed, whether it carries a valid code-signing certificate, whether it has misbehaved elsewhere. Rarity and youth are suspicious; ubiquity and age are reassuring. This is how vendors react quickly to a campaign that is spreading, and it is also why a genuinely obscure piece of niche software sometimes gets treated with suspicion.

What quarantine actually does

When a file is convicted, a well-behaved engine does not delete it. It moves it into a quarantine store, usually encrypted or otherwise neutered so it cannot execute, and records where it came from. That matters because the verdict may be wrong: quarantine is reversible and deletion is not. If a tool you trust disappears after an update, look in quarantine before reinstalling anything.

Flow diagram showing a file arriving, a real-time hook pausing the write, the engine deciding, and the file either opening normally or being moved to a reversible quarantine. — **Figure 2.** Where the interception happens: on write, before execution. Original diagram drawn by us.

What the engine is looking for

The categories behave differently enough that the symptom you should watch for is different in each case.

Six malware categories with what each wants and the usual sign of infection: ransomware, infostealers, trojans, rootkits, adware and browser hijackers, and cryptominers. — **Figure 3.** Six categories, six different symptoms. Original diagram drawn by us.

The honest limits

Nothing catches everything. Public comparative tests exist precisely because detection rates differ and move between rounds.
A scanner does not defend against you. If you are persuaded to type your password into a convincing fake, no engine intervenes.
Backups beat detection for ransomware. A current offline backup turns a catastrophe into an afternoon. Detection is the first line; backup is the one that actually holds.
Updates matter more than brand. An unpatched browser or operating system undoes a great deal of what any scanner buys you.

Sources

AV-TEST Institute — test methodology and published results: av-test.org
AV-Comparatives — real-world protection test methodology: av-comparatives.org
Microsoft, Microsoft Defender Antivirus documentation: learn.microsoft.com
CISA, StopRansomware guidance: cisa.gov/stopransomware

Where this guide and a vendor's own documentation diverge, the publisher's information prevails. Implementation details differ between products and versions.