A glossary of antivirus and device security terms

From adware to zero-day: what each term means in consumer security software, what it does not mean, and which entry to read next.

Around fifty terms, in the sense they carry in consumer security software rather than in academic literature. Where vendors use a word inconsistently, the entry says so instead of choosing one vendor's usage and presenting it as the meaning.

A

Adware: Software that displays advertising you did not ask for, often installed alongside something you did want. Most adware is not malicious in the legal sense, which is why products classify it as a potentially unwanted program rather than as malware, and why removal is sometimes optional rather than automatic.
Antivirus: Historically, software that detected viruses. Now a general label for consumer products that detect and remove malicious software of any kind, usually bundled with a firewall, web filtering and other tools. The name has outlived its accuracy.
Auto-renewal: The arrangement by which a subscription continues, and is charged again, unless cancelled. The renewal price is usually higher than the introductory price and is set out in the subscription terms rather than on the sales page. Check the renewal amount, the renewal date, and how cancellation is performed before subscribing, not after. See reading the billing terms.

B

Backdoor: A hidden route into a system that bypasses normal authentication. It may be left deliberately by malicious software so that access survives a password change, or it may exist by accident as a vulnerability.
Behavioural monitoring: Watching what a running program does — which files it opens, what it writes to, which network connections it makes — and acting when the pattern matches known malicious behaviour. Unlike signature matching, it can act on software it has never seen, but only after the program has started to run.
Botnet: A group of compromised machines controlled remotely as a unit, typically to send spam or to generate traffic against a target. An infected device may show no symptom its owner would notice, which is why detection tends to come from the network rather than the user.
Browser extension: An add-on that changes how a browser behaves. Security suites often install one to provide web protection. Because extensions can read page content by design, the permissions an extension requests are worth reading in the browser's own extension settings.

C

Cloud lookup: Sending a file's hash, or in some products the file itself, to the vendor's servers for a verdict. It shortens the gap between a threat appearing and a product recognising it, and it means some capability depends on a connection. What is transmitted is described in the vendor's privacy documentation.
Command and control: The server infrastructure that malicious software contacts for instructions. Blocking those connections is one of the things web protection and firewalls are for, and it can limit damage even when the initial infection was not prevented.
Cookie: A small text file a website asks your browser to store and send back on later visits. Some security products report tracking cookies as findings, which is a privacy judgement rather than a malware one. This site sets none; see the cookie policy.

D

Definition update: The regular download that adds new signatures and detection rules to an installed product. Separate from a program update, which changes the software itself. Products that have stopped receiving definition updates — usually because a subscription lapsed — keep running while becoming progressively less current.
Device licence: The unit a subscription is sold in. A five-device licence permits installation on five devices at once, but the rules that matter are in the detail: whether a phone counts the same as a laptop, whether a licence can be moved off a device you have sold, and what happens when the count is exceeded. See device coverage explained.
Dropper: A small program whose only job is to fetch and install something larger. Droppers are deliberately unremarkable, because the component that does the damage arrives afterwards and separately.

E

Encryption: Converting data so that it can only be read with a key. Used protectively in disk encryption and in VPN tunnels, and destructively in ransomware. The mechanism is the same; the question is who holds the key.
Endpoint: Any device that connects to a network: a laptop, a phone, a server. Mostly a business term, but it appears in consumer marketing when a product is derived from a business one.
Exploit: Code that takes advantage of a vulnerability to do something the software's author did not intend. An exploit is the technique; the payload it delivers is a separate thing, which is why patching closes a route regardless of what was being sent through it.

F

False positive: A clean file identified as malicious. Common with heuristic and behavioural methods, and with uncommon software such as a small developer's utility. The practical cost is the quarantined file that something else depended on, so knowing how to inspect and restore from quarantine is part of using the product.
False negative: Malicious software that is not detected. Less visible than a false positive and more serious. Every detection method trades one against the other: tuned to catch more, a product flags more clean files.
File-less malware: Malicious activity that runs in memory or through legitimate system tools, leaving little on disk to scan. It is the main reason products added behavioural monitoring to file scanning.
Firewall: A control on network connections, deciding what may reach the device and what a program on it may reach outward. Windows and macOS both include one. A suite's firewall replaces or sits alongside it and generally adds per-application rules and simpler prompts.
Full scan: An inspection of every file the product can reach, as opposed to a quick scan. It takes substantially longer and is mainly useful after an incident, after installing a product for the first time, or on a machine that has been offline for a long period.

H

Hash: A short fixed-length value calculated from a file's contents, used as a fingerprint. Change one byte and the hash changes completely, which makes hashes excellent for identifying an exact known file and useless for identifying a modified version of it.
Heuristic analysis: Assessing a file by its properties and instructions rather than by matching a known pattern: what it asks the operating system to do, how it is packed, what it resembles. It catches variants no signature covers, at the cost of more false positives.

I

Identity monitoring: A service that searches breach data and other sources for an email address or other detail you have registered, and notifies you when it appears. It monitors; it does not prevent, and it cannot remove data from anywhere it finds it.
Internet of things (IoT): Network-connected devices that are not general-purpose computers: cameras, televisions, doorbells, appliances. Most cannot run security software, so protection for them comes from the router, from firmware updates and from changing default passwords.

K

Keylogger: Software or hardware that records keystrokes. Used to capture passwords and card numbers. As a category it is defined by what it does rather than by how it arrives, so it can be part of a trojan, a remote access trojan or a physical device.

M

Machine learning classifier: A model trained on large sets of known-good and known-bad files that scores new files by resemblance. In consumer products it usually runs alongside signatures rather than replacing them. A score is a probability, not a verdict, which is why products combine methods.
Malware: The umbrella term for software written to do harm or to act against the interests of the device's owner: viruses, worms, trojans, ransomware, spyware and more. Vendors use it loosely and interchangeably with "threat".
Multi-factor authentication (MFA): Requiring more than one kind of proof to sign in: something known, something held, something measured. The Australian Cyber Security Centre publishes guidance on setting it up. It is unrelated to antivirus software and is frequently more consequential.

O

On-access scanning: Inspection triggered by an event — a file being opened, written or executed. The technical name for what is marketed as real-time protection.
On-demand scanning: Inspection you start yourself or schedule, covering a chosen location. Complements on-access scanning rather than duplicating it: it reaches files that have simply been sitting on disk untouched.

P

Password manager: A tool that generates and stores distinct passwords in an encrypted store unlocked by one master credential. Frequently bundled into security suites. The bundled version and the standalone product from the same vendor are not always the same software with the same features.
Patch: An update that fixes a vulnerability in software you already have. Applying patches promptly to the operating system, browser and applications is standard public guidance; the ACSC covers it in its advice on updating devices.
Phishing: A message that impersonates a trusted organisation to obtain credentials, payment details or a click. Delivered by email, SMS, chat or phone. Scamwatch catalogues current variants and takes reports.
Potentially unwanted program (PUP): Software that is legal and often technically consented to, but that few people would install deliberately: browser toolbars, bundled cleanup utilities, aggressive adware. Products differ on whether PUP detection is on by default, and whether removal is automatic or offered.

Q

Quarantine: An isolated store where a product places files it judges unsafe, rather than deleting them. Quarantined files cannot run. Because false positives happen, a product's quarantine is the first place to look when a program stops working immediately after a scan.
Quick scan: An inspection limited to the locations malicious software most often occupies: running processes, startup entries, system directories, temporary folders. Minutes rather than hours, and the sensible default for a routine check.

R

Ransomware: Malicious software that encrypts files and demands payment for the key, sometimes combined with a threat to publish the data. Backups held offline or in a separate account are the defence that does not depend on detection; the ACSC publishes guidance on ransomware for individuals and organisations.
Real-time protection: Continuous inspection of files and processes as they are used, rather than only during a scan. Standard in paid products. The name says the scanning is continuous; it does not say what is inspected, which is a separate question worth asking of any product's documentation.
Remote access trojan (RAT): Malicious software that gives an operator interactive control of a machine: files, camera, screen, keyboard. Distinct from legitimate remote-support tools, which do the same things with consent — a distinction that technical-support scams exploit deliberately.
Rootkit: Software that hides its own presence by interfering with the operating system's reporting. Because it subverts the system the scanner is running on, some products offer a scan that runs before the operating system loads.

S

Sandbox: A restricted environment in which a program can run without reaching the rest of the system. Used by security products to observe suspicious files, and by operating systems — particularly mobile ones — to separate applications from each other by default.
Scareware: Software or a web page that manufactures an alarming finding to sell a remedy: a fabricated infection count, a fake system dialog, a pop-up claiming a scan has run. Genuine security products do not deliver findings through a web page you have merely visited. Reports go to Scamwatch.
Signature: A pattern — often a hash or a distinctive byte sequence — that identifies a specific known piece of malicious software. Exact, fast and cheap to check, and by construction unable to recognise anything that appeared after the last definition update.
Spyware: Software that collects information about use of a device and sends it elsewhere without meaningful consent. The boundary with aggressive analytics is a matter of disclosure and consent, which is why classification varies between products.
System overhead: The processor time, memory and disk activity a security product consumes. Noticeable mainly during a full scan and on older hardware. Independent laboratories publish performance measurements; AgileBase does not, because it runs no tests.

T

Threat intelligence: Collected information about current attacks, malicious infrastructure and known-bad files, used to update detection. In consumer marketing the phrase usually stands for the vendor's cloud lookup network.
Trojan: Malicious software presented as something desirable, relying on the user to install it. Unlike a virus or a worm it does not spread by itself, which makes the delivery method — a download, an attachment, a cracked application — the point at which it is stopped.

V

Virus: Malicious code that attaches itself to another file and spreads when that file is run. Specific, and now rare relative to the other categories, despite giving the whole product class its name.
Virtual private network (VPN): An encrypted tunnel between a device and a server run by the VPN provider. The local network sees only the tunnel; the site visited sees the server's address. It does not detect malicious software, and it moves trust from the network operator to the VPN operator rather than removing the need to trust anyone.
Vulnerability: A flaw in software that can be used to make it behave incorrectly. Becomes a practical problem when an exploit exists for it and stops being one when a patch is applied.

W

Web protection: Blocking access to addresses on a list of known-bad sites, usually through a browser extension or a local network filter. Effective against what is already listed, and, like signatures, dependent on the list being current.
Worm: Malicious software that spreads between machines on its own, without needing a user to run anything. Because propagation is automatic, worms are the category where prompt patching matters most.

Z

Zero-day: A vulnerability being exploited before a patch exists — the vendor has had zero days to fix it. It describes timing, not a product feature, though marketing copy often uses it as one. What a product can offer against it is behavioural and heuristic detection, which work without prior knowledge of the specific flaw.

Using these definitions

Three habits make the glossary more useful than a list of meanings.

Expand the marketing phrase. Split a feature claim into its component terms and look each up. "Advanced real-time protection against zero-day threats" resolves into on-access scanning, heuristics and a claim about timing.
Ask what the term commits the vendor to. Some terms have an agreed technical meaning; others are descriptions the vendor defines for itself. The second kind should send you to the vendor's own documentation.
Separate the feature from the outcome. A password manager and identity monitoring are both useful and neither detects malicious software. A suite that includes them is a bundle of separate products, priced as one.

The detection page follows several of these terms through a single sequence of events, and the questions page answers the ones people most often ask about them.