Home › How the software works

How antivirus software actually works

Five different techniques run under the single word "antivirus". Knowing which is which explains why the software sometimes stops something instantly, sometimes flags a file you trust, and sometimes does nothing at all.

Reviewed by the Arcadia Group editorial team · Last reviewed 17 September 2026

The job, stated plainly

An antivirus product tries to answer one question, repeatedly and fast: is this file, or this running process, something the user would object to? It has to answer in milliseconds, without the benefit of hindsight, and without being wrong often enough to become annoying. Every design decision inside these products is a compromise between those three pressures — speed, accuracy and tolerability.

The answer is assembled from several independent techniques layered on top of each other. No single layer is sufficient, and the marketing names vendors give them obscure how ordinary the underlying ideas are.

Layer one: signature matching

The oldest technique, and still the fastest. The vendor calculates a distinctive fingerprint of a known malicious file — a cryptographic hash, or a pattern of bytes found in it — and ships that fingerprint to every installation. When a file's fingerprint matches an entry in the list, the verdict is immediate and essentially certain.

The limitation follows directly from the method: it only recognises what has already been seen and catalogued. An attacker who changes a single byte produces a file with a different hash. This is why the definition list updates constantly, and why "when did this last update?" is a more useful question about a security product than almost any feature name.

Layer two: static analysis and heuristics

Rather than matching a whole file, the engine inspects its structure without running it: which system functions it imports, whether its code is packed or obfuscated, whether its declared purpose matches its contents, how it was signed. Individually these signals mean little. Combined and weighted, they produce a score, and above a threshold the file is treated as suspicious.

Heuristic detection catches variants that signature matching misses, and it is also the main source of false positives. Legitimate software sometimes does unusual-looking things — installers unpack themselves, developer tools inject code, small utilities from independent authors are unsigned — and a scoring system with no knowledge of intent cannot always tell the difference.

Layer three: cloud reputation lookups

When an unfamiliar file appears, the product can ask the vendor's servers what is known about it: how many other installations have seen it, how recently it first appeared anywhere, whether it is associated with a known publisher. A file seen by millions of machines over three years is treated differently from one that appeared an hour ago on four machines worldwide.

This is effective and it has a privacy dimension worth understanding. Reputation lookups involve sending information about files on your computer — commonly a hash, sometimes metadata, occasionally a sample — to the vendor. What is sent, and what the vendor may do with it, is described in the vendor's own privacy documentation, and reading that document is a reasonable part of choosing a product. The Office of the Australian Information Commissioner explains the principles that apply to handling personal information in Australia at oaic.gov.au.

Layer four: sandboxing and emulation

Some products will run a suspicious file in a constrained environment first — a virtual space where its actions are observed but cannot affect the real system. If it immediately tries to encrypt files, disable security tooling or contact a command server, that behaviour is visible before any damage occurs.

Emulation costs time and processing power, which is why it is applied selectively rather than to every file. It is also something malware authors design against: code that detects it is being watched and behaves innocently until it is not.

Layer five: behaviour monitoring on the live system

The final layer watches what programs actually do once running. Rapid sequential encryption of documents, modification of system startup entries, attempts to read another process's memory, a text editor suddenly opening network connections — these are patterns rather than files, and they can be recognised in software that passed every earlier check.

Behaviour monitoring is the layer most likely to stop something genuinely new, and the layer most likely to interrupt legitimate but unusual activity. It is also the technical basis for the folder-shielding features that vendors market as ransomware protection.

When the software is wrong about a file

False positives are not a malfunction; they are the visible cost of detection that reaches beyond known files. Handling one sensibly matters, because the instinctive response — clicking "allow" to make the message stop — is also the response an actual attacker is relying on.

1. Note what was flagged and where it came from. A file you downloaded deliberately from a publisher you know is a different situation from one that appeared in a temporary folder.
2. Leave it in quarantine. Quarantine is reversible — the file is neutralised, not destroyed — which is precisely why it is the default rather than deletion.
3. Check the publisher's own channels. Developers of small utilities often document known false positives themselves.
4. Report it to the vendor. Every major product has a submission route for suspected false positives, and reports are how the weighting gets corrected for everyone.
5. Only then consider an exclusion, and make it as narrow as possible — one file, not an entire drive.

What this software does not do

Being clear about the boundary is more useful than any list of features, because the gaps are where people are actually caught out.

• It does not stop you giving someone your password. Credential phishing works on the person, not the machine. Web filtering blocks some known imitation sites; it is not a complete answer.
• It does not undo a payment you authorised. Scams that persuade a person to transfer money involve no malicious code at all. Scamwatch, run by the National Anti-Scam Centre, collects and publishes current approaches at scamwatch.gov.au.
• It does not replace backups. Detection that fails once against ransomware costs you the files; a recent offline copy costs you an afternoon.
• It does not secure an account that has been breached elsewhere. When a service you use is breached, the exposure is at the service, and the remedy is a changed password and multi-factor authentication.
• It does not fix a compromised router or an out-of-date operating system. Desktop software defends the desktop.
• It does not make anonymity. A bundled VPN changes which network sees your traffic. It is not invisibility, and treating it as such leads people to take risks they otherwise would not.

Where to go next

With the mechanics in hand, the practical questions become easier to answer. Free versus paid protection looks at which of these layers you get without paying. Windows, macOS and Linux covers which of them your operating system already runs. And choosing antivirus software puts the whole decision in order.