How we review security software

The sources we use

Every claim on a review comes from one of these source types, and the page links to the exact document with the date we checked it.

1. Vendor documentation and pricing. The vendor’s own pricing page, plan comparison, help center, terms of service and security documentation. We record first-term and renewal prices separately.
2. Independent lab results. Published results from AV-TEST, AV-Comparatives and SE Labs (and other labs that publish their method, such as MRG Effitas). We name the lab, the test, the period tested and the report.
3. Independent audits. Third-party security audits, penetration test reports and no-logs audits that the auditor or vendor has published, with the auditor’s name and the audit date.
4. Breach and regulator history. Incidents the vendor or credible reporting has disclosed, and actions by regulators such as the FTC, state attorneys general and data protection authorities, stated as who, what and when, with a link.
5. Privacy policies. What the product collects, how long it keeps it and who it shares it with, quoted from the current policy.

For background statistics we cite government sources such as the FBI Internet Crime Complaint Center, the FTC, CISA and NIST.

What we don’t do

• We don’t run our own lab tests, malware tests or speed tests, and no page says otherwise.
• We don’t publish star ratings or scores we didn’t produce, and we don’t mark up pages with review-star schema.
• We don’t cite other affiliate sites or listicles as evidence.
• If a source can’t be checked, we mark the claim unverified or leave it out.

How we rank

• Every ranked list prints its single criterion, or a short scoring method with each input shown, above the list.
• Products are sorted strictly by that criterion. Ties share a rank and are listed alphabetically.
• We include products whose vendors don’t pay us. A product is left out only for a reason printed under the list, such as no published price or no independent results to rank on.
• Affiliate or referral status never changes a product’s position, its verdict or what we say about it.

Prices

Prices come from the vendor’s own site and show the date we checked them. Many security products discount the first term and renew at a higher price; we show both when the vendor publishes both. Totals we calculate are labelled as our sums of published prices.

How often we update

• We re-check prices on our most-read pages every month and on every other page at least every quarter.
• We update lab results when a lab publishes a newer report that covers a product we rank.
• We update a page when a vendor changes a plan or a policy, or when a breach or regulator action becomes public.
• Any material change updates the page’s “Last reviewed” date. We never backdate a page.

Corrections

If we get something wrong, we fix it, note the change at the bottom of the page and update its review date. Send corrections with a source through our contact page.