01
Same corpus, two runs
A 32 MB set of representative files is generated — text, binary, archives, scripts — and scanned twice with the same configuration. The only difference between runs is the needle prefilter: on, then off.
Tests and measurements
The numbers on this site have a procedure behind them
Every figure published here has a measurement, and the measurement has a method you can read. Where we have no figure, we do not invent one.
Prefilter, measured
7×3,1 swith prefilter
21,6 swithout prefilter
32 MBcorpus scanned
2.770automated tests
The same detections in both runs — otherwise the figure would not be published.
The method
How 3.1 s and 7× came about
Four steps, in the order they run. None is optional: if step three fails, the figure from step two is not published.
02
Time is measured per run
The timer starts before the buffer is read and stops after the last engine has returned a score. Process startup and rule loading are not counted, because they are paid once.
03
Soundness is verified
A fast prefilter that loses detections is worse than none. Soundness tests run both variants over every sample in the corpus and compare the detection lists: if they differ by even one entry, the measurement is not published.
04
The measured number is published
The numbers above are the ones the run produced, not rounded up for a slide. An earlier version of this page showed 1.98 s and 12×; the correct measurement was 3.1 s and 7×, and the copy was changed.
What the tests cover
2.770 tests, eight areas
The number alone says nothing. What matters is what exactly is asserted, and what happens when something does not match.
The detection engines
Every engine has its own tests on synthetic samples: hand-built PE files, obfuscated scripts, nested archives, VBA macros, documents carrying personal data. Both detection and non-detection on clean files are asserted.
Score combination
The maximum plus 15% of the sum of the rest, capped at 100 — tested on edge cases: every engine at zero, one engine at 100, several engines at close values, impossible scores rejected.
Quarantine
A full round-trip: AES-256-GCM encryption, restore with tag verification, refusal of a blob changed by a single byte, compatibility with the legacy DQ1 format.
RBAC and API routes
Every route is called with every role — admin, analyst, viewer — plus with no token and with an expired token. The returned status is asserted, not merely that the route answers.
The prefilter
The soundness test described above: the same samples, with and without the prefilter, compared detection by detection. It runs in CI, not only locally.
The emulation sandbox
Payloads encoded in 1, 2, 4 and 8 layers, plus a 9-layer payload that must be reported as “too deep”, not as “clean”. Layer count, the rule that matched and the resulting text are all asserted.
The driver bridge
The filter-port client is tested against a simulated port: valid protocol, truncated reply, delayed reply, port unavailable. In every case a missing driver must report “unavailable”, never “protected”.
The hardening checks
The 24 Windows checks are tested against real command output, not invented text. An “unknown” result stays unknown in the score — a test fails if anyone turns it into a “pass”.
What we refuse
The limits of the measurements
A page of numbers is easy to inflate. Here is the part the charts never show.
What we do not measure
We have no detection figures on public corpora such as AV-TEST or VirusTotal. We do not recite them from memory or estimate them — we simply do not have them yet.
Where numbers do not compare
3.1 s for 32 MB is the time on this machine, with this corpus. On a slower disk, or with another antivirus scanning at the same time, the figure changes. We do not publish a “fastest in the world”.
What changes when things change
When a figure turns out to be wrong we correct it on the page and say we corrected it. The 1.98 s and 12× figure was retracted exactly that way.
Try it on a file you already have.
The installer is 177 MB and asks for no account. Not convinced? Check a link above — the web engine is already running on this page.