How to choose an antivirus: seven criteria that matter and three that are marketing.
Seven criteria that matter when choosing
Order matters: the first three eliminate products, the rest separate them.
1. Is the verdict explainable? If the product only says “threat found”, you cannot dispute a false positive and you learn nothing from the incident. Ask to see the rule, the engine and each one's contribution to the score.
2. What happens to your data? A product that uploads every scanned file to a cloud has an architecture that can be a privacy risk. Read the policy, not the slogan.
3. Can you recover anything after an incident? Detection without recovery is bad news delivered on time. Ask for encrypted quarantine, pre-write copies and a rollback you understand.
4. How fast does it scan, on a real disk? A 32 MB benchmark in 3.1 s is only useful if measured on the same machine. Ask for numbers that include prefiltering, not just the fast engine.
5. Does it work without internet? If the answer is “partially”, ask exactly what stops. A product that cannot give an offline verdict is not suitable for isolated networks.
6. Can you write your own rules? Teams that know what threatens them need an editable rule engine, with documented syntax and a prefilter that makes the economics of rules work.
7. What happens when the vendor disappears? Ask for offline activation, a grace period and a data format you can read. An antivirus that disarms itself when the server does not respond is a continuity risk.
Three criteria that are marketing
These are not lies, they are numbers without context. The problem is not that they exist, but that they are used as a substitute for an evaluation.
“Over a billion signatures.” The number of signatures says nothing about the detection rate on what matters to you. A million adware signatures do not help against new ransomware. Ask what happens with an unknown sample.
“AI-based detection.” It means very different things: a classifier trained on samples, a weighted heuristic or an LLM writing rules. Ask to see what it concretely produces and whether a human can verify the result.
“Cloud protection.” It can mean a useful reputation service or it can mean every scanned file leaves your machine. Ask what is sent, how long it is kept and what happens if you refuse.
Where Malnox loses, stated directly
A comparison where the vendor writing it wins every row is not a comparison, it is an ad. These are the cases where a big vendor is the better choice today.
Signature base: 67 targeted YARA rules and our own engine, against the millions of signatures of a vendor with two decades of collection. On known, widely spread malware a large vendor has the advantage.
Cloud reputation: our network is young. An unknown hash gets a better answer from a vendor with hundreds of millions of endpoints.
Fleet management: we have no multi-tenant central console. For 500 centrally managed endpoints, an enterprise product is the right choice.
Threat lab: we do not have one. We do not publish APT group reports and we have no researchers tracking campaigns.
VM detonation: our emulation is static, not a full virtual machine. A sample that only reveals itself under full execution can get through.
Where Malnox wins
Not for everyone, but for a precise profile: someone who wants to see why a decision was made, and who does not want their files leaving the machine.
Explainable verdict, per engine: each of the 17 engines writes its own score and the final formula is published. You can dispute a result with arguments.
Zero network calls in the detection path: unplug the cable and the verdict stays the same. Suitable for isolated networks, industrial environments and anyone who does not want documents analysed elsewhere.
Real speed through prefiltering: 32 MB in 3.1 s, 7× faster than 21.6 s without a prefilter, because impossible needles are eliminated before the rules are evaluated.
Your own rules, with documented syntax: an editable YARA engine and a guide that explains exactly what a 32 MB prefilter in 3.1 s does.
Transparency about limits: the list of real gaps is on the site, not in an internal PDF. A product that publishes its limits is easier to evaluate than one that hides them.
Decision table: what suits you
Four profiles, four honest answers. If you recognise yourself in the second or third row, Malnox is not the right choice for you today.
You want a local scanner, no account, on a personal computer → Malnox Free. All 17 engines, no real-time protection.
You want resident protection, ransomware guard and automatic updates on 1–10 computers → Malnox Complete, first year free.
You run an isolated network, a lab or an industrial environment → Malnox Complete with offline activation by file.
You have 500 endpoints, want a central console, EDR with automatic isolation and a threat lab → an enterprise product. We are not there yet, and we tell you before you lose a month on an evaluation.
Frequently asked questions about choosing an antivirus
For many users, it is. Defender has a good signature base, is integrated into the system and is free. A second scanner makes sense when you want a verdict you can read line by line, a second rule set and a result that depends on no connection. We do not ask you to disable it.
It means you can see exactly what contributed to the score: which YARA rule matched, what the PE engine found, what the heuristic reported, and with what weight. The final score is computed with a published formula, with written thresholds, not an average hidden inside a model.
On known malware, yes, if you have good signatures and rules. On new malware, a product with large-scale cloud reputation has a real advantage — we say so openly. What you gain instead is privacy and a verdict that works identically on an isolated network.
With harmless samples, not real malware: the EICAR test file, a signed installer, a document with macros disabled. Check three things: that the verdict is correct on EICAR, that it does not false-positive on the installer and that you can see why each decision was made. If the product does not show you the reason, you have the answer to the most important question.
It depends what you are buying. For a scanner, no: our Free plan includes all the engines. For resident protection, ransomware guard and automatic updates, yes — and at 3 EUR per year for one seat, cost is not the argument. The right question is whether the product shows you why it made a decision.
It means we analyse the structure and instructions of a binary without executing it in a fully isolated environment. It catches simple packers, suspicious APIs and behaviour patterns, but a sample that only reveals itself under full execution can get through. A sandbox with VM detonation is stronger and more expensive; we do not claim to have one.
Useful next steps
Try it on a file you already have.
The installer is 177 MB and asks for no account. Not convinced? Check a link above — the web engine is already running on this page.