AV-Comparatives: Real-World Protection Test Jul-Aug 2019

I agree, but the plausibility of such a scenario makes me lean towards always using an AV product with good behavioural protection capabilities, or at least strong signatures. WD is lacking in both these areas. Default Deny and Cloud Lookup aren't a panacea in all cases.

 

Actually I just realized that AV-C does perform a test for both off-line and on-line detection rates. The latest one is here: https://www.av-comparatives.org/tests/malware-protection-test-march-2019/ . Of note is off-line detection rates for McAfee(84%), Panda(62%), Symantec(89%), Trend Micro(51%), and WD(68%).

 

Exactly my point, those differences show that the products with extremely low detection rates in offline scenario, like Panda, Trend Micro or WD, tend to either have poor behaviour blocker/proactive module, or poor signatures (or both). In the scenario that such a malware does arrive as described earlier, they will be completely useless. As far as I understand, Symantec/Norton does have a decent behaviour blocker, but the same is not true for the other products described.

Another thing AV-Comparatives should look at is FP rate for offline vs. online scenario. I have distinct experiences of PC Tools products generating FPs on offline scans, which would not appear if there was internet access during the scan due to the product accessing a cloud whitelist and flagging it post-scan (of course, this means the offline scan has to be performed first to observe any diffferences...)