By nearly all accounts, we’re inching closer to a passwordless society. The FIDO Alliance, which develops new passwordless authentication standards and whose tagline is quite literally “reducing reliance on passwords”, now estimates that more than 5 billion passkeys are in use worldwide. In fact, more than three-quarters of global consumers have already enabled a passkey on at least one account.

The technology is a boon for the financial industry because it finally removes the sector’s entrenched dependency on knowledge-based credentials – reusable “secrets” that criminals can steal, guess, or extract through social engineering. Suddenly, being able to quote a user’s mother’s maiden name, the town they grew up in, or their several-digit password, isn’t enough – and that makes user access instantly more secure.

Passkeys also give customers a much easier ride when it comes to accessing their accounts, speeding up the process by allowing them to use a key biometric like a fingerprint rather than hopping through two or three screens and entering their “memorable information” each time they log on.

So far so good. However, according to research by Javelin, account takeovers still impacted some 6 million US consumers in 2025 – an increase of 18% on the previous year – with losses exceeding $15 billion. Countless other stats and analyses also support this trend, including The Federal Reserve, which reported a 36% increase in account takeovers between 2023-4 – and those are just the incidents that were brought to its attention.

A surface read of these figures suggests that passkeys are failing outright, but dive a little deeper and it’s clear that the problem isn’t with the technology itself, but how it’s implemented and safeguarded. Securing the front door doesn’t work if a fraudster can manipulate the locksmith into handing them a new key.

While a successful passkey authentication establishes control of a device-linked credential, it’s still on financial institutions to prove how that credential came to be enrolled and whether the session it grants access to remains trustworthy. Did the account holder genuinely intend to add that payee, recover that account, or move a huge sum of money? Passkeys are useful, but they were never designed to answer all of these questions on their own.

In finance, scale doesn’t always equate to risk

Back in August, researchers at Palo Alto Networks’ Unit 42 published details of three proof-of-concept attacks against passkey-protected accounts. They demonstrated how malware on one compromised device could authenticate itself without the account holder even being present. It could even interfere with the registration of a new passkey, or even expose the passkeys synchronized to that user’s environment. Seemingly, another blow for passkeys.

This is an alarming piece of research for sure, but best taken with a grain of salt. Delve deeper into the report, and it’s clear that every one of these scenarios began with a “poisoned” device, where malware was already present. The most serious cases also depended on a very particular combination of browsers and operating systems with preset security hardware.

Reassuringly, none of the cases had an “Enigma moment” where they broke the cryptography behind passkeys, nor did they uncover a “master vault” of credentials that could be ransacked in a single raid. That means attacks like these, where customers are pursued individually, would be far harder to scale than the kind of breaches we frequently read about in the headlines.

But “hard to scale” isn’t really much of a defense in finance. A criminal doesn’t need to steal access to thousands of accounts if one “whale” justifies the effort, and if successful, that single breach can spell doom for a bank’s reputation or regulatory standing – so warnings, while taken in context, should nevertheless be heeded.

Account recovery was, and remains, the weakest link

One criticism users often have of passkeys is, “what happens when I lose or switch my device?” It’s an inconvenience for customers, and it's a real headache for banks. Of course, banks want to make the experience of switching devices as quick and painless as possible, but issuing a new passkey isn’t like resetting a password. It will only be as trustworthy as the processes used to issue it.

If passkey recovery falls back on an email, a text, or a PIN sitting in a notebook somewhere, all an attacker has to do is clear that relatively weak hurdle. How can a finance enterprise know if the person claiming to have a new device isn’t just an attacker who has come across this information by chance or while targeting a specific individual? It relegates passkeys to basic, knowledge-based security again, undermining the very purpose they were created for.

A bank simply cannot recover confidence in a customer’s identity if it never established that confidence in the first place. During enrollment, when the bank verifies who an individual is and binds their identity to a trusted record, it’s usually done through a server-held biometric reference – something that is preserved even when the original device is lost.

If a situation arises where a customer needs to recover an account, the bank should always return to that same source of truth rather than create new “evidence” by asking for it through channels that may have already been compromised. So while recovery may not be needed months or years after onboarding, the efficacy of it is really decided on day one.

Authentication shouldn’t be confused with authorization

The line between authentication and authorization may seem invisible at times, but there’s a canyon between the two – particularly when it comes to moving money. Authentication establishes access, but authorization is what determines less tangible things like permission and intent. A passkey might prove the presence of a credential on the device, while a biometric or PIN check “releases” it and opens it for the user.

That confirms that the authenticator approved the login, but it doesn’t mean that everything that follows on that session is legitimate. Proving a user logged in legitimately at 10:19 doesn’t also prove that they meant to transfer $5,000 to a new payee at 10:26 – and that’s the grand canyon between authentication and authorization.

How the finance industry crosses that canyon depends on their ability to establish user intent in the moment. Of course, they can’t simply add gateways at every single point in the user’s journey – that kind of friction would be enough of an inconvenience for customers to start considering switching to a competitor.

But they can engage in step-up authentication and do what they can to establish contextual baselines. If a user logs on at 9:50 and checks their balance, like they have done countless times before at roughly the same time every few days, the passkey alone is enough. If they want to move money, add a new payee, or – perish the thought – recover their account, they need to reestablish trust by going back to the server stored source of truth outlined above.

Each request should warrant its own process for establishing truth depending on its level of sensitivity and what is at stake.

Putting passkeys in their place

When it comes to modern banking, passkeys absolutely deserve their seat at the head of the table. They strip away the traditional dependencies on knowledge that can be easily stolen, and replace it with device-based credentials that are far harder to crack from a social engineering perspective. On paper, passkeys should banish account takeovers, but in practice, there’s still work to be done.

Finance enterprises still need to know who was originally bound to a device-based credential, and they need to be able to separate access from intent. Passkeys can carry some of that burden, but not all of it. Increasingly, finance is on the front lines of the new war on trust, and they must do what they can to establish it, nurture it, and preserve it.

We've featured the best antivirus software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Kaspersky's VPN, Password Manager, Safe Kids, and My Kaspersky portal failed worldwide from October 11 to roughly October 14
• The outage began hours after Ukrainian drones shut down Yandex's Vladimir data center, but no technical link has been shown between the two
• A viral post calling Kaspersky "practically dead" was wrong on database updates, lost passwords, and its Europe-only framing - the effect was global and temporary

Kaspersky customers worldwide recently spent several days unable to use the company's VPN, Password Manager, Safe Kids parental controls, or My Kaspersky account portal, after an outage began within hours of Ukrainian drones forcing a third Yandex data center offline.

The company has blamed technical issues and has not named an underlying cause - but the overlap with the strikes on Russia's biggest tech firm has been hard for users to ignore.

On October 15 2026, Riga-based commentator Professor Talk (@SergejTalk) told his followers that European users were finding Kaspersky's antivirus "practically dead," with database updates failing, the password manager gone along with its contents, and the VPN wiped out.

Many of those claims don't hold up to the record; the outage itself, however, was real, global, and lasted the better part of four days, but it did point to a potential connection to Russian hosting for many of Kaspersky's key services.

Locked out on four continents: Bad timing or something more?

The first complaints landed on Kaspersky's support forum early on Sunday, October 11, when a user reported the VPN refusing to connect on both PC and phone. Within a day, the thread had drawn reports from Malaysia, Brazil, Italy, Vietnam, Spain, Germany, Iraq, the UK, and Australia, while users in Japan described failed activations and an unreachable VPN on X.

As a result, on October 12, Kaspersky employee and forum moderator Danila T. confirmed that some features in Kaspersky products and on My Kaspersky were temporarily unavailable, naming VPN, Safe Kids, and Password Manager, and said protection and user data were unaffected.

A later notice, relayed in French by moderator Berny, said the VPN problems hit the app on every supported operating system, and that licenses bought from October 10 onward could face activation delays. Kaspersky said it would extend affected subscriptions automatically to cover the lost time.

The staff, while in damage-control mode, also told users not to uninstall or reinstall applications, noting that the activation service issues would essentially lock them out of the applications altogether.

Service came back in stages. Berny reported My Kaspersky was reachable again on the evening of October 13; users said the VPN was connecting by the morning of October 14, and Danila T. posted that day that "the VPN issue should now be resolved."

The timing is what has people talking. Drones struck Yandex's Sasovo data center in the Ryazan region overnight on October 7 to 8, partially disabled its Kaluga site on October 9, and forced the complete shutdown of its Vladimir facility overnight into October 11.

Yandex Cloud was placed into emergency mode, and customers were advised to activate their own disaster recovery plans. We reported Yandex search traffic collapsing as the company's central Russian cloud zones went dark.

Correlation, not proven causation

A detailed incident timeline published on Habr puts the Vladimir power failure between 04:00 and 06:08 Moscow time on October 11, close to when Kaspersky VPN users began reporting problems. Kaspersky's own notice flagging licenses bought on October 10 also falls within a window when two Yandex sites were already damaged.

This is correlation, not causation, and Kaspersky has not said any consumer service runs on Yandex Cloud; none of the reporting to date, including Günter Born's blog and WinFuture, has produced technical evidence that one does.

WinFuture has noted that it remains unclear whether Kaspersky still depends on Russian data centers. Yandex's collapse also knocked over more than a dozen unrelated third-party services, according to The Record, from retailers to the Russian arm of TikTok, so a coincidental fault elsewhere would struggle to stand out.

The same week also reminded everyone how quickly such links harden online often without actual grounding in facts. Viral claims that the strikes had silenced Russian troll farms drew a rebuttal from OCCRP senior editor Ilya Lozovsky, who said they have "no basis in fact", noting the Cloudflare data in question measured automated crawlers rather than social media bots.

Irrespective of what is true here, the timing of Kaspersky's services going offline coinciding with Russian data centers going offline is a worrying one for an EU that is already looking to develop its own data security infrastructure and is trying to wean its users off 3rd-party services of what could in the future be an adversary.

The wider data center war shows no sign of easing. Russian strikes damaged at least six Ukrainian data centers in late September, and Ukraine's current strikes are seen as a tit-for-tat measure rather than an escalation.

For retail customers of Kaspersky's services inside or outside the EU, the practical lesson is narrower: Local protection kept working, which matters most for antivirus software.

But anyone leaning on the company's VPN or cloud-synced password manager has just seen how a disruption far from their own machine can take those tools away for days. Those who want a reliable plan B can find alternatives in our guide to the best antivirus software or the best VPN solutions for their specific use cases.

Discussions about passkeys replacing passwords as the go-to sign-in method have rapidly accelerated. The National Cyber Security Centre (NCSC) has acted as the catalyst for this transition, describing the shift as "overhauling decades of security practice". Finally, the industry has reached a collective point of recognition: traditional, static passwords are a weak defense against modern, automated threats.

AI has turned cybercrime into a highly efficient, industrial-scale enterprise. With researchers uncovering agentic ransomware attacks, we are fast approaching a reality that outpaces traditional human-centric defenses. Cybercriminals routinely deploy industrial-scale AI tooling to orchestrate and deploy vast credential-stuffing attacks and hyper-realistic phishing campaigns at machine speed and scale.

For organizations, the adoption of passkeys and other passwordless verification methods is dependent on the maturity of existing identity and access management (IAM) systems. Of the businesses with less mature, or no IAM strategy in place, only 30% are embracing password alternatives. Without passwordless systems, threat actors will continue to undermine digital trust.

User friction and weak protection

For years, identity security was treated as an isolated concern for the operations department. However, as customer experience dictates corporate revenue, delivering seamless IAM has become a commercial imperative.

Passwords force a broken trade-off: making users create unique, complex strings of characters results in severe password fatigue, while cutting corners by reusing credentials and using easily guessable phrases leaves gateways vulnerable to threat actors. When security kills usability, the business model breaks.

Another barrier passwords create is that, although most of the British public is genuinely worried about identity theft and fraud, only 17% fully trust organizations managing their identity data. Passkeys directly resolve this trust deficit through cryptographic authentication.

Because private keys stay securely on the user's local device and are never shared with a central server or application, there is no central database for hackers to breach. Passkeys are also phishing-resistant, removing the risk of users falling prey to social engineering attempts. Unlike passwords, they are also cryptographically bound to a specific, verified domain name, adding another layer of technological defense against attackers.

Securing autonomous identities

The shift towards agentic AI – fully autonomous systems operating with minimal human intervention – shatters traditional authentication models. Passwords were fundamentally built for human brains to remember.

An autonomous AI agent, such as autonomous digital proxies, personal shoppers and synthetic workflows, cannot "remember" a password without creating severe vulnerabilities, such as hardcoded credentials or shared session tokens exposing permanent risks.

If an agent inherits over-privileged human credentials, a compromised or rogue AI can exfiltrate sensitive data at machine speed, vastly outpacing the response time of traditional security methods.

To secure the growing autonomous workforce, AI agents must be given their own distinct, first-class identities with task-specific, time-bound permissions. Passkeys and decentralized, cryptographic credentials secure these machine identities and allow enterprises to securely verify and audit agentic workflows and interactions, without exposing underlying human credentials.

From passwords to passkeys

The technology industry is driving the momentum behind passkey adoption. Tech giants like Google and Amazon are seeing the need to improve customer convenience and account security, positioning passkeys as their default authentication standard. Businesses that delay moving towards passwordless frameworks are left defending a perimeter built for an entirely different era.

Although most organizations now see the importance of adopting passwordless options, transitioning away from traditional passwords is hindered by real-world complexities. Many core IT systems and legacy infrastructure are reliant on passwords, which remain deeply embedded within business processes.

IT leaders therefore fear that updating these systems will demand massive code rewrites and extensive specialist development resources, meaning replacing them requires careful orchestration.

To address this challenge, modern, low-code or no-code identity platforms allow organizations to visually map, test and deploy sophisticated authentication journeys seamlessly. This enables businesses to introduce modern passwordless options like passkeys or biometric prompts progressively, without disrupting the active user workflow or having to replace entire underlying legacy systems.

By allowing teams to modernize security processes without affecting user experience or uptime, advanced identity orchestration becomes a critical business enabler.

The future of trust starts with identity security

The threat landscape continues to be redefined by automated threats, deepfakes and autonomous software. Against these sophisticated attacks, the concept of static, point-in- time logins is obsolete. The NCSC’s call to action has been the final push many organizations need to drop passwords and rethink how to safeguard digital trust.

Adopting an identity-first approach centered on passkeys and robust identity orchestration allows enterprises to reduce user friction, strengthen the security of both human and machine identities and establish the continuous trust needed to grow confidently in an AI-driven environment.

We've featured the best antivirus software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

Cyber resilience isn't measured in firewalls. It's measured in minutes.

Time has quietly become the biggest driver of cyber costs. For years, we've measured cyber security success by what organizations could stop. How many attacks were blocked? Which vulnerabilities were patched? How much was invested in the latest security tools?

They're no longer the questions that matter most.

It isn't a groundbreaking observation to say the threat landscape has changed. Attackers are moving faster, AI is accelerating both offensive and defensive capabilities, and businesses are becoming more digitally connected than ever before. If we accept that no organization can eliminate cyber risk entirely, then our definition of resilience has to evolve too.

The organizations that emerge strongest aren't necessarily the ones that avoid being breached. They're the ones that detect, respond and recover fastest.

Our latest Grant Thornton Finance Leaders Barometer found the average financial impact of cyber incidents now stands at £488,000 over a two-year period, with 82% of CFOs reporting they've experienced a cyber incident with direct financial consequences. Crucially, the cost of an incident is increasingly determined not by the breach itself, but by how quickly leadership teams understand what's happened, make decisions and restore operations.

Every hour spent identifying the issue, establishing ownership or waiting for decisions and ensuring notifications are made to meet regulations, compounds operational disruption, financial loss and reputational damage. Increasingly, organizations aren't judged on whether they experience a cyber-attack. They're judged on the quality and speed of the decisions made in the aftermath.

Every cyber incident eventually becomes a board meeting

In the immediate aftermath of an incident, the conversation shifts away from compromised systems and malicious code towards operational disruption, financial impact and business continuity. Boards aren't asking which vulnerability was exploited or whether identity controls failed. They're asking how much it's going to cost, how long operations will be affected, whether customers, supply chain and regulators need to be informed, and what happens next.

This creates an uncomfortable tension for many organizations. Cybersecurity is fundamentally about risk management, spanning people, processes and technology. While many of the security controls used to mitigate cyber risks are technology-led, they are underpinned by organization-wide processes, policies and decision-making.

Accountability therefore extends well beyond technology teams, with finance leaders and boards increasingly expected to understand and make high-stakes decisions around cyber risk. Yet our research found that 79% of CFOs say ownership of key business risks remains unclear across their organization – a particularly significant gap when speed is critical and decisions can carry financial, operational and reputational consequences.

The organizations that respond best are those that have already decided who owns risk, who makes decisions, how issues escalate and what level of risk the business is prepared to accept. In other words, resilience isn't just about having the right controls in place – it's about ensuring the right conversations have happened long before an incident occurs.

Cyber language doesn’t translate to the boardroom

If organizations are going to make better decisions about cyber resilience, they first need to change the conversation. One of the biggest barriers isn't a lack of investment, it's a lack of translation. Cyber teams naturally talk about identity management, endpoint detection or upgrading legacy infrastructure. All important priorities, but they're not the language boards and CFOs use to make investment decisions.

Finance leaders are asking different questions. How does this protect revenue? What operational disruption could it prevent? What's our potential financial exposure?

How does this reduce regulatory or reputational risk?

The organizations making the most progress are those that can bridge that gap. Rather than presenting cyber as a technology upgrade, they frame it as a resilience investment – protecting business continuity, customer trust and shareholder value. That shift in language changes the conversation from "How much does this cost?" to "What would it cost us if we didn't do it?"

Ultimately, cyber investment shouldn't be justified by the sophistication of the controls being deployed. It should be measured by the business outcomes it enables; reducing downtime, improving recovery, protecting critical operations and giving leadership teams confidence they can respond decisively when disruption occurs.

With the cyber landscape evolving rapidly, it can be difficult to predict exactly where investment will be needed one or two years ahead. Organizations therefore need enough flexibility within budget cycles to adapt investment and controls as new threats emerge, rather than being constrained by priorities set at the start of the budgeting period.

AI is shrinking the time frame for good decisions

Artificial intelligence is changing cyber security in two directions at once. Attackers are already using AI to identify vulnerabilities, automate reconnaissance and increase the speed of attacks. At the same time, recent advances in frontier AI models have demonstrated just how quickly AI tools can uncover software vulnerabilities at a scale previously impossible for human teams alone.

The result isn't simply a more sophisticated threat landscape – it's a faster one.

Leadership teams have less time to understand what's happened, assess the commercial impact and make informed decisions. The organizations that respond well won't necessarily be those with the most advanced AI capabilities. They'll be the ones that have already agreed who makes decisions, how incidents escalate and what business priorities take precedence before an attack occurs.

The real measure of cyber security

Organizations need to rethink what good looks like. The goal is no longer to create the illusion that cyber risk can be eliminated; it's to build confidence that the business can make good risk based decisions when disruption inevitably occurs.

That requires more than better technology. It requires clearer ownership, stronger governance and a shared understanding of risk across the organization. In many ways, cyber has become the clearest test of organizational resilience, not because attacks are inevitable, but because they reveal how well leadership teams perform when certainty disappears.

Ultimately, the organizations that come through incidents strongest won't necessarily be those with the best security tools. They'll be the ones whose leaders have already had the difficult conversations, made the key decisions and built the confidence to act when it matters most.

We've featured the best antivirus software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

Chances are that your VPN does more than just encrypt your traffic. An increasing number of providers now bundle malware detection, malicious link checkers, and ad blockers into their packages.

This recent trend raises an interesting question: Are a VPN’s built-in security tools enough to replace standalone antivirus products? Or do we still need dedicated antivirus protection layered underneath our VPN?

This article is the first in a series of content relating to Cybersecurity Awareness Month 2026, which runs throughout October.

VPN security tools

Modern VPNs have evolved far beyond simple tunneling tools. The best VPNs like NordVPN and Surfshark now include real-time malware protection that checks URLs against malicious databases and scans files during downloads.

In 2024, NordVPN became the first VPN to earn certification as a reliable anti-phishing tool. Its Threat Protection feature blocks websites, web trackers, and ads while scanning downloads on the spot.

Surfshark takes this further with Surfshark One. It offers real-time protection from viruses and malware, with scheduled scans as part of regular security maintenance.

That said, VPN-based solutions often skip features common in standalone antivirus such as full system scans and behavioral threat analysis.

Here’s where it gets interesting: some VPNs’ antivirus tools are essentially rebadged versions of the same underlying technology. Surfshark’s antivirus is directly powered by Avira’s anti-malware SDK, while CyberGhost Security Suite uses Intego’s frontend – which, for Windows, relies on Avira’s engine and definitions.

This shared infrastructure means they depend on the same detection databases. When Avira pushes an update, VPN partners may take time to integrate it, creating potential gaps in protection compared to native Avira users.

Beyond timing delays, platform support can be inconsistent. Some VPN antivirus features only work on Windows and Android, leaving macOS and iOS users with partial coverage. For threat actors targeting Apple devices specifically, this gap becomes exploitable.

OS-level protection

Having evolved significantly since the days of basic protection, built-in security deserves more credit. Microsoft Defender, once considered a bare-minimum option by many, has improved considerably.

In AV-Comparatives’ July-August 2026 real-world protection test, Defender blocked 95.5% of live threats with just one false positive recorded.

What stands out is its consistency. Across multiple testing rounds, Defender has consistently earned Advanced+ awards and solid protection scores that often rival paid solutions, including Bitdefender and Sophos.

Critically, it recorded fewer false positives than many commercial competitors – meaning fewer instances of legitimate files being incorrectly flagged as threats.

Apple’s approach is equally sophisticated, deploying a trio of defenses rather than traditional signature-based scanning. Gatekeeper verifies authenticity, Notarization scans for known malware before distribution, and XProtect handles background detection with automatic updates. XProtect Remediator, added in recent macOS versions, periodically scans for active infections that slip through.

Between these systems, Apple prevents a substantial share of opportunistic attacks, though zero-day threats remain a vulnerability.

The free options and when to pay

If you prefer not to pay for antivirus software, Avast Free Antivirus remains a solid baseline. In recent testing from AV-Comparatives, it was one of only three products out of 20 tested to achieve a 100% block rate.

Free tiers typically come with trade-offs such as limited cross-platform coverage and reduced toolsets. For casual browsing, these rarely matter, but for managing sensitive files across multiple devices, they start to add up.

However, the value proposition shifts with paid suites. Norton 360 Deluxe and Bitdefender Total Security offer numerous valuable extras beyond antivirus protection that justify their cost for many users.

Features include password managers, cloud backup, parental controls, and identity monitoring. Having all these utilities in one package means less to juggle, and often works out cheaper than buying each tool separately.

The Verdict

Rather than choosing between them, a combination works best. A VPN, free antivirus, and built-in OS-level security creates a solid protection foundation. Relying on any single layer leaves gaps.

A VPN alone won’t catch malware already on your device or protect offline activity. Free antivirus lacks the behavioral analysis and premium support of paid suites. OS-level security can’t stop every zero-day exploit or advanced persistent threat.

That said, for the average user practicing sensible browsing habits, this layered approach provides adequate protection for everyday use. If you manage sensitive data, handle financial transactions regularly, or use older hardware that might delay security updates, investing in a premium suite adds meaningful insurance.

Practically speaking, most users can stay secure without overspending. The key is to stay sharp by keeping software updated and avoiding clicking on unexpected pop-ups or unsolicited links without thinking twice.

In July, two of OpenAI’s research models sat down to take a test. An internal cybersecurity benchmark, and they were meant to solve a set of exploitation challenges. Instead, they worked out that the answer key was probably sitting on Hugging Face, where the benchmark files were hosted, and went to get it.

Getting it took chaining a zero-day in a package manager, some stolen credentials, and a privilege escalation across OpenAI's own network. The models broke out of the evaluation sandbox, reached Hugging Face's production infrastructure, and achieved remote code execution. Hugging Face later reconstructed roughly 17,600 actions across four and a half days of this.

Nobody told them to attack anything. They were cheating on an exam.

Two more incidents followed, at Anthropic and Meta, and those were different in a way that matters. Those models didn't build a route out. They found one that was already there, because the evaluation environment had been set up wrong.

So, of the three incidents that prompted the UK’s National Cyber Security Centre’s (NCSC) guidance in August, one was an agent doing something genuinely novel and two were an agent walking through a door a person left open.

Have a guess which type you're more likely to have in your own environment.

The instinct to build a new category is the wrong instinct

The reflex right now is to treat all of this as a new security category. New containment strategy, new governance forum, new line in the budget, probably a new acronym before the year is out. I understand the appeal. It's a lot easier to fund a new thing than to admit the old thing was never finished.

But look at what an agent actually is inside your organization. It's running on some employee's access rights. It's operating under their identity, or a service account they spun up. Its scope is whatever they thought to constrain when they configured it on a Tuesday afternoon, which is usually less than you'd hope. Hand the same agent to two different people and you get two different risk profiles, because the agent didn't change. The human did.

That's not new. That's the thing we've been calling insider risk for fifteen years, with the latency taken out.

Some of what you already own transfers cleanly, which is the good news and also why I'd push back on anyone selling you a greenfield. Behavioral baselining works. You already flag when a user's activity departs from their pattern, and a hijacked agent looks like the same class of deviation. Identity governance works too.

The access reviews and the offboarding runbook you use for leavers apply to agent credentials, and if you skip it you end up with agents cheerfully operating on the access of someone who left in March.

What doesn't transfer is the tooling.

The model extends. The tooling does not.

DLP was built around a human moving a file. It assumes a pace and a shape of data transfer that agents just don't have. Access controls and containerization draw a boundary, which is useful as far as it goes, but they tell you nothing about what happens on the permitted side of it. Scope creep isn't a perimeter breach. It's an agent gradually doing more than anyone intended, entirely inside the rules it was given.

Prompt injection sits underneath all of this. Someone laces instructions into an email or a document, addressed to the AI reading it rather than the person. The attacker never needs to steal the employee's credentials. The agent is already holding them.

Which brings me to the unglamorous part, and the only recommendation here I'd defend in front of a board. You need to know what's actually running.

Shadow AI isn't a new concept, but it's still rampant, and agents make the unsanctioned side of it harder to see. 98% of organizations already have unsanctioned AI tools in use today. According to Mimecast telemetry, unsanctioned GenAI tools see roughly 8,000 copy-pastes and file uploads every hour. It only takes one of those interactions to trigger a GDPR breach or an IP leak.

That’s why keeping track of AI use in an organization with a live inventory is critical. Not a list from last quarter. A live one. Vendors keep switching AI on inside tools you sanctioned two years ago, so the inventory decays whether or not anything in your environment changes. Real-time data flow controls, anomaly detection, agent identity cataloguing, all of it comes after this and none of it does much without it.

Start with visibility. Always.

Ollie Whitehouse at the NCSC put it better than I'm going to: relying on detection alone, after the fact, isn't going to be enough.

Agents didn't invent a new risk. They took the gap between someone making a careless configuration decision and that decision costing you something, and closed it to seconds. Most of us are running an architecture that assumed we'd have longer.

So before you sign off on another point solution, go and find out what's already in there. I'd bet it's more than you think, and I'd bet most of it arrived without anyone making a decision.

We've featured the best antivirus software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

Financial crime has never stood still. In my nearly three decades in financial services, I have watched fraud move in lockstep with the technology built to stop it, and at times, even stay a step ahead of it​,​ given the speed fraudsters adopt new technology.

I have witnessed decades of AI innovation ​that raised​ the bar on fraud detection, yet criminals continue to test those boundaries. Fraud remains a top consumer concern, with over ​87.5 million American adults experiencing a scam or financial fraud each year. That’s roughly one in every three American adults.

The question for financial institutions isn't whether AI has a place in fraud prevention​,​ but whether the AI they've deployed is built for the threat landscape they're facing today – and the one that's coming.

Compute has finally caught up with mathematical vision

For decades, data scientists working on fraud prevention had theories they couldn't implement. The ideas were sound, but the computers at the time weren't powerful enough to get the math done. That constraint no longer exists.

Historically, most fraud detection has been carried out by building a profile summarizing a customer's typical behavior using sophisticated features, a neural network, and the customer’s current transaction to flag transactions that are suspicious. It's an approach constrained by the computational limitations of time.

Today, access to GPU and other high-performance compute is changing the art of the possible. Rather than analyzing a transaction in the context of a profile, GPUs allow us to implement entirely new algorithms that can evaluate a customer's extensive transaction history in real-time as the transaction happens.

The result is a significantly sharper, more accurate prediction and far fewer false alarms that can delay or stop legitimate purchases​,​ eroding customer trust.

Built for one job, not every job

Thanks to greater GPU availability and computational power, we're now seeing new opportunities to support fraud prevention with a sequence-modeling transformer – not a generic transformer, but one purpose-built for transaction analytics and financial crime.

With a purpose-built transformer architecture that’s trained exclusively on financial transaction data and engineered for a single focused task, financial services institutions can detect financial crime in real time using deep personalization and the context of the customer transaction history.

These are not overarching ‘do everything’ models. They are focused foundation models purpose-built to deliver auditable, high-performing, low-latency generative AI for the fight against financial crime. Each of these models specializes in distinct areas, such as account takeover, scams, mule detection, and first-party misuse.

Independent models focused on their specialty allow for a more complete, accurate, and transparent picture than any single model working alone. And this is just the start​,​ as the same methodology applies to risk decisions, hardship, collections, and any application where understanding our customers leads to better engagement, protection, and service.

The future is now

The fraud prevention capabilities that will define the next five years are being built right now. Enterprises investing in protecting customers from fraud – both now and in the future – understand that purpose-built models, use of specialized compute, and AI agents are the path to protecting their customers.

The math protecting consumers today was invented decades ago by AI scientists who saw the potential in algorithms even before the compute and infrastructure existed. I've spent much of my career continually chasing that goal to ensure that the industry is ready to bring the best algorithms when compute shows up.

Some of my proudest work came from refusing to settle and trust that technology will catch up with AI invention and math. Every patent, every model, every AI experiment has served the same purpose: making sure the industry is ready to lead with the best AI tools once compute catches up with scientific invention.

That work is happening right now. The only question is whether ​​​​​​financial institutions are​​ part of it or racing to catch up.

We've featured the best antivirus software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Windows 11's antivirus is bugged as of the latest updates
• Microsoft Defender is telling users that it's turned off, when in fact it isn't — it's working just fine
• The warning keeps popping up, though, and that's proving to be frustrating, although Microsoft is now working on a fix

If you use Windows 11's built-in antivirus and you keep getting worrying messages warning that it's turned off and you're no longer protected, the good news is that this is a bug, and you've got nothing to be concerned about.

That said, this is still an annoying glitch, as it's one that's happening repeatedly to those using Microsoft Defender following its most recent updates. Windows Latest noticed the problem, which has been acknowledged by Microsoft on the Windows release health dashboard.

Microsoft tells us: "After installing the latest updates for Microsoft Defender Antivirus, notifications might appear stating that 'Microsoft Defender Antivirus is turned off,' even though the antivirus is functioning correctly and all settings show it as active."

The software giant says you may see these warnings when Windows 11 first boots and "intermittently afterward", noting that they'll appear even if notification settings are switched off. This is also a problem for Windows 10 users.

Microsoft explains that it's working on a fix that will be provided in an update for Defender Antivirus, but we aren't given an ETA for its arrival.

Analysis: a persistent bug that's been hanging around

The bugged pop-up asks you to click to turn virus protection back on, but you obviously don't have to, as it hasn't actually been turned off. Confused users have likely been clicking to re-enable Microsoft Defender, though, and then wondering why they're repeatedly being asked to do this — possibly coming to the conclusion that the antivirus is broken.

Rest assured, it isn't, but this has proved to be a frustrating bug for some, as it sounds like it's appearing quite regularly. As one Redditor complains: "Turns out, yep, it's a bug with their latest update. Fortunately it's harmless but annoying."

Based on reports on Reddit, the issue has been around for over a week at least, and Windows Latest believes it goes back further than that, to early August — although Microsoft only recognized and flagged the problem on its health dashboard a few days ago. Given that the bug has been in play for a while now, hopefully it'll be resolved this week.

I'm surprised that Microsoft hasn't already issued an update to cure this glitch, frankly, but maybe it's a spanner that's pretty deep in the works of Defender Antivirus, so it's taking some time to extract.

It's worth noting that the first time you see this error, you may want to double check whether it's the bug, or a genuine problem elsewhere with Microsoft Defender. You can always ensure that the antivirus is still running by going to Windows Security (type that in the taskbar search box) and looking under 'Virus & threat protection' which will give you the current (correct) status of Defender, flagging any problems if they're present.

CISOs are facing growing pressure to stay quiet about cyber incidents despite stricter regulatory demands for transparency. That’s one of the findings from Splunk’s 2026 CISO report, which shows that one in five security leaders have been pressured by their organization not to report incidents or compliance issues.

The situation is proving to be so problematic that almost eight in ten (78%) are now concerned about their own liability for security incidents, a sharp spike compared to last year (56%).

What’s more, a similar number (79%) reported that their roles have become more complex, with nearly half (43%) now given new responsibilities in areas such as fraud and financial crime investigations. Almost all (96%) of 650 CISOs questioned as part of the global survey are now also responsible for AI governance and risk management, making them the de facto AI policy leaders at their organizations.

But perhaps most worrying of all is that stand-out figure that one in five (20%) CISOs have even been pressured not to report a security incident or a compliance issue by their organizations.

CISOs concerns about liability amid pressure to stay silent

This tension highlights a growing contradiction in modern cybersecurity: CISOs are being asked to take greater responsibility for cyber resilience and transparency, while in some cases also facing pressure not to disclose incidents.

Further to this, the tension caused by internal pressures and personal responsibility has built up to such an extent that a quarter (26%) of CISOs have considered quitting the cybersecurity industry altogether.

But as concerning as these survey results are, they could soon be about to get worse. If the role of CISO was not already demanding enough, new draft laws could be about to make things even harder.

The Cyber Security and Resilience (Network and Information Systems) Bill, currently making its way through the UK Parliament is set to place even greater pressure on organizations to correctly identify, assess and disclose cyber incidents.

For CISOs, the challenge will be navigating the increasingly fine line between reporting too much and reporting too little. Organizations that fail to disclose significant incidents, or even near misses that could cause disruption, may face fines, yet reporting incidents prematurely before the full picture is clear could mean operational, financial and reputational consequences.

This places CISOs in a difficult position: they are being asked to defend against attacks, while also making high-stakes reporting decisions quickly, often while investigations are still unfolding and facts remain unclear.

This balancing act is likely to become one of the defining challenges of modern cyber governance.

A new era of cyber accountability

A recent blog published by the National Cyber Security Centre (NCSC) warned that cyber threats have become an urgent priority and that business leaders need to act now to help strengthen the UK’s collective cyber resilience.

For many CISOs, making sure they stay on the right side of the law will depend on whether they're able to find the reporting sweet spot.

One approach might be to take a ‘rather be safe than sorry’ approach. But over-reporting events that may even be false alarms can unnecessarily damage market confidence in your organization.

Similarly, underreporting incidents – or worse, brushing them under the carpet as some CISOs are being pressured to do – can dent reputations and risk long-term loss of trust.

Why evidence-led governance matters more than ever

That’s why – in the face of growing regulatory scrutiny and increasing internal pressure – CISOs need more than just better visibility. They need the ability to defend their decisions with evidence.

It goes without saying that they need to identify threats quickly. But they also need to be able to provide proof that incidents were assessed appropriately, escalated correctly, and reported transparently.

That is why evidence-led governance is now critical. Organizations need systems that create clear and robust audit trails showing what happened, when it happened, who was involved in decision-making, and what information was available at the time. That means having the ability to document and evidence that decision-making process from start to finish.

Not only that, when security teams can correlate activity across networks, endpoints, cloud environments, and operational systems in real time, they are in a far stronger position to determine whether an incident crosses the threshold for disclosure.

When you have CISOs admitting that they have effectively been 'leaned on' not to report incidents, you know that something is wrong. And it’s time for CISOs to put measures in place to protect themselves from whatever may be just around the corner.

And that’s only possible with strong governance, clear workflows, transparent audit trails – and the evidence to support that decision-making.

We've featured the best antivirus software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

Protecting a household of devices, storing family memories, and protecting your online identity would usually have your searching for multiple solutions from different providers. But right now, Norton 360 Advanced is currently 77% off, reducing the monthly cost of protecting 10 devices to just £2.92/mo.

It may not seen like it looking at the price, but 360 Advanced is Norton's highest level of protection - spanning across antivirus, data, identity, and financial defence.

Inside, you get Norton's award winning antivirus protection to defend against malware, ransomware, and hacking, alongside a 200GB Cloud Backup, password manager, parental control app, dark web monitoring, social media monitoring, financial monitoring, identity restoration support, and much more.

• See all Norton 360 deals

Today's top Norton 360 deal

Full Feature Breakdown

200 GB Cloud Backup

If you are used to storing your family photos or important documents on your home computer, there is always the risk of your computer failing or your storage corrupting.

Unless you have them backed up elsewhere, it could mean that you lose them forever. Storing them in a cloud backup adds a level of redundancy into your storage that helps to protect from these risks.

With Norton's 200GB cloud backup, you can choose which files are regularly uploaded in to the cloud, so that any recent changes you make are automatically saved into your online drive.

Password Manager

Its no secret that many people rely on the same password, or a combination thereof, across all of their accounts. From bank logins, to social media, and beyond - if just one of these passwords is leaked on compromised it can put your entire online life at risk.

Norton's password manager can securely store your current passwords, generate new, highly secure passwords, and autofill your credentials when you want to log on so you don't have to spend time remembering and typing long and complex passwords.

VPN private connection

A Virtual Private Connection (VPN) is an encrypted internet tunnel that secures your browsing traffic. That means that even if you internet activity is intercepted in transit, it cannot be read or decrypted.

This helps to protect against crooks attempting to steal your IP address or find your location, and can help secure your internet activity when browsing on unsecured networks such as those in cafes or airports.

Norton's VPN is fast and unlimited with over 100 connection locations across the globe.

Parental Control App

A parental control app helps you manage and secure the online activity of any children in your house. Unrestricted access to the internet can be dangerous, even in online gaming or on social media.

Norton's parental control app provides web filtering to remove unwanted websites from access, provides search engine monitoring, app blocking, and screen time monitoring.

Identity Protection Tools

Most of your identity is now stored online. From social media and online accounts, to the daily services you use to communicate. But sometimes things go wrong. Your credentials and personal information can get leaked during data breaches, and while it may not be your fault, hackers are just waiting for the opportunity to steal accounts and personal info.

Dark Web Monitoring

Norton's Dark Web Monitoring tool actively checks the parts of the internet where hackers like to post their finds. It regularly checks for your personal information and credentials and will notify you if anything suspicious is spotted, giving you precious time to change passwords or act as a heads up in case any suspicious emails or texts arrive in your inbox.

Identity Restoration Support

Norton's Identity Restoration Support provides expert advice and direct customer support in the case that your identity is compromised. You will have access to Restoration Specialists to help navigate how you can restore your identity, and live support from Norton experts for any questions or concerns you have about suspicious activity.

Social Media Monitoring

Norton's Social Media Monitoring provides oversight on your social media accounts for suspicious activity, account takeovers, and inappropriate content.

Financial Protection Tools

Credit Alerts, Credit Reports, and Credit Scores

Norton's Credit services provide regular credit scores and reports, and will notify you if any changes are made to your financial accounts or payments.

Stolen Wallet Assist

In the event your wallet is stolen, Norton's agents will guide you on how to cancel or replace credit cards, bank cards, driver’s licence and other cards.

Financial Monitoring

If any unusual subscriptions or payments are made from your accounts, Norton will notify you of the changes and help you navigate suspicious transactions.

• Take a look at our full guide to the best antivirus software

The reported cyber attack involving Canvas and the subsequent ransomware payment will inevitably trigger familiar debates around paying ransomwares.

Most organizations facing ransomware attacks avoid publicly confirming whether a payment was made. Even where payments occur, communications are typically cautious, limited, or deliberately ambiguous.

Admitting to a ransomware payment creates legal, regulatory, reputational, and ethical complications. It can invite scrutiny from customers, insurers, regulators, and shareholders. It may also create concern that the organization has become vulnerable to future extortion attempts.

On one hand, transparency can be viewed positively. Stakeholders increasingly expect honesty during cyber incidents, particularly where personal data is involved. Attempting to conceal the reality of an attack can create longer-term trust issues if details later emerge through other channels.

For many organizations, the decision to pay a ransom is ultimately driven by operational and financial calculations rather than principle alone. If they don’t have things like ransomware protection, backups, or logs it makes it an almost impossible task to recover.

Cyber insurers, legal advisers, and incident response firms may conclude that prolonged recovery, forensic investigation, service restoration, regulatory management, and reputational damage could cost substantially more than the ransom demand itself.

Pressure to restore services

In sectors like education, where downtime directly affects students, exams, coursework, and institutional continuity, the pressure to restore services quickly can become commercially and socially overwhelming.

That does not make payment risk-free or strategically desirable, but it does explain why some organizations determine that the immediate cost of disruption outweighs the uncertainty and expense of a prolonged recovery process.

However, transparency also exposes a more uncomfortable reality within modern ransomware incidents: it does in fact pay to be a cybercriminal.

Yet focusing solely on the ransom payment itself misses the larger issue.

This incident appears to reinforce a wider trend emerging across modern digital platforms: attackers are increasingly exploiting trust itself.

Reports suggest threat actors abused Canvas “Free-For-Teacher” accounts, leveraging a legitimate platform capability designed to support accessibility and adoption. Rather than forcing entry through traditional technical weaknesses, the attackers operated within accepted trust boundaries.

For education providers, this creates a particularly difficult balance. Platforms are intentionally designed to reduce friction for teachers, students, and external collaborators. Accessibility is part of the value proposition. However, the same openness that enables rapid adoption can also create opportunities for malicious actors to blend into normal platform activity.

This is not simply a security engineering issue. It is a governance issue around how digital trust is granted and monitored at scale.

Identity has become the primary security boundary

Cybersecurity strategies historically concentrated on protecting networks, endpoints, and data centers. Increasingly, those controls sit behind identity systems that determine who is trusted, what access they receive, and how quickly they can move through interconnected platforms.

Modern ransomware groups and financially motivated actors increasingly prefer credential abuse, social engineering, and exploitation of trusted workflows because they are often less visible than conventional intrusion methods. A valid account can bypass many of the controls designed to detect malicious behavior.

The challenge becomes even more pronounced in education as, unlike tightly controlled corporate environments, educational ecosystems are inherently decentralized. Institutions regularly support temporary users, external educators, contractors, collaborative learning environments, and remote access requirements. The result is a digital environment where trust relationships are broad by design.

That creates a difficult strategic question for providers and customers alike: how do you preserve accessibility without creating exploitable trust pathways?

The human consequences are often underestimated

Cyber incidents are still frequently measured through technical metrics: records exposed, systems encrypted, or hours of downtime incurred. Those measures rarely capture the wider societal impact.

In education environments, disruption affects students during formative periods of their lives. Exam preparation, coursework submission, academic continuity, and communication channels can all be interrupted simultaneously. Parents and educators face uncertainty around outcomes they cannot directly control.

There is also a more uncomfortable consideration in that educational platforms frequently contain data relating to minors. Even where sensitive information is not immediately weaponized, long-term exposure risks remain difficult to quantify. Personal information tied to younger individuals may retain value for years through identity fraud, social engineering, or future credential abuse.

The emotional dimension of cyber attacks is still poorly understood within many boardrooms because it does not fit neatly into conventional risk reporting.

The due diligence dilemma

Most schools, colleges, and mid-sized organizations cannot realistically perform deep technical assurance assessments against large SaaS vendors. Procurement teams are often left reviewing compliance certifications, security statements, audit summaries, and contractual language that may provide only partial visibility into actual operational practices.

This creates an accountability imbalance.

Customers remain responsible for protecting their own stakeholders and data, yet their ability to validate supplier resilience is constrained by commercial scale and information asymmetry.

That challenge is not unique to Canvas. It reflects a broader maturity gap across the SaaS market.

Many providers publish extensive security documentation, but external assurance still struggles to address practical questions such as: What assumptions are made about “legitimate” users? What controls exist around free-tier or trial account creation?

For customers, obtaining meaningful answers to these questions can be difficult without substantial procurement influence and the result is a market where trust is often inferred rather than verified.

The larger issue beneath the incident

The reported Canvas ransomware payment will understandably drive debate around criminal incentives and incident response decisions. Yet the more strategic question sits elsewhere.

The challenge for organizations is no longer confined to protecting infrastructure from external intrusion. It is understanding where trust is granted, how legitimacy is established, and what happens when a trusted platform becomes the weakest link in a much larger interconnected ecosystem.

That is not merely a cyber security concern.

It is becoming a fundamental business risk question about dependency, governance, and the fragility of digital trust at scale.

We've featured the best cloud antivirus.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

Intego's antivirus is our top pick for the best Mac-dedicated protection, and but Intego sweetened the deal just in time for the World Cup by offering an exclusive limited time 50% discount across all Intego One plans.

Even if you opt for the most comprehensive package, you'll be paying just £2.50 per month for the first two years. And the software seriously impressed us in our review, currently sitting in the number two spot on our picks of the best Mac antivirus that we've tested.

Each plan is suited to a range of users - from those looking for simple protection that doesn't hinder performance, to those wanting protection across antivirus, network, and internet traffic with all the bells and whistles to improve your Mac performance.

Today's top Intego One deals

We've tested Intego's Mac Security X9 suite and were seriously impressed with its antivirus protection performance, with our expert security reviewer Sead praising how the antivirus "is easy to use, and is powerful enough to offer you peace of mind" in his full review.

Intego's same antivirus software is included in the One range, and performs exactly the same. Even AV-Test gave it 6 out of 6 across protection, performance, and usability in the latest testing from March 2026.

This limited time deal runs from today through July 2nd, 2026, so if you want to secure your World Cup viewing experience or just need a new protection package, Intego's 50% discount is hard to beat.

• Take a look at our full guide to the best antivirus software

Norton 360 Deluxe currently sits in our top three for the best antivirus software after showing outstanding results during our handling, which is backed up by laboratory testing results.

The Deluxe package goes beyond regular antivirus protection, with a parental control app, VPN, password manager, scam protection and cloud backup.

• See all Norton 360 deals

Where you would usually be paying £89.99, Norton's current sale has 67% off, lowering the first year to £29.99.

Today's top Norton 360 deal

In his full review of the Norton antivirus lineup, our expert security tester Sead Fadilpasic said its 360 Deluxe is "the best general-purpose option", additionally noting that the combination of features makes it a great choice for protecting a household of devices.

The package includes a more than generous 50GB cloud backup for securely storing family photos and important documents, with the included password manager offering a vault to manage your personal and shared credentials, alongside your online payment info.

If you are worried about scammers using texts, deepfake videos or voice changers to impersonate your friends and family, the scam detector can quickly analyse anything out of the ordinary and offers a cornucopia of knowledge to keep you informed of the latest threats and trends.

The parental control app offers granular device monitoring to help ensure your children are using the internet to its full potential while remaining safe online, with the added SafeCam software to prevent unauthorised access to webcams.

For those with kids who are distracted by their device during learning, you can set a device-level School Time control that can set access to certain websites, helping them focus on their education.

This feature level really shows why Norton 360 Deluxe has earned such a high ranking in our testing, and this is the lowest first year pricing we have seen in months. Whether you want to secure your internet traffic while watching the World Cup, or you're looking for a Father's day present for a tech-savvy dad, definitely consider this Norton deal.

• Take a look at our full guide to the best antivirus software

• NordLayer’s Web‑based Threat Report 2026 found a gap between confidence and reality: 73% of firms feel prepared, yet 82% suffered browser‑based attacks
• Malware harvested 1.8M credentials and 68.8B cookies last year, with stolen logins enabling silent intrusions as SaaS reliance grows
• Researchers stress browsers are the critical boundary, urging stronger DLP and controls to address uneven coverage and escalating web‑threat sophistication

Most businesses believe they are well-prepared to face cyberattacks, but the number of successful breaches in the last year alone paints a different picture.

Earlier this week, NordLayer released a new report, called “Why Browser Security Can’t Wait: Web-based Threat Report 2026.” In it, the company states that while 73% of organizations claim to be prepared for web-based attacks and are confident in their solutions, 82% experienced some form of web-based attack.

The paper is based on an analysis of 504 “highest rated and most reviewed work applications”, an analysis of data stolen from various infostealers, and a survey of 405 US cybersecurity and IT professionals.

Hackers don't hack anymore

NordLayer stresses that coverage is “modest and uneven”, with data loss prevention tools (DLP) leading at just 53%, followed by other security controls. Nearly all IT professionals reported that their organizations are concerned about web-based threats (98%), and most expect escalation. In fact, 81% expect greater sophistication and 73% believe there will be more incidents in the coming years.

“There’s a clear gap between recognizing the threat and knowing how to address it,” says Buinovskis. “Concern is high, but awareness of which controls actually solve browser-specific risks is low. Much of the initial confidence most likely comes from having general security controls in place, yet they rarely adequately cover risks in the browser.”

The researchers also stressed that 100% of the tested applications were browser-accessible, and almost four in five (78.8%) were browser-only. At the same time, malware was able to harvest 1.8 million credentials and 68.8 billion cookies last year.

“Hackers don’t hack anymore, they just log in,” says Buinovskis. “Stolen cookies and credentials grant immediate access without raising alarm bells — a login looks legitimate. It’s low risk, high reward, and as reliance on web-based SaaS grows, so does the value of stolen data. Attackers will keep exploiting this until organizations secure the browser as a critical boundary.”

• NordVPN rebrands its app across three pillars: connect, protect, monitor
• Threat Protection's tools are now under a newly launched anti-gen antivirus
• Anti-gen antivirus tools blocked 4.8 million threats in April alone

NordVPN is officially changing. The cybersecurity giant has announced a major rebrand, shifting its focus from a standalone VPN provider to an all-in-one digital security app.

The revamped NordVPN application is now organized around three core pillars: "connect," which refers to the virtual private network tech; "protect," where what's known as the Threat Protection suite becomes next-generation antivirus; and "monitor," which includes tools like Dark Web Monitor.

As Marijus Briedis, CTO at NordVPN, said in a press statement: "Such an approach reflects what users increasingly want from digital protection: stronger security, less complexity, and fewer separate tools to install and manage."

The need for a next-gen antivirus

The rebranding of Threat Protection features as next-generation antivirus capabilities is especially significant to grasp how the company is adapting to an online landscape where threats are diversified.

Many of today's most common and damaging digital dangers, including phishing pages, fake online stores, scam messages, and account takeover attempts, do not rely on downloadable files at all. Instead, modern cybercriminals use deception, compromised credentials, and social engineering to target unsuspecting users.

Yet, as Briedis explains, people still use the word 'antivirus' as a "shorthand" for digital security. "Modern protection should address the real risks people face online today, from phishing and scams to malicious downloads. Protection needs to evolve, without compromising the standard of privacy people expect from us," said Briedis.

Traditional antivirus software, in fact, has historically focused on reactive file scanning. NordVPN's next-generation antivirus aims to redefine this concept for private customers. It focuses on proactive, real-time protection to stop phishing, scams, ads, trackers, and malware before they ever reach a user's device.

Over the last year, we have tracked how NordVPN has steadily integrated broader defense features against online scams and malware. And these tools are already working hard. In April alone, NordVPN's next-gen antivirus tool blocked 4.8 million threats. Malware made up the majority of these blocks, accounting for over 3 million stopped threats.

Now, those extra layers of defense are taking center stage. A massive evolution for a service that already ranks among the best VPN options on the market.

Privacy-first security by design

One of the biggest concerns for users adopting all-in-one security suites is privacy. Antivirus software historically requires deep system access, which can raise surveillance concerns.

NordVPN claims its security approach is designed around collecting the minimum signal required to make a threat decision, avoiding turning security tools into surveillance products.

This privacy-first ethos extends across NordVPN's entire suite, from its core VPN capabilities to its dedicated machine learning models used to catch specific threat categories.

For users looking to streamline their digital setup, this rebrand also seeks to reduce the clutter of managing multiple subscription services.

"Consumers should not have to choose between convenience, protection, and privacy," says Briedis. "Our goal is to bring together advanced VPN technology and next-generation antivirus in one streamlined app experience that reduces complexity and better matches how people think about digital safety today."

This rebrand follows what has already been a highly active period for the provider; you can catch up on their other recent updates in our recap of everything NordVPN released in early 2026.

Formula 1 is one of the most popular sports in the world today, boasting over 827 million highly passionate fans across the world in 2025, all tuning in to watch wins, losses, crashes, and (occasionally) disqualifications.

To say Formula 1 fans get emotional is an understatement, and when there is a chance to win, many will go to extreme lengths to watch it happen - and not always legitimately - and for a threat actor, that pool of 827 million fans is an unmissable opportunity.

But participation goes beyond just watching the sport. The allure of cheap or discounted merchandise, dubious free streaming services, and the too-good-to-be-true offers play on the high-stakes nature of the sport, and the emotions of passionate fans - we spoke to security giants (and Ferrari partners) Bitdefender to find out more.

Bitdefender Threat Index

At Pista di Fiorano, Ferrari’s private racetrack in Italy, I was part of a group of journalists given exclusive access to Bitdefender’s Fan Threat Index, which has collated data on the threats facing fans since March 2025.

Bogdan Botezatu, Senior Director of Threat Research & Reporting at Bitdefender, was on hand to guide us through the report.

“Scams are evolving. Last year, cybercrime was making about $9 trillion in losses at the global scale. Out of that $9 trillion slice, about $1 trillion is responsible for scamming,” he said. “This Fan Threat Index is our response to how scams are evolving.”

The Formula 1 teams themselves face a huge array of threats. There is the potential for not only malware and ransomware, but also physical infiltration to steal intellectual property and secrets - and that is why teams form partnerships exactly like Ferrari’s partnership with Bitdefender, which can offer the teams the expertise and solutions they need to stay protected.

“At home though, things are fundamentally different,” Botezatu notes. “When things are moving fast, people make mistakes, and those mistakes cost.”

He explains there are four major threats that Formula 1 fans face. “The motorsport ecosystem is dominated by speed; you have to source tickets fast; you have to get the right merchandise from the right vendor; you have to find a streaming partner to watch the show at home; you have to face that emotional involvement that happens on race weekend.”

Last minute tickets and counterfeit merchandise

The ultimate thrill for a Formula 1 fan is almost certainly the opportunity to watch a race in person. In order to make cheap or discounted tickets even more alluring, scammers will seek to lower the cost of entry by offering ticket lotteries and giveaways.

Attending in the merchandise of a fan’s chosen team adds to the allure, and these forms of scam usually spike in the run up to a race as eager fans look for last minute tickets, and finalize their race-day outfits.

The main target for scammers is the theft of financial information. Drawn in by the urgency of an “80% OFF” banner and a storefront that looks legitimate, many fans will trade their banking details for a knock-off hat.

These websites are hosted on short-lived domains that are quickly recycled once the event is over, and are most commonly disseminated through social media.

“These cybercrime groups are using stolen accounts that have credit cards attached to boost promoted posts,” Botezatu explains. “That's how they reach the right audiences, and that’s how they advertise their offers in front of the right people.”

“They are maximizing their profits using social media tactics,” he adds, explaining that they can abuse the data social media conglomerates such as Meta collect on users to serve their adverts and promoted posts to people of a specific demographic, in a specific geographic area, or those above a specific income.

Free streaming serving up malware

As the build-up to a race reaches its highest intensity, threat actors will begin offering free streaming services to fans desperate to tune in. These websites won’t necessarily only show Formula 1, but will serve a range of content from around the world to funnel in as many users as possible.

In many cases, the dubious streaming service will require that you install a VPN in order to watch. While this is sometimes a legitimate way to watch content that typically would not be available in a user’s region, the services these streaming providers offer are sometimes far from legitimate.

In a best case scenario, Botezatu explains, you’ll end up purchasing a legitimate streaming service that you don’t actually need and you still won’t be able to watch the race, but it will provide the service owner with a source of affiliate revenue. “Worst case, that VPN kit will be malware. and you’re going to infect your computer or device.”

For those on Android devices, some services will require the installation of a third-party video player in order to access a stream, and again, you will install malware. In these circumstances, Botezatu notes, the malware will often monitor your clipboard or your screen to track everything you type into your device, including sensitive banking and financial information.

The alternative some fans turn to is the dodgy-streaming dongle. Where legitimate streaming dongles such as the Amazon Fire Stick start from around $30, some groups will disseminate streaming dongles with preinstalled software for far less, and sometimes at a loss.

While a fan may feel like they’re just got a great deal and free access to every upcoming race, the reality is far sinister. “The people who are selling these are using Formula 1 as a pretext for you to open a proxy; an exit node in a VPN used for cybercrime,” Botezatu says.

“These people give you hardware for free, but instead can sell access to your household to various cybercrime groups that are doing money laundering, illegal content distribution, child pornography, all sorts of things,” he adds.

These devices use your IP address to distribute their illegal content, meaning that when law enforcement investigates these crimes, it could be your house they’re raiding.

Social engineering to dodge antivirus

Hollywood and modern TV has taught many people that hacking is a highly complex, intelligent pursuit that requires the layman to say, “In English, damn it!”

But the malware distribution scams Bitdefender has spotted targeting some Formula 1 fans are incredibly simple that they border on genius.

Those in the know may have heard of ClickFix attacks, whereby an attacker presents the user with a problem that needs to be solved in order to access a website or service. When many of us are presented with a CAPTCHA to solve, we recognize the familiarity of the branding and will trust that it's legitimate.

But ClickFix attacks abuse this trust, and rather than clicking on all the bicycles in an image, the user will instead be prompted to open the Windows Terminal using a keyboard shortcut, and then use the “Ctrl” + “V” shortcut to paste in a line of code that the hacker has snuck into the clipboard.

For many antivirus suites, even first-rate protection, this activity appears to be legitimate human activity. The antivirus will do nothing to stop it, and the code will launch a powershell application that immediately installs infostealing software onto the infected device. The infostealer will then harvest browser passwords, session cookies, saved credit cards, VPN credentials, and email access - leading to even bigger problems for fans.

Our advice to Formula 1 fans? Always be on your guard when hunting for online streams, tickets and merch sales, and other linked activity - and remember, if an offer feels like it could be too good to be true, then it probably is.

• Avast unveils new free modular platform
• Avast One offers free antivirus and scam protection, with optional extras
• Users only pay for the features they use

When it comes to choosing antivirus protection, there has always been a clear separation between the protection offered by free and paid services - an issue that has troubled money-savvy prosumers and budget-lovers alike.

But Avast may have just changed all that. From the baseline, its new Avast One platform includes powerful antivirus protection alongside the essential privacy protections required for the internet of today.

The free tier starts with industry leading antivirus protection, scam protection, and web protection. Should any extra features be needed - such as AI agent protection, a no-log VPN, data breach monitoring, or device cleanup - they can be added as individual modules, so users only pay for what they need.

A free, no-frills, essential online security suite

The new Avast One user journey starts on a single dashboard with free antivirus enabled. From this foundation, users can add the individual modules they need.

Avast One now does away with rigid subscription tiers with locked-in features that some users never use, instead allowing them to flexibly add the individual modules they need.

Outside of the free foundation, users can choose from a range of free and paid addons to improve security and privacy coverage. For example, users can opt to use the platform's free cleanup service to save hard drive space and remove dysfunctional shortcuts and software.

The same goes for the free BreachGuard personal information protection which can scan the dark web for exposure, and stop advertisers from loading sites with targeted advertisements.

"People know what they value and how they want to protect their digital lives," said Travis Witteveen, Head of Products and Portfolios at Gen. "Avast One has been designed to give you greater choice and control making it easy to personalize protection, manage features, and only pay for what you truly need."

For those that require enhanced protection to scan for suspicious emails, banking protection, and remote access protection, users can opt to include Premium Security as a paid addition. Or if a VPN is required, users can choose to pay for Avast’s SecureLine VPN, which comes with a 60-day free trial.

Cleanup can also be upgraded to Premium to include extra space-saving and speed-optimizing features. The same goes for BreachGuard to include leaked personal info alerts, data breach scanning, and access to a cornucopia of security tips and privacy advice.

• Microsoft has a new post on the Windows Learning Center
• It asks: "Do you still need third‑party antivirus in 2026?"
• The conclusion is that Windows 11's built-in protection should be fine for most people, but situationally, you may want to consider an alternative

Ever wondered whether Microsoft Defender can protect your PC from whatever malware might be lurking out there? You're not alone, and Microsoft has just addressed this issue.

Windows Latest noticed that Microsoft has a new post on its Windows Learning Center advising people on the subject of the best antivirus software, and whether the default option in Windows 11 is good enough.

The key question in respect of the latter point comes later in the article, where Microsoft asks: "Do you still need third‑party antivirus in 2026?"

The answer is clear enough: "For many Windows 11 users, Microsoft Defender Antivirus covers everyday risk without requiring additional software. The choice to add third‑party antivirus depends on how you use your PC and which features you value."

Microsoft elaborates that Defender antivirus is "usually sufficient when Windows 11 runs with default protections enabled, updates are installed regularly, and software downloads are deliberate".

The company also notes that SmartScreen plays a part in protecting the average Windows 11 PC, too, and that the coverage given by this feature plus Defender should be fine, bearing in mind the noted caveats.

Situationally, where you might want to consider installing a third-party antivirus or security suite is if you share devices with other family members who may not be as careful as you (or indeed you might want to manage multiple family devices across one dashboard).

Microsoft further notes that you'll need an independent solution if you "want services like identity monitoring or parental controls", which aren't provided by Defender.

Analysis: I don't think Microsoft is wrong here

What Microsoft is essentially saying is that for most people, certainly individual PC owners, Windows 11's built-in antivirus should be just fine. It's mainly family scenarios, where you may want the ability to control internet access for your children, in which you'll need to look for something more extensive in the way of a security suite.

Is Microsoft correct to assert that Defender works well for everyday users? I would say that yes, it is. There was a time in the past where Defender wasn't very highly thought of, but Microsoft has come a long way since then, and relying on Windows 11's default antivirus is not a risky proposition these days.

It covers the basics and keeps you safe from malware, although as Microsoft notes, there are other pieces of the puzzle when it comes to ensuring your PC isn't compromised. That includes applying regular updates (for Windows 11 and other apps), and a sensible dose of caution regarding what you download onto your system (don't underestimate the importance of the latter).

No, Microsoft Defender doesn't offer the best antivirus protection going, but it is good enough. However, it's just the core basics, and other security solutions offer a lot more in the way of features, some of which may be valuable to you.

The other benefit of Defender is that because it's already there in Windows 11, it fits neatly away in the background — updating itself as and when — and the app doesn't require a separate installation (and consumes little in the way of resources).

That said, even if you don't want to pay for an antivirus, there are still relatively lightweight free antivirus apps from major vendors that perform slightly better than Microsoft Defender in terms of malware protection (based on independent tests). The days when Defender was appreciably lagging behind those security top dogs, though, are well and truly in the rearview mirror.

• Huntress sinkholes adware signed by Dragon Boss Solutions LLC
• Malware disabled antivirus, left open update domains exploitable for $10
• Tens of thousands of endpoints compromised, including universities, OT networks, governments, and Fortune 500 firms

Security researchers Huntress recently stumbled upon a piece of adware that, by all accounts, should have been a boring, run-of-the-mill ad-displaying nuisance. However, what they found under the surface raised a few eyebrows and warranted deeper investigation.

In late March 2026, Huntress was alerted to a piece of software signed by a company called Dragon Boss Solutions LLC. This company, allegedly working on “search monetization research” (but instead just displaying unwanted ads and redirects to people) came with an advanced update mechanism that disabled antivirus programs and prevented them from being started again.

While analyzing how the malware worked, the researchers discovered that the threat actors did not register the main update domain, or the fallback one which, at the same time, presented a major risk and a huge opportunity to do good.

Severing the ties

“More concerning is it turned out to have an open door baked right into its update configuration, one which anyone with $10 could have walked straight through,” Huntress said. In other words, someone could have registered these domains and thus taken control over a vast network of infected computers.

Instead, it was Huntress who bought the domains, effectively sinkholing the connection from all infected hosts.

“Within hours” they saw “tens of thousands of compromised endpoints reach out looking for instructions that, in the wrong hands, could have been anything.”

Analyzing incoming IP addresses, Huntress researchers found 324 infected devices in high-value places, including 221 academic institutions, 41 Operational Technology networks in the energy and transport sectors, 35 municipal governments, state agencies, and public utilities, 24 primary and secondary educational institutions, and 3 healthcare organizations. Furthermore, networks of multiple Fortune 500 companies were compromised, as well.

To stay safe, the researchers recommend system admins look for WMI event subscriptions containing “MbRemoval” or “MbSetup,” scheduled tasks referencing “WMILoad” or “ClockRemoval,” and processes signed by Dragon Boss Solutions LLC.

Phishing has evolved beyond obvious tells, such as bad grammar and spelling, or fake email addresses.

In fact, most obvious phishing red flags – unprofessional design, faulty website links – no longer apply. Phishing attacks are polished and often look exactly like a message from a colleague or a bank.

And gone are the days when hackers worked alone out of random premises. That’s another misconception: today’s cybercriminals operate like fully-fledged corporations. They’re licensing tools to partners – ready-made “all in one” phishing kits – who execute attacks.

‘Phishing as a service’ or PhaaS works like any other software subscription service – Netflix, Amazon Prime, or any other product delivery service. Attackers pay a monthly fee which varies depending on chosen features, and in return get fake login pages, email templates, and website hosting that resists takedown.

The tactics and techniques behind PhaaS

PhaaS has evolved into a thriving business model on the dark web. It saves time and effort for criminals who don’t know how to build phishing emails or the infrastructure to host fake login pages. They also use clever methods to avoid detection, such as using links to compromised websites and platforms that look misleadingly legitimate.

There are typically two purchase models; a one-time purchase of a ‘phishing kit’, which can be simple or advanced. More advanced kits include features like geo-blocking and antidetection elements to evade antiphishing bots and search engines.

The other purchase model customers can go for is a subscription-based model where a PhaaS operation takes care of the entire phishing campaign, or a large part of it, for the customer.

A good example is the application ‘Frappo’, which helps cybercriminals create and use premium phishing pages called ‘phishlets’. This works to collect victims' information, like their IP addresses, login credentials, and user-agents. It’s anonymous and doesn’t require its users to even register or create an account.

What is particularly dangerous about these kits is that they are evolving, as cybercriminals are constantly evolving their methods to avoid being detected. But these attackers aren’t even necessarily smarter-they’re just faster.

Keeping pace will require businesses to adopt a layered, proactive strategy which is built around visibility, automation, and trust minimization.

Monitoring is the name of the game

Set against this backdrop, businesses should adopt the mindset that a breach could occur at any moment. This means ensuring requests from users and devices are verified. Integrating identity and access controls helps limit who can do what, and when. That way, if businesses are attacked, the fallout is minimized.

The MITRE framework recommends continuous monitoring, as the only way to spot the subtle patterns that signal an attack in progress. Businesses should monitor application logs, network traffic, and file creation.

This entails using software that can monitor network traffic and perform packet inspection, as well as conduct offline analysis on emails. And organizations should be on the lookout for any new files created from phishing messages. This could be the result of an adversary trying to gain access to vulnerable systems.

There are software tools which can provide businesses with analytics to detect techniques and sub-techniques used to carry out phishing attacks or attempt to gain initial access.

How to prepare for threats

Businesses should be taking action to protect employees – many who don’t even realize they’re at risk. For example, they could implement phishing-resistant MFA such as biometrics, hardware security keys and passkeys, without adding friction to the user experience.

Phishing-resistant MFA is designed to be extremely difficult to crack and to provide protection against device-code compromise. It’s a crucial step on the battle to stay ahead of the phishers, which can also be helped by deploying user and entity behavior analytics (UEBA) profiling to spot anomalies.

Similarly, security orchestration, automation, and response (SOAR) capabilities can be used to automatically execute workflow profiles and assign tickets to security admins to quickly remediate a phishing attack.

It’s also useful for businesses to examine endpoint security and identify any blind spots. Organizations should be set up to deploy patches quickly, detect and defuse threats like ransomware, enforce least-privilege access with MFA, and protect sensitive data wherever it resides.

Adopt a company-wide cybersecurity culture

Businesses should be treating cybersecurity defense like a continuous operation, not a quarterly checklist. This means ensuring buy-in across the organization, and making security everyone’s purview, rather than just that of the IT team.

To build a culture which is cybersecurity conscious, businesses must be sharing threat intelligence across teams. They should also be educating employees into why cybersecurity defense is important, by running red team exercises to simulate attacks.

Conducting regular training sessions on recognizing phishing attempts and using strong passwords is a great first step in the right direction. Employees should be kept aware of how phishing attacks are evolving and getting ever smarter: from artificially intelligent phishing emails to deepfake impersonations and self-evolving malware.

Protecting businesses against PhaaS requires rethinking how they can stay ahead. It’s not just about firewalls, antivirus tools, and endpoint security: it’s also about building a security-aware culture that adapts and anticipates attacks.

We've featured the best secure email provider.

This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro

• Hackers used Hugging Face to deliver Android malware via fake antivirus app TrustBastion
• Malware steals screenshots, lock codes, and payment logins, exfiltrating data to attacker servers
• Campaign persisted with new repositories despite takedown, highlighting risks of unverified app source

Hackers are abusing the Hugging Face platform to deliver Android malware which can entirely take over compromised endpoints, experts have warned.

Hugging Face is an open platform for AI tools and machine learning, where users can host and distribute AL, NLP, or ML models - but it seems it also sometimes used as a launchpad for poisoned models too.

In this case, the crooks used it to deliver Android malware, cybersecurity researchers at Bitdefender noted, starting with a dropper app called TrustBastion.

Thousands of commits

This app acts like an Android antivirus solution - it offers virus protection, defense against phishing, malware, and fraudulent SMS messages. However, TrustBastion engages in scareware - as soon as the victim installs it, it says the device is infected with malware. Then, it demands the user update the app, which is when the malicious code is actually installed.

To deliver the malware, TrustBastion connects to a third-party server, which redirects to a Hugging Face repository where the malicious APK is hosted. From there, the malware is downloaded and delivered via Hugging Face’s CDN.

While these types of campaigns are rather common, unfortunately this one was also successful. In less than a month of activity, it accumulated more than 6,000 commits, Bitdefender said. To make matters worse, as soon as the campaign was spotted and terminated, a new repository popped up, named ‘Premium Club’, using new icons, but retaining the same malicious code.

The malware itself is rather powerful. It can grab screenshots, display fake login interfaces for popular payment services, and steal the lock screen code. Everything is then exfiltrated to a third-party server.

The best way to defend against this type of malware is to only download Android apps from reputable sources, such as the Google Play Store, or the Galaxy Store. Also, make sure to read through the reviews, and be mindful of the number of downloads and overall rating.

Via BleepingComputer

As we usher in the new year, you might have a host of new devices that need antivirus protection. Luckily for you, there are just a few days left to grab up to 33% off ESET antivirus - with big discounts across Essential, Premium, and Ultimate plans!

In our ESET review, we complimented its excellent antivirus effectiveness, low performance impact, and great VPN speeds - but don't just take it from us!

AV-TEST gave it full marks across the board in the latest testing from October 2025, and AV-Comparatives gave ESET the 'Advanced+' award in their October 2025 testing - the highest award possible.

But don't leave it too long to snap up the deals below - the discounts end on January 11!

Today's top ESET antivirus deals

To get everyone in the holiday spirit, ESET has made it even cheaper to secure your devices ready for the new year.

Our ESET review touted its low performance impact, great VPN speeds, and a great coverage-to-cost ratio, but don't just take it from us! AV-TEST gave it full marks across the board in the latest testing from October 2025, and AV-Comparatives gave ESET the 'Advanced+' award in their October 2025 testing - the highest award possible.

So take a look at the deals below, as they might just make the perfect gift for the holidays.

Today's top ESET antivirus deals

Cyber Monday has arrived, and this is your last chance to grab ESET discounts of up to 50% on antivirus software.

In our ESET review, we found the antivirus to be very easy to use, played nicely with other antivirus software on the same device, and the VPN speeds were seriously fast, so its definitely worth picking up this Black Friday.

Don't forget to check my roundup of the best Cyber Monday antivirus software deals - but before you do, take a look at my roundup of the best ESET deals around:

Today's top ESET antivirus deals

Norton is one of the best antivirus software providers around - and with good reason.

Norton antivirus frequently scores very high in our own testing and in the testing performed by third-party labs, and right now you can pick up Norton antivirus with a limited-time Cyber Monday discount.

Below, I have rounded up the best discounts from Norton for your region, ranging from single device protection, to family plans, mobile friendly antivirus, and even some great value plans on business antivirus.

Use the links below to jump to the best deals in your region:

• US Norton Antivirus Deals
• US Norton Business Antivirus Deals
• UK Norton Antivirus Deals
• AUS Norton Antivirus Deals

US Norton antivirus deals

US Norton SMB antivirus deals

UK Norton antivirus deals

AUS Norton antivirus deals

Its Black Friday, which means Amazon has officially kicked off its Black Friday sales with some of the biggest savings on the best antivirus software you'll see in 2025.

Amazon's Black Friday antivirus deals are seeing prices cut by over 80%, and to help you find the biggest savings on your favorite software, I've rounded up all the best Amazon Black Friday antivirus deals I've seen so far.

Antivirus software helps protect your devices from malware and hackers by intercepting malicious files before they have a chance to execute. As a bonus, many antivirus packages throw in extra features such as identity theft protection, scam detection, a VPN, and even password managers to keep your credentials secure.

You'll find even more savings on our roundup of the best Black Friday antivirus deals, where we have collected deals on antivirus, password managers, identity protection, and data removal services.

Today's Best Amazon Black Friday Antivirus Deals

In the UK? Norton 360 Deluxe is just £11.50 at Amazon

In the UK? Bitdefender Total Security is just £20 at Amazon

In the UK? McAfee Total Protection is just £12.50 at Amazon

In the UK? McAfee+ Premium is just £40 at Amazon

In the UK? Malwarebytes Premium is just £20 at Amazon

Cyber Monday and Black Friday are some of the best times times to take advantage of security software deals. This sale season, we've taken the time to round up the best Cyber Monday security software deals around right now - with a particular focus on deals that are half price (or better)!

From antivirus software through to secure email providers, security software can help protect almost every aspect of your digital life, keeping it safe from overreaching websites and hackers looking to steal your data.

To keep up to date with all the latest Black Friday discounts on security software, don't forget to bookmark my roundup of the best Cyber Monday antivirus deals.

Antivirus

In the UK? This Bitdefender deal is down to £19.99 per year

Password Manager

In the UK? This NordPass deal is down to £0.95 per month

Data Removal

In the UK? This Incogni deal is down to £9.90 per month

Parental Controls

Secure Email

In the UK? This Proton Mail deal is down to £2.04 per month

We've also rounded up our picks of the best Black Friday cloud storage deals.

Technology can protect you from certain cyber threats, but it cannot protect you from falling in love with an AI sweetheart carefully created by cybercriminals.

Some of you may remember the late 90s and early 2000s, when peace of mind was achieved simply by installing antivirus software on a PC with an Intel Pentium 4 processor, 80GB hard drive, and NVidia GeForce4 Ti 4200 graphics card.

Those were different times, when for ordinary people like myself even a mediocre firewall was completely sufficient.

It was a world before tempting financial offers from Nigerian princes or news of a generous inheritance from an uncle in the United States, Canada, or Australia you never knew existed. Back then, “scam” wasn’t a buzzword.

But times have changed. According to the latest CrowdStrike Global Threat Report, 79% of intrusion detections are now malware-free. This means that attackers simply log in with stolen credentials instead of relying on malicious software.

With the rapid development and accessibility of AI tools, the ability to launch highly personalized scams and identity theft at scale has only increased.

I would go further: we are now accelerating into a new era of fraud. The AI revolution has shifted cyberthreats from cold, abstract malware to the most vulnerable corners of human emotion – love, compassion, fear, loneliness. Basic feelings have become humanity’s greatest security weakness.

Criminals focus on vulnerable users online

While malware did not choose its victims, today’s cybercriminals deliberately target the most vulnerable internet users. Grandparents and romance scams, as well as fraudulent job recruitment offers, are among the fastest-growing digital crime categories.

News headlines are filled with stories of people swindled out of their life savings after believing in a fake relationship with an AI bot impersonating the person of their dreams.

With vishing attacks increasing by 442% last year, many victims were deceived by voice-cloning scams where fraudsters pretended to be relatives “in trouble.”

The FBI’s Internet Crime Report reveals that Americans lost $16 billion to cybercrime in 2024, a 33% increase compared to 2023.

The Federal Trade Commission reports a dramatic rise in impersonation scams targeting older adults: combined losses for people aged 60 and over who lost more than $100,000 reached $445 million in 2024, compared to just $55 million in 2020.

Even more concerning, these crimes are now supported by global infrastructure. Fraud centers are being set up in underdeveloped countries, entire villages are dedicated to scams, and organized groups collaborate seamlessly across borders.

Many victims feel ashamed of being scammed. It is understandable – no one wants to appear foolish – but the truth is that scams exploit emotions, not intelligence. Everyone can fall for them.

Even cybersecurity professionals sometimes fall victim to social engineering. Being scammed should be seen as no more shameful than being pickpocketed in Rome or having your house robbed. The stigma must disappear.

At some point, becoming a victim of fraud may be as ordinary as experiencing theft in any major city. And just as we protect our homes and belongings to minimize losses, the same approach must shape the future of cybersecurity. Cybersecurity can no longer be limited to blocking malware – it must evolve the way home security has.

Digital protection requires full spectrum of tools

Technology remains central to this. Despite what I wrote earlier, malware, malicious ads, and digital exploits have not gone away. Failing to install proper protection is like leaving your doors unlocked: you may not be robbed immediately, but eventually it will happen.

Yet, as we know, locked doors alone do not stop burglars. That is why people invest in alarm systems and surveillance.

The same logic applies to identity theft. The most sophisticated social engineering and scam attacks usually begin with leaked personal data. If your identity is exposed in a data breach, it becomes a key that unlocks larger fraud attempts.

This is why identity monitoring – “digital eyes” that scan for compromised data – has become increasingly important.

And even if you take every precaution, crimes still happen. That is why homeowners turn to insurance companies for coverage. The same must apply to cybersecurity. As noted earlier, many victims lose their entire savings to scams. Insurance may become the safety net that helps people recover.

According to multiple market projections, the cyber insurance sector is expected to grow 15–25% annually by 2029. In other words, cyber protection is moving in the same direction as home security. Unfortunately, with the scam industry growing at record speed, we are still lagging behind.

We've featured the best private browser.

This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro

With an increasing number of people running into trouble online, it's important that we all find ways to stay safe. Digital security and cyber security might be just buzzwords to some but with viruses, online threats, payment issues, and password compromises, it's not enough just to hope it won't happen to you.

With that in mind, we'd highly recommend ESET, who offer some of the most comprehensive protection that is on the market - and right now you can grab any plan for 30% off with our exclusive ESET code: TECH30. It doesn't get better than that.

This comprehensive security suite has everything you need to protect yourself from threats online. It's as simple as choosing between Essential, Premium, and Ultimate packages, with ESET taking care of the rest. That means you'll be protected from online threats so you can browse with confidence.

Save 30% with our exclusive code

The ESET features that we love

ESET packages offer a range of different features to help keep you safe online. One of the best features, is the secure VPN. It encrypts your internet connection, which hides your IP address and therefore makes browsing the web safer than ever. This is particularly useful if you're using public Wi-Fi.

The last feature to mention is the anti-phishing technology. If a website looks to steal sensitive information, then ESET will jump in and bring the much-needed protection. With proactive ransomware protection, users can rest easy knowing their files are safe from malicious software along with a UK-based customer and tech support.

Overall, ESET security provides the level of cover that users need to ensure a safer browsing experience. These packages are ideal for those who rely on the internet for their work, entertainment, and daily life.

• Microsoft's clarified that Defender Antivirus will continue to get updates on Windows 10 even though support for the OS has now ended
• The antivirus will receive updates and new virus definitions through October 2028
• That'll help keep these PCs safer, but it's not the full story

Microsoft has made it clear that its Defender Antivirus will still provide protection against malware on Windows 10 PCs, which have just reached their End of Life in terms of support.

Neowin picked up on a blog post where Microsoft stated that: "Microsoft Defender will continue to provide detection and protection capabilities to the extent possible on Windows 10 and other legacy systems."

The company adds that: "For Windows 10 customers without Defender, Microsoft will continue to provide security intelligence updates for the built-in Microsoft Defender Antivirus protection through October 2028."

It's the latter bit that we're interested in, as consumers continue to run Windows 10: this is the built-in antivirus that comes by default with the OS, and, as noted, it'll keep working with updates and virus definitions provided until October 2028. 'Microsoft Defender' refers to the broad suite of security features as a whole, including the antivirus and more.

So, if you've got security updates for Defender Antivirus through to 2028, are you safe sticking with Windows 10, even without monthly cumulative updates for the operating system?

No is the short answer to that, as Microsoft points out: "Defender Antivirus alone isn't a comprehensive risk mitigation posture", and you need to sign up for Windows 10's Extended Security Updates (ESU) program as well as keep Defender Antivirus running.

Analysis: what's safe enough?

This is something I've already discussed in a recent article about whether using Windows 10 is safe after the end of support deadline. While it's true that you may be okay if you pursue this route, and you're very, very careful about what you do online, and you have a good antivirus backing you up (Defender is decent enough), the reality of this situation is that most of us simply aren't cautious or careful enough – even if we think we are.

And even the ultra-cautious could be hit by malware if they're unlucky - and without Windows 10's monthly security updates, as time goes on, the risks increase because there will be a growing number of unpatched holes in the older operating system. It's just a simple matter of odds, and given that extended support (for an extra year) is free to consumers (bar a slight catch, albeit that caveat isn't present in Europe), you'd be silly not to take up Microsoft on that offer, frankly.

Don't rely on Microsoft Defender or any other antivirus in place of Windows 10 updates, as Microsoft advises, even if its own security app is still getting regular updates through to 2028.

You might also like

• I was about to upgrade to Windows 11, but I've decided to stick with Windows 10 – here's why
• Is using Windows 10 still safe after the End of Life deadline? All your questions answered
• Microsoft exec's vision of Windows 12 and beyond could terrify some of you

From halting fuel pipelines to crippling hospital IT systems, cyber attackers are seeing continued success in targeting the infrastructure that underpins society.

Some of these attacks are the work of high-level, state-backed operatives seeking to weaken rival powers. Other incidents stem from opportunistic criminal gangs aiming for digital extortion, such as the recent spate of attacks using the Medusa ransomware-as-a-service.

Whatever the motivation, the objective is the same: cause maximum chaos and disruption. In sectors like energy, manufacturing, and healthcare, even a brief outage can be economically devastating or, worse, life-threatening. And that’s exactly what threat actors are counting on.

These attacks are especially effective at the intersection of digital and physical systems, which means they are increasingly targeting operational technology (OT) systems interconnected with IT networks.

To protect vulnerable OT systems and keep operations running, organizations must shift their focus from prevention to containment, limiting the reach and impact of inevitable breaches.

How attackers are exploiting OT’s unique weaknesses

OT environments weren’t built for today’s threat landscape. Most systems were engineered decades ago for reliability and continuity, often with local-only access in mind. Any security measures were concerned purely with physical access to control panels.

Today, those same systems are increasingly connected to broader corporate networks to facilitate remote access and automation. It’s common to find protocols like Modbus, PROFINET and DNP3 still running unmodified from their legacy pre-digital days without encryption or authentication.

Industrial controllers and field devices rarely support modern defences like endpoint agents or patch management. In some cases, even identifying which assets exist on the network is a challenge.

Add in remote-access VPNs, retrofitted TCP/IP, and shadow IoT devices, and the once-isolated OT domain becomes an open playing field for attackers. They don’t need sophisticated exploits; gaining a foothold in a flat network is often enough to start causing chaos.

Many of these OT systems aren’t just vulnerable, they’re predictably exploitable, and adversaries know it. According to recent research 77% of companies suffered an attack compromising confidential data or disrupting their OT over the last 12 months

Why OT needs more than prevention

One reason so many attacks succeed is that many organizations still pin their hopes on traditional perimeter defense, tools like firewalls, antivirus, and access controls, which are geared to keep threat actors out.

But it’s been clear for some time that this approach has reached its limit against modern attack strategies, and nowhere is this more evident than in OT environments.

Industrial systems often rely on hardcoded passwords, unpatched firmware, and/or decades-old hardware that can’t support modern security tools.

In many cases, installing endpoint protection or making configuration changes isn’t possible without risking system instability.

In OT environments, breaches are increasingly inevitable. And when a threat actor gains network access, the real danger begins. Lateral movement allows them to hop between systems, turning a single breach into a full-blown incident that can grind an entire operation to a halt.

Relying solely on prevention creates a false sense of security. The smarter strategy is to assume the perimeter will fail, and build in controls that limit the damage. In critical environments, containment must be the foundation of a resilient defense

How containment builds true resilience

Containment isn’t about locking everything down. It’s about understanding your environment and how systems are connected, and putting guardrails in place so a breach can’t spiral out of control.

OT environments often consist of a piecemeal collection of legacy tech added over time, with no unified inventory. That makes getting started on security feel overwhelming.

Visibility is the first step to making it manageable, using discovery tools to build a complete inventory of the OT environment. From there, the priority is identifying the minimal set of systems critical to operations such as PLC shutdown functions and SCADA historian databases.

Next, it’s time to apply microsegmentation, one of the most critical capabilities in containing intrusions and preventing lateral movement. Apply microsegmentation to one surface at a time, starting with high-priority assets that are likely to be targeted by attackers seeking to cause maximum chaos.

One effective OT approach is to group assets by function, such as emergency shutdown systems, historian databases, or engineering workstations, and place them in separate security zones.

Once assets and connections have bene identified, policies can be set up to govern system access using exception-based allow-listing and behavioral baselining. Disabling all unused ports and protocols and permitting only multi-factor-authenticated operational flows will drastically reduce the attack surface.

Applying Zero Trust principles to microsegmentation ensures that access is never granted without the right level of authorization. Allowing only verified traffic between authorized systems prevents attackers from using tools like RDP or SMB to skirt around defenses and achieve lateral movement.

Finally, AI-driven security graphs can learn normal communication patterns, enabling security teams to automatically isolate anomalous commands before they can escalate into full-blown attacks.

With the right strategy, this containment approach will protect what matters most, without disrupting what keeps the lights on.

Organizations should regularly test their defenses against real-world threats, including quarterly “network unplug” exercises that manually validate SCADA and PLC operations under simulated attacks.

Why shifting to containment demands a cultural change

Alongside the technical challenges of securing complex OT environments, cultural blockers can be a major obstacle. In many industrial settings, change is seen as risk. Some systems may have operated for decades without incident, and any initiative that threatens uptime, even temporarily, can face strong resistance.

This resistance often extends to risk and security management. Some organizations still rely on outdated frameworks like the Purdue model, which no longer aligns with the open, interconnected nature of today’s digital environments.

There’s a persistent ‘if it ain’t broke…’ mindset around OT systems, but in today’s threat landscape, that attitude is increasingly dangerous.

Securing the OT systems that power our most critical infrastructure demands a shift in mindset, from prevention to resilience. Embedding this approach starts with tracking what matters. Metrics like mean time to containment, blast radius size, and operational impact offer far more meaningful insights than the number of alerts closed.

OT environments can’t afford to wait for new regulations, major incidents, or board-level directives to act. Containment is achievable now, and it doesn’t require a complete overhaul.

Start with the basics: visibility, segmentation, and access control. Identify what matters most and make it harder to reach. Resilience, not perfection, is the new security benchmark. For OT environments facing adversaries bent on chaos, that shift in mindset might be the most important upgrade of all.

We've featured the best online cybersecurity course.

This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro

Fortect may not be one of the biggest names when it comes to the best antivirus and security, but this German business demands attention thanks to an ethos that prizes transparency, trust and user empowerment.

They’re all good qualities when trying to identify your next piece of security software, and it means that we’re eager to evaluate the company’s specific antivirus credentials in this review.

If you need a free antivirus product, then Fortect does have one option available – but it’s very limited. You can view and fix issues one-by-one using a manual repair system, but automatic repairs are only supported in the paid versions of the product.

Fortect’s paid antivirus module is found within a wider product called PC Suite, which also includes a slate of PC tweaking, optimization and repair tools alongside security features.

Fortect’s most affordable paid product, Essential, protects one system for one year and includes all of the app’s core features for $38.

Upgrade to the multi-device plan for $47 and you get unlimited annual usage for three devices. The Ultimate product, which costs $65, includes licenses for five devices.

Those single-device and three-device plans are priced reasonably, but the Ultimate product feels a tad expensive: Norton 360 Deluxe supports five devices for $49, for instance, and you can get Sophos Home Premium protection for ten devices for $44.99.

Fortect: Interface

Installation is easy and, once it’s complete, Fortect runs through a comprehensive system scan. Because this is a PC suite rather than just an antivirus scanner, its results outlined a host of issues, but Fortect was comprehensive when tackling security: it detected a vast array of potential privacy issues, for instance.

Get beyond that initial scan and Fortect has one of the best interfaces we’ve seen on a PC security and tweaking app.

It’s modern and mature, with navy blue shades throughout, and the dashboard has a huge “On” button that starts a full system scan.

The front page has indicators so you can see if malware and real-time protection are both activated, and on the left-hand side there are links to the app’s performance, security, privacy and VPN modules.

Delve into the Security section and you can deploy quick and custom scans and toggle malware and real-time protection, and drag and drop folders and files for custom scans.

In the Security settings menu you can enable real-time protection, cloud-based analysis and the browsing shield, which blocks harmful sites. You can also customize the frequency of security reports and tweak file quarantine settings.

The app’s Privacy module includes browser cache cleanup, and a unique tool that enables users to remove traces of Office apps from their system. You’re also invited to install an effective, free Chrome browser extension that monitors your browsing activity and highlights any issues.

Fortect: Antivirus and Protection

Fortect’s Antivirus module delivers real-time malware and web browser protection, comprehensive scanning for malware and unwanted apps, and cloud-based technology that provides the app with updates of new and emerging threats.

The app automatically fixes and removes threats, repairs your system if it becomes unstable, and can be used to create system restore points. Malicious files, folders and apps can also be quarantined.

Fortect’s macOS version also includes real-time protection, cloud-based security, full system scanning, quarantine management and detailed security reports, and its Android and iOS apps include all of those abilities alongside network scanning, website blocking, data breaches alerts and a system advisor.

To access these features across multiple devices, you’ll have to pay for one of the pricier tiers that supports multi-device usage.

Most of the antivirus products we cover have been independently tested by AV-Comparatives and AV Test – or a reputable alternative like SE Labs.

Sadly, none of those organizations have evaluated Fortect, so we’re turning to Virus Bulletin and AppEsteem.

VirusBulletin is a global authority on the antivirus industry and has been testing consumer and enterprise security software for over two decades. VirusBulletin’s publications include reports by leading researchers and details about new threats, with archives going back to 1989.

VirusBulletin’s VB100 certification is awarded to apps that “meet the basic standards required to be recognized as legitimate and properly functioning anti-malware solutions.” Fortect has earned that certification with a Grade A result, with 99.19% of malware detected and only 0.007% false positives.

AppEsteem certifies apps using the Anti-Malware Testing Standards Organization’s protocols to provide consumers can see which apps offer effective antivirus performance without false positives and over-aggressive monetization tactics.

AppEsteem’s testing saw Fortect rated as a Contender, with an 88% rating for Deceptors and a 94% pass mark for certification. That’s not the best score and it means you’ll likely see some upselling attempts in this app – and we can vouch for that, given that upon installation we were presented with an offer to upgrade to a multi-device app.

Apps from Avast, AVG, Sophos and others provided a cleaner experience than Fortect, but tools from Malwarebytes, Bitdefender and Norton received poorer ratings – so Fortect is not the worst offender here, and you shouldn’t let the occasional special offer put you off.

Fortect: Other features

As Fortect Antivirus is included in a wider PC Suite, that means you get a solid range of additional features in the app.

Fortect’s Performance Scan identifies junk files and crashed apps that can slow your PC down, and the app also has a Driver Updater that will make sure your system is always up to date.

Those PC performance features are not particularly extensive, though, and there are plenty of features missing elsewhere if you compare Fortect to apps like Norton 360 and Sophos Home Premium.

Norton, for instance, included an unlimited VPN, dark web monitoring, parental controls, a password manager and a private browser. Sophos had more in-depth web filtering. None of that is available with Fortect.

Support options are underwhelming, too. If you need help with Fortect, you can complete a web form and get a response within 48 hours – below the industry standard in 2025. Norton has live chat and phone support options and paid options for more extensive help, and Sophos has chat options.

It’s worth mentioning that Fortect is a slightly different product to those two rivals: it concentrates on PC optimization and security. But given the pricing parity between all of these tools, it makes Fortect’s value proposition look a little underwhelming.

Fortect: Final verdict

The antivirus testing that we’ve found indicates that Fortect does an excellent job of protecting devices from the latest threats.

That said, its lack of testing from our favored testing sites means that we’re reluctant to give a wholehearted recommendation when compared to tools that have scored well across a wider array of testing services.

There’s no doubt that this app is a slick, easy to use tool: it’s got an excellent interface with straightforward design and sensible organization. But that does mean that Fortect lacks the in-depth tweaking and customization options that are commonplace on tools that will appeal for a more technical audience.

Go beyond its core antivirus and PC performance functionality, though, and there’s not much on offer here compared to other tools – rivals routinely include VPNs, password managers, parental controls and more, alongside better support.

Fortect may do a good job with antivirus abilities, but rivals offer more functionality and customization. Fortect is not bad, but there are better options available.

We've listed the best firewall software.

• Crypto24 ransomware group was seen disabling AV protection before deploying the encryptor
• In some cases, it can even uninstall the AV programs
• A layered defense is the best approach to mitigate the threat

Security researchers have found another antivirus-killing tool out there that hackers are using before dropping any additional payloads.

Experts from Trend Micro have uncovered custom variant of the open source tool called RealBlindingEDR.

This tool comes with a hardcoded list of antivirus company names:

Trend Micro
Kaspersky
Sophos
SentinelOne
Malwarebytes
Cynet
McAfee
Bitdefender
Broadcom (Symantec)
Cisco
Fortinet
Acronis

When it is deployed on a device, it looks for these names in driver metadata, and if it finds one, it disables kernel-level hooks/callbacks, essentially blinding detection engines. Trend Micro’s researchers found the hackers are also able to silently uninstall antivirus programs altogether, opening the doors and enabling easy deployment of stage-two malware.

Crypto24

The tool was seen in the wild, used by a hacking collective called Crypto24, a nascent ransomware group first spotted in September 2024.

However, the researchers believe the group consists of former members of other, defunct hacking collectives, since its members are highly skilled and experienced.

When it gains initial access, establishes persistence, and removes antivirus roadblocks, the group usually deploys two pieces of malware - a keylogger, and an encryptor. All of the stolen secrets are exfiltrated into a Google Drive using a custom tool.

The identity, or location, of Crypto24 is currently unknown. However, researchers are saying that in its short lifespan, the group successfully hit a number of large organizations in the United States, Europe, and Asia. Most of their targets are in finance, manufacturing, tech, and entertainment.

There are many ways to protect against attacks looking to disable antivirus protection, including opting for a layered defense strategy.

Companies can use a reputable antivirus with tamper protection, enable real-time protection and firewalls, and use a separate anti-malware tool that can work alongside an AV.

Via BleepingComputer

You might also like

• Top antivirus tools targeted by "killer" malware
• Take a look at our guide to the best authenticator app
• We've rounded up the best password managers

The recent surge in cyberattacks on major UK retailers such as the Co-op and Marks & Spencer has brought home the harsh reality of today’s threat landscape. These breaches haven’t just exposed sensitive data—they’ve caused millions in lost revenue, long-term operational disruption, and reputational damage. For cybercriminals, attacks of this scale serve as proof of the damage they can inflict—and a blueprint for future campaigns.

Cyber threats are no longer rare occurrences. They are relentless, increasingly automated, and difficult to detect. Attackers are exploiting misconfigurations, weak credentials, and unseen trust relationships to move laterally and escalate access—rendering traditional defenses like firewalls and periodic scans no longer sufficient.

Thanks to advances in AI, launching a sophisticated cyberattack now costs next to nothing. Today’s adversaries—from nation-state actors to cybercrime groups—are deploying AI-powered agents capable of disrupting not only individual organizations, but entire sectors. The UK retail incidents may have made headlines, but similar techniques are being used across industries—quietly eroding systems over time.

If there’s one takeaway from these breaches, it’s that they are a wake-up call—an opportunity to separate what’s assumed to be secure from what’s proven to be. Marks & Spencer’s decision to accelerate their tech transformation is the right move, but only if it’s grounded in security that’s continuously validated, not just promised.

Why passive defense is no longer enough

Traditional cybersecurity measures—like firewalls, antivirus software, and compliance checklists—were built for a slower, more predictable threat landscape. They aim to block known threats and tick regulatory boxes, often relying on periodic assessments and static defenses.

But today’s threat actors move faster than these systems can react. They use automation and AI to adapt, persist, and exploit weaknesses in real time. In a world where threats evolve daily, a reactive approach simply can’t keep pace. Organizations need strategies that assume compromise, move proactively, and adapt with the same agility as the attackers they face.

A radically faster threat landscape

We’re in a new reality. With generative AI, developing weaponized exploits no longer requires deep technical expertise—just the right prompt. What once took weeks of work by highly skilled attackers can now be achieved in minutes by anyone with access to the right tools. This levelling of the playing field has dramatically accelerated the pace of cyberattacks.

The moment a vulnerability (CVE) becomes public, attackers begin exploiting it almost instantly. There’s no longer a buffer for defenders to respond. The asymmetric advantage we thought we had—people, process, tools—is eroding because the adversary has something more powerful: tempo. The result is a cyber environment defined by speed, where hesitation or outdated defenses can be costly.

Offence is the best defense

As cyber threats evolve in both speed and sophistication, traditional security measures—while still necessary—are no longer enough on their own. Tools and audits tend to focus on ticking regulatory boxes rather than addressing the weaknesses most likely to be exploited in real-world attacks.

To stay ahead, organizations need to go beyond passive defense and adopt a more adversarial perspective. Offensive security does just that—actively probing systems for weaknesses using techniques such as penetration testing, red teaming, and social engineering simulations. These controlled exercises expose gaps that conventional tools often overlook, giving teams the chance to fix them before malicious actors do.

This shift in approach is becoming crucial. As attackers grow faster and more opportunistic, defenders must become equally agile. Offensive security replaces assumptions with evidence—offering a clear, action-oriented view of where security holds firm and where urgent improvements are needed.

What UK businesses must do now

Many organizations are responding to rising cyber threats by increasing patching cycles and ramping up alert monitoring. But volume alone doesn’t equal security. The real challenge is not visibility, but prioritization. Rather than trying to fix everything at once, security teams must understand where cyber criminals are most likely to strike—and act accordingly.

This is where adversarial testing plays a vital role. Simulating the techniques used by real attackers helps uncover the vulnerabilities that matter most. It moves businesses away from reactive models and towards a more strategic, evidence-based approach to defense.

For UK companies—especially in exposed sectors like retail—key steps include:

• Implementing continuous security testing to keep pace with constant change
• Reviewing and updating incident response strategies to reflect evolving threats
• Investing in threat intelligence and red-teaming to sharpen detection and resilience

Speed isn’t the enemy—assuming you're secure is. Modernizing in a post-breach window can make you stronger, but only if every new system, integration, or control is tested like an attacker would.

Too many organizations skip this step. They make the mistake of equating 'new' with 'secure' and implement changes without knowing what risks they’re introducing. We’re not in the age of zero-days anymore.

We’re in the age of zero hours. The organizations that stay secure won’t be those that react the loudest—but those that challenge assumptions and prove their defenses work, day in and day out.

The role of leadership

Cybersecurity can no longer be treated as a siloed IT concern — it’s a critical business issue that belongs on the board agenda. From operational continuity to customer trust, cyber resilience underpins every facet of modern enterprise. That’s why leadership alignment is essential. Security decisions must be cross-functional, embedded into digital transformation efforts and tied directly to business risk and reputation.

Security-by-design isn’t a checkbox—it’s a mindset. And the only way to know you’re getting it right is to validate like the adversary. That’s how you build real resilience, restore trust, and come back stronger.

From assumptions to assurance

In a threat landscape defined by speed and unpredictability, being proactive isn’t optional — it’s essential. UK retailers and businesses across sectors must move beyond reactive measures and start thinking like attackers. The organizations that will lead in security aren’t those with the most tools, but those with the discipline to test, question, and validate every assumption — before it’s too late.

We've featured the best encryption software.

This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro

• Connex Credit Union confirm suffering major data breach
• Customer data stolen, and the attackers have not been identified
• Users are warned to be wary of suspicious incoming emails

Financial cooperative Connex Credit Union has revealed it suffered a cyberattack in which it lost sensitive data on around 172,000 customers.

The company confirmed the news in a new filing with the Office of the Maine Attorney General, as well as via data breach notification letters it sent to affected individuals.

In the letter, the company said it experienced “unusual activity” on its network on June 3, 2025, and after an investigation concluded that an unauthorized third party stole sensitive files the day before. After almost a month of investigating, Connex determined that the threat actors stole people’s names, account numbers, debit card information, Social Security numbers (SSN), and other government identification information needed to open an individual’s account with the company.

Shifting strategies

“Connex has no reason to believe the incident involved unauthorized access to member accounts or funds,” it was said in the letter.

The letter then goes on to say the usual - that the company is further strengthening its cybersecurity posture, and that it is offering 12 months of free credit and identity theft protection services. It picked Cyberscout as the service provider in this case.

Connex Credit Union is a well-established, member-owned financial cooperative based in Connecticut. It is one of the largest credit unions in Connecticut, with more than 70,000 members and over $1 billion in assets.

At the same time, a San Francisco law firm - Schubert Jonckheer & Kolbe, is said to be investigating this data breach under the suspicion the company took too long to notify its customers of the incident.

In a press release, the law firm said the breach occurred in June 2025, but Connex “did not begin notifying affected individuals until or around August 7, 2025, which may have violated state and federal laws.”

In the State of Connecticut, the deadline for notification is “without reasonable delay, but no later than 60 days after discovery of the breach”. That is, unless shorter time is required by federal law.

How to stay safe

There are numerous ways cybercriminals can abuse the stolen files.

They can create accounts with different financial and government institutions, running wire fraud and tax evasion schemes.

They can also engage in spear-phishing attacks to deploy malware, or even ransomware, against the victims.

To stay safe, users should be careful when opening unsolicited communications, and should keep a close eye on their bank statements.

Via BleepingComputer

You might also like

• Cybercriminals launch new malware that can completely wipe out your antivirus
• Take a look at our guide to the best authenticator app
• We've rounded up the best password managers

• EDRKillShifter is getting a dangerous upgrade
• The new malware can disable AV and EDR from reputable vendors
• Sophos, Bitdefender, and Kaspersky among the tools being targeted

Cybercriminals appear to have improved their antivirus-killing capabilities, as recent research suggest a new tool being shared within the underground community.

In a new report, security researchers from Sophos said multiple ransomware groups are successfully disabling endpoint detection and response (EDR) systems before deploying the encryptor.

Originally, the group known as RansomHub developed a tool called EDRKillShifter, which Sophos says is now made obsolete thanks to this new and improved variant. The new tool can disable security software from multiple high-end vendors such as Sophos, Bitdefender, and Kaspersky.

Shifting strategies

The malware is often packed using a service called HeartCrypt, which obfuscates the code to evade detection.

Sophos found the attackers are using all sorts of obfuscation and anti-analysis techniques to protect their tools from security defenders, and in some cases, they’re even using signed drivers (either stolen or compromised).

In one case, the malicious code was embedded inside a legitimate utility, Beyond Compare’s Clipboard Compare tool, the researchers explained.

Sophos also said that multiple ransomware groups are using this new EDR-killing tool, suggesting a high level of collaboration between players.

EDRKillShifter was first spotted in mid-2024, after a failed attempt to disable an antivirus and deploy ransomware.

Sophos then uncovered that the malware dropped a legitimate, but vulnerable driver.

Now, it seems there is a new method - taking an already legitimate executable and modifying it locally by inserting malicious code and payload resources (as was the case with Beyond Compare’s tool). This is often done after the attacker has access to a victim’s machine, or when creating a malicious package that pretends to be legitimate.

To defend against this threat, Sophos suggests users check whether their endpoint protection security products implement, and enable, tamper protection.

Furthermore, businesses should practice “strong hygiene” for Windows security roles, since the attack is only possible if the attacker escalates privileges they control, or if they can obtain admin rights.

Finally, businesses should keep their systems updated, as Microsoft recently started de-certifying old signed drivers.

You might also like

• Cybercriminals launch new malware that can completely wipe out your antivirus
• Take a look at our guide to the best authenticator app
• We've rounded up the best password managers

Fifty years ago, it was heists like the one that hit the Baker Street Bank that had the power to shock the nation. Now, in the digital world, heists look starkly different and cybersecurity threats are constant, with banks like NatWest facing a “continuous arms race” with around 100 million cyber-attacks every month. What used to be gangs of robbers digging tunnels and smuggling deposit boxes full of cash are now groups of hackers sending phishing emails and holding some of the most notable companies to ransom for hundreds of millions of dollars.

This transition from physical to digital theft is evident. No longer confined to vaults and getaway cars, today's high-stake heists are executed remotely, by online threat actors. These modern-day criminals operate across borders, targeting vulnerabilities in systems and human behavior to extract data and money. The sheer volume and relentless nature of these digital assaults, as exemplified by financial institutions battling millions of cyber-attacks monthly, highlight a new era of crime.

The growing problem of cyber-attacks

Cyber-attacks are a growing problem, amongst a growing number of sectors, and confronting this escalating issue is vital. It’s not just banks that are facing the constant threat of cyber-attacks; cyber threats are growing at an exponential rate, while becoming increasingly sophisticated and targeted.

Data breaches have hit a myriad of industries: from luxury brands like Dior and supermarkets like M&S, to cryptocurrency exchange Coinbase and UK government organization Legal Aid.

The dangers to personal data are being felt across all sectors, at all digital touchpoints. Amid this battleground of immediate cyber threats comes a growing demand for robust security solutions that address company concerns.

From advanced antivirus technologies to endpoint backup software, AI-powered security is evolving rapidly to stay ahead of such attacks - and it’s essential that companies invest in these defenses in order to stay more than one step ahead.

Evolution of technology

As technology evolves at a rapid pace, companies must keep up with advancements made by cyber-attackers. As businesses of all sizes continue to embrace digital transformation, the need to strengthen their cybersecurity grows increasingly critical.

The UK Government’s recently published Cyber Governance Code of Practice highlights that management of cyber risks is vital for modern businesses to function, and effective management requires collective input from across an organization. This Code of Practice and governance framework package guides boards and directors in managing digital risks and safeguarding their businesses and organizations from cyberattacks.

The framework encourages companies to take four employee-focused actions: foster a cybersecurity culture; ensure clear policies support a positive cybersecurity culture; improve their own cyber literacy through training; and use suitable metrics to verify the organization has an effective cybersecurity training, education, and awareness program.

The report is a clear reminder that the human firewall, that is, the employees who encounter an attack and respond, is just as important as technological defenses.

More than a simple fix, a culture shift is needed

It’s not enough to roll out generic training. The reality is that in today’s world, one wrong click can bring a business to a complete halt. According to the latest insights, the approximate amount of ransoms paid globally in 2024 reached $813.55 million.

When requested to pay a ransom, companies know that refusing to do so runs the risk of their customers’ personal information being leaked publicly, which would additionally require them to pay the associated financial penalties and legal payouts, not to mention reputational damage.

Addressing the threat of cyber-attacks must be embedded in a company’s culture, given the fact that if threat actors are successful, the impact of their actions would be felt not only company-wide but also by the ecosystem within which the organization operates.

Leadership and security

Organizations can bolster their security by cultivating strong leadership, providing tailored training, and building a proactive security culture to create a ‘human firewall’ of colleagues armed with know-how.

Employees of all skillsets and seniorities should undergo comprehensive and ongoing cyber awareness training, whatever their role and seniority, to drive the defenses forward and cultivate a mindful culture.

When employees are provided with the knowledge and tools to maintain awareness of the dangers their company is facing, they can be the most effective method to keep the business secure.

Building a mindful culture

Building a mindful culture can be complemented by a Zero Trust approach, which creates a robust defense against evolving cyber threats. This strategic approach mandates rigorous verification for all access requests, irrespective of their origin or the user's location within the network, thereby yielding exceptionally strong results that effectively eliminate a significant portion of potential threats.

For example, when an employee receives an email requesting sensitive information or a link to a suspicious website, they should be trained to recognize it as a potential phishing attempt right away, verify the sender's identity, and report the email to the IT department for further investigation.

This proactive stance, ingrained through a Zero Trust philosophy and continuous education, significantly reduces the likelihood of successful breaches. It’s better safe than sorry, and in the realm of cybersecurity, this means being diligent about taking the extra steps to fortify an organization's digital defenses.

Don't stop at basic protections

Don't stop at basic protections, make ongoing training a priority.
Defenses can’t stop at antivirus technology and endpoint protection, and training isn’t a one-time solution. While these are the necessities, they are simply not enough for the twenty-first century heist as businesses continue to battle millions of cyber-attacks each month.

As threats advance or teams become complacent, ongoing phishing simulations, tests and education are key in maintaining a robust human firewall. Companies must invest in technology and ongoing training to equip employees across all roles and levels with the skills and awareness to stay alert. A company’s greatest weapon can be its workforce, if leveraged.

Cybersecurity needs tech, but it's nothing without people who are well trained to understand the latest attack methods and protect against the digital transition's inherent risks.

We list the best ransomware protection.

This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro

An AI Accelerator is a deep learning or neural processor created specifically for inference and to improve the performance of an AI task. While Graphics Processing Units (GPUs) are the most common type, other specialized accelerators include Tensor Processing Units (TPUs), Data Processing Units (DPUs), Field-Programmable Gate Arrays (FPGAs), and Application-Specific Integrated Circuits (ASICs).

With so many acronyms to remember (and even more accelerator types left unnamed), we will focus on GPUs because their highly parallel architecture makes them incredibly versatile for a wide range of AI workloads.

GPU acceleration

GPUs are an in-demand commodity throughout the IT industry. Manufacturers like NVIDIA and AMD are powering the world's insatiable appetite for artificial intelligence and machine learning applications.

An AI GPU accelerator is responsible for making hundreds of thousands of calculations in parallel, and it's used in every facet of AI, large language models (LLMs), data analytics, and high-performance computing.

Such widespread adoption not only highlights their critical role in advancing modern technology but also explains why GPU demand continues to outpace supply. This leads us to a crucial question: Can your cloud hosting provider truly deliver the AI GPU hosting you need? Let's dive into what that really means with 5 things you need to know.

1: Pick the GPU your workload requires

This might sound like common sense, but it’s important to understand the GPU accelerator hardware available from your hosting provider. GPUs are not created equal; they vary massively in specification and capability.

It's important to know what VRAM does, what tensor cores are, and what an NVLink interconnect does; otherwise, it's very easy to overspec and overpay for GPU resources if you don't understand exactly what's needed.

Understand your workload: Do you want to train your own AI model, use private LLMs, or perhaps need a chatbot application? Different AI tasks require different GPU specifications.

Understand data size and IO: AI models are typically trained on huge datasets, so you need a GPU that can process data at a good rate, and you need underlying storage, ideally NVMe SSDs that can keep up to prevent bottlenecks.

Consider future scalability: Ask yourself: Will your AI project grow? You need a hosting provider that can grow with you because you may need a bigger server (more memory, faster CPU) in the near future.

Get developer feedback when choosing a framework: Does the hosting environment support your preferred framework tools out of the box? Ask your devs what they want to use; popular AI frameworks include TensorFlow, PyTorch, and JAX.

2: Choose a provider with the necessary hardware platform

GPUs are very important for AI workloads, but it's also important to consider the underlying hardware and ensure that it's fit for purpose. Network architecture and interconnects are critical for maximizing the performance of AI accelerators when hosted in the cloud.

Don't forget the importance of CPUs: CPUs are still critical for AI as they control the throughput of data to all aspects of the cloud platform. You need a provider that uses the latest CPU architectures, such as Intel Xeon or AMD EPYC, and examines the number and the speed of the CPU cores.

Go beyond high-speed networking: Fiber-optic connected networking is essential for AI platforms to function with low latency. There are 3 types of networking commonly deployed:

InfiniBand provides very low-latency and high-bandwidth communication between nodes (servers) containing GPUs. This is ideal for large-scale distributed AI clusters.

NVLink is NVIDIA's high-speed interconnect for direct GPU-to-GPU communication within a single server. It's needed for multi-GPU setups and is great for preventing bottlenecks.

High-Bandwidth Ethernet (e.g., 100GbE+) offers affordable performance for distributed AI and high-performance storage.

Latency: The ultimate goal is to choose the best hardware that will achieve the lowest latency. This is crucial because rapid GPU IO prevents bottlenecks and improves efficiency.

3: Embedded cloud AI ecosystem

One major benefit of GPU hosting is the fact that it's easy to integrate with existing services from a provider. Pick managed services that work for you. Popular integrations include hooking into cloud storage layers, picking managed security services, and backups.

If you are a business, server management options are a great way to ensure optimal performance and uptime, letting you focus on developing your AI application whilst the provider manages the underlying infrastructure, load balancing, MFA, Antivirus, Intrusion Prevention, and DDoS Protection behind the scenes.

4: Cost optimization

It's essential to keep on top of your operational expenditure, especially when using GPU accelerators. Costs can spiral if you make inefficient deployment decisions, overspecify your server requirements, or leave resources running idle around the clock. Costs vary significantly, so shop around and pick a provider that offers the hardware you need for a cost that is sustainable.

Cloud GPU hosting is the way forward (unless you can afford about $40,000 for a decent-spec GPU), do not forget about all the cooling and power requirements too. Remember to optimize your instance sizing, monitor and turn off idle resources, and take advantage of multi-instance GPU capabilities, where providers essentially slice up a GPU into smaller and very affordable partitions.

5: Support, reliability, and compliance

These factors underline a provider's ability to deliver GPU hosting that meets the needs of modern business. You may run into blockers or issues that could prevent you from releasing on schedule. Having 24x7x365 support skilled in AI/ML available for when things go wrong is vital to business continuity.

Look for strong uptime guarantees and providers that back up their claims with service credits if the unexpected happens. They should also demonstrate proven redundancy capabilities, disaster recovery, and a proactive approach to monitoring to safeguard your expensive GPU operations.

Beyond that, ensure your chosen provider meets all necessary compliance standards for your industry, whether it's GDPR, HIPAA, or SOC 2. Understand where your data will reside and confirm the provider has strong security controls like encryption and proper access management in place. Finally, always clarify the shared responsibility model so you know exactly what security aspects the provider handles versus what falls to you.

Key takeaways

Choosing the right cloud GPU hosting means looking beyond just raw power. It's about picking a provider that meets your specific requirements, delivers strong, flexible server infrastructure, and offers comprehensive tools for integration.

By optimizing costs and prioritizing critical areas like expert support, reliability, and adherence to compliance standards, you ensure your operations run efficiently and without unexpected hitches.

We've featured the best cloud storage.

This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro

AVG often tops the best antivirus software lists, though more frequently the list of best free antivirus. It does offer a paid plan, but then it enters the realm of heavy hitters such as Norton and Bitdefender.

However, AVG users prefer a more lightweight AV that won't break the bank; therefore, finding a suitable upgrade is not always easy.

That's why I have rounded up some top-tier AV that have powerful features and a range of use cases. Below, I have laid out exactly why these are the best alternatives to AVG AV.

Best AVG alternative overall

Features:

Outside of Norton's excellent antivirus and firewall protection, the 360 Standard plan will provide you with several additional features across 3 devices.

You'll be able to browse the web securely with Norton's AI Genie Scam Protection, a tool that can analyze the content of texts, phone calls, emails, and websites to check for hidden scams or fraud.

Additionally, you'll be able to use a password manager and an unlimited VPN to encrypt your internet traffic, and protect your sensitive files in a secure 2GB cloud backup. Norton 360 Standard also includes breach monitoring to score the dark web for any exposed credentials.

What Norton 360 lacks is a performance optimizer and a driver updater, but Norton's lightweight performance means it shouldn't have too much of an impact on your devices.

Security:

Norton has been one of the top-rated antivirus providers for some time, up there with the likes of Bitdefender, McAfee, and Norton.

In the latest tests by AV-Comparatives, Norton achieved a protection score of 99.5% with 9 false positives, making it one of the highest scoring antivirus solutions tested by AV-Comparatives.

In AV-Test real-world testing, Norton secured a 6/6 across the board for protection, performance, and usability, earning it a 'Top Product' badge.

Price:

Norton is the most affordable alternative to AVG, with a first year price of just $39.99, or $3.33 per month. After the introductory year, the renewal price rises to $99.94, which is also the lowest renewal cost on this list.

Best AVG Alternative for multi-device protection

Features:

McAfee+ Premium is the 'Core Protection' package, but it does include some additional features that make it a better alternative to AVG.

You get McAfee's tried and tested antivirus and firewall, alongside safe browsing protection, scam protection, a password manager, unlimited VPN, and dark web scans for credential breaches and personal information leakage.

For those with a household full of different devices, McAfee+ Premium is the definite choice. You can secure antivirus protection across an unlimited number of devices.

Security:

McAfee is one of the highest scoring antivirus solutions in terms of protection. In AV-Comparatives testing, it achieved a malware block rate of 99.96%. However, it did log 15 normal programs as malware during testing.

In the AV-Test results, McAfee also scored highly, achieving 6/6 across protection, performance, and usability, also earning it the 'Top Product' award.

Price:

McAfee's pricing sits nicely in the mid-point on this list at $49.99 for the first year, or around $4.16 per month. The one thing to be wary of is the renewal pricing, which ups the price to $149.99, making it one of the most expensive antivirus solutions on this list when it comes to renewal by around $50.

Best AVG Alternative for protection score

Features:

As you'll read below, Bitdefender's reputation for protection is not unfounded. It has been one of the best performing antivirus solutions for several years. Outside of Bitdefender's antivirus and firewall, you'll be provided with safe browsing capabilities, scam detection, leaked credential monitoring and a VPN. The VPN does have a daily cap of 200MB/day however.

Security:

As I mentioned, Bitdefender's protection is near perfect. In Av-Comparatives testing, Bitdefender missed hitting top marks by just 0.2%, with a surprisingly low false-positive rate of just 3, making it the best performing antivirus in the latest testing.

As expected, Bitdefender also scored very well in AV-Test results, 6/6 across protection, performance, and usability. Again, Bitdefender also earned AV-Test's 'Top Product' award.

Price:

Protection of this level does come at a cost. Bitdefender Total Security's introductory price sits at $59.99 for the first year, or $4.99 per month. The renewal price is also quite high at $109.99.

Best AVG Alternative for the essentials

Features:

When it comes to features, Avast Premium is a little sparse. You get the essential antivirus and smart firewall, but outside of a performance optimizer and scam protection, there isn't much else to add.

Avast Premium does include browser based password protection, but falls short of offering a dedicated password manager. There are a few other nice-to-haves included in the plan though, such as a tool for permanently and securely deleting files, and a sandbox that can be used to open 'risky files' without them potentially infecting your device.

On the upside, you do get protection across 10 devices, making it another good choice if you're looking for multi-device protection.

Security:

Avast scored very well in the latest AV-Comparatives testing, with a protection score of 99.5%. It did however pick up 15 false-positives, which could be an issue for those who don't want frequent interruptions from their antivirus.

On the AV-Test side of things, Avast also holds up under pressure, again scoring 6/6 across protection, performance, and usability with Avast matching up to the other alternatives on this list and earning the 'Top Product' award.

Price:

Avast is the most expensive alternative to AVG on this list, with the introductory pricing for the first year sitting at $69.48, working out at $5.79.

However, the renewal pricing jump isn't too bad, with renewal costing just $99.99 per year. Avast is therefore the best alternative to AVG for the essentials, offering excellent protection across 10 devices.

Comparison

Check out our guide to the best antivirus software for even more alternatives

If you are among the millions of users affected by the ban on Kaspersky sales by the US, then fear not. Rest assured that there is other equally, if not better, antivirus software to keep you protected online.

Equally important, you should try and find a reputable supplier that offers similar functionality so you do not miss out on any critical features that make your life easy.

Luckily, there are a range of Kaspersky alternatives that offer exactly the same level of protection, and some even through in some extra features to keep you safe online!

Best Kaspersky alternative overall

Features:

The Norton 360 Standard suite contains almost everything you need to replace your Kaspersky antivirus, and even throws in several extra goodies to tempt you.

This package includes Norton's award winning antivirus software that frequently scores highly in both our own testing and in testing done by third party laboratories.

You also get access to a highly configurable firewall, alongside safe browsing protection that includes payment protection, and dark web monitoring, and even includes Genie scam protection; and AI powered tool that can quickly spot nefarious scams.

As an added bonus to your personal privacy, Norton 360 standard also throws in a password manager, VPN with kill switch and IP rotation, and a 2GB cloud backup for important files.

The one tool that Norton 360 Standard is missing is a performance optimizer, but Norton has earned top marks in the latest AV-Test performance scores, so you'll hardly know its there.

Security:

When it comes to protection, Norton is one of the best performing antivirus solutions on the market. The software frequently receives three stars from AV-Comparatives in their real-world testing scenarios without letting malware slip through the net or picking up too many false-positives.

In the latest testing from June 2025, Norton detected 99.5% of the sample threats with 9 false-positives, making it a more than capable solution to replace your existing Kaspersky antivirus.

Price:

Norton 360 Standard is priced at an introductory rate of $39.99, putting the per month cost at $3.33. Norton 360 Standard only provides protection for one device.

However, after the first introductory year, the price jumps to $94.99. While not the most expensive renewal cost on this list the pricing can appear quite steep. However, with Norton 360 Standard you are getting a wide range of features at an excellent price point compared to the other services on this list - making it the best Kaspersky alternative.

Best Kaspersky Alternative for all-in-one protection

Features:

Avast Premium Security offers everything you would expect from antivirus software at this price point. You'll have access to Avast's signature antivirus software complete with firewall, and safe browsing protections including secure payment protection.

Unlike Norton 360 Standard, Avast Premium Security includes an Email Guardian scam filter. Plus, you'll also to dark web monitoring to spot compromised credentials linked to your email account.

What this package is missing is a password manager and cloud backup, but for a price as low as this I think it is still worth the money, and definitely a good budget alternative for Kaspersky.

Security:

Avast is another name that frequent the top of the list when it comes to antivirus protection. In the latest testing from AV-Comparatives, Avast blocked 99.5% of threats, but had a rather high false-positive rate, detecting 15 files as malware.

When it comes other lab testing, Avast scored top marks from AV-Test, achieving a maximum score of 6/6 across protection, performance, and usability, awarding Avast the Top Product badge.

Price:

Avast is the budget option on this list for a reason, with an introductory price of $31.20, or $2.60 per month.

The renewal price also makes it a great budget alternative to Kaspersky, offering the lowest renewal price on this list at just $77.99.

Best Kaspersky Alternative for multi-device

Features:

Bitdefender has maintained our top pick for the best antivirus software for some time - and with good reason. Bitdefender has consistently been one of the highest performing antivirus solutions on the market, consistently raking in top marks in our own testing and in the testing done by AV-Test and AV-Comparatives.

Bitdefender Total Security gives you 1 account to use with protection across up to 5 devices, alongside a firewall, safe browsing protection, online payment and scam protection, and a system optimizer to keep things running smoothly.

Additionally, Bitdefender Total Security includes a VPN with a 200MB/day limit, and dark web monitoring for breached accounts.

Security:

As mentioned before, Bitdefender consistently scores highly in tests. The latest AV-Comparatives test from June 2025 place Bitdefender's protection at 99.8% with just 3 false positives.

Bitdefender also received an 'Outstanding' rating by AV-Test in their latest results, with a 6/6 for performance, protection, and usability, also earning Bitdefender the Top Product award.

Price:

Protection levels such as these do come at a premium, with Bitdefender Total Security costing $59.99 at its introductory rate, or $4.99 per month. The renewal cost rises to $109.99.

Keep in mind however that Bitdefender Total Security gives you protection across 5 devices compared to the other plans on this list, which may offset the increased price if you have more devices to protect.

Best Kaspersky alternative for simplicity

Features:

Compared to the other solutions on this list, AVG Internet Security offers fewer features at a similar price point.

You get access to all the essentials, including protection for one device, firewall, safe browsing and payment protection, a performance optimizer, and scam protection.

The list of features is slightly less than the other solutions, with the lack of a password manager, breach monitoring, and VPN being significant reductions in protection compared to the other plans.

However, if you are looking for a simple plan without too many frills, bells, or whistles, AVG Internet Security is the choice for you.

Security:

In the latest AV-Comparatives testing, AVG scored a protection rate of 99.3% with a false positive rate of 13. It is still a very capable software, and these tests are by no means a comprehensive display of antivirus performance, but there is the potential for this antivirus to pick up normal software as malware during scans.

AVG almost scored top marks in recent AV-Test testing, with a 6 in protection, 5.5 in performance, and 6 in usability. The tests showed slightly slower launching of software while the antivirus is running, but it is fairly minimal and shouldn't impact day-to-day activities too much.

Price:

AVG Internet Security sits in the middle of the road when it comes to pricing, matching Norton 360 Standard's $39.99, or $3.33 per month. Renewal is slightly higher though, at $99.99.

For the features on offer, AVG Internet Security seems slightly overpriced compared to some of the protection and features offered by the other plans. However, if you are looking for simplicity with good protection, AVG is the one for you.

Comparison

Check out our guide to the best antivirus software for even more alternatives

Q&A

While it may be true that McAfee has been around for quite some time, and that it holds a sizable market share among the best antivirus software, it doesn’t necessarily mean that it is the best at what it does.

Numerous new devices come preinstalled with McAfee, but users occasionally complain about its missing features, higher costs and, at times, slowdowns they experience on their machines while using it.

Nevertheless, McAfee has a lot to offer in terms of its protection prowess, so finding a suitable alternative may prove to be a challenge. For this exact reason, we would like to share the best alternatives we’ve found for McAfee. Let’s take a look!

Best McAfee alternative

Features:

At this pricing tier, Norton 360 Deluxe offers the greatest range of features compared to any other McAfee alternative on this list.

Outside of the obvious inclusions in an antivirus product (antivirus, malware removal, firewall), this plan provides you with the additional online browsing nice-to-haves such as safe browsing protection, payment and scam protection, a password manager and an unlimited VPN.

As for the features that improve day-to-day life, Norton 360 Deluxe adds a 50GB cloud backup, dark web monitoring for compromised accounts, and parental controls to keep the household safe.

The one feature that Norton 360 Deluxe is missing is a PC performance optimizer, but considering the price point and array of features, this is a fairly minor sticking point.

Security:

Norton is one of the top performing antivirus solutions around. Norton has received the full three stars from AV-Comparatives in their real-world testing scenarios, blocking 99.5% of the malware samples with only 9 false-positives.

AV-Test scores are also impressive, with 6/6 across the board for protection, performance, and usability, earning it the 'Top Product' badge.

Price:

When it comes to price, Norton 360 Deluxe gets additional points for being the cheapest on this list. It also matches the price of McAfee Premium while offering significantly more bang for your buck.

The first year is currently $49.99, working out at around $4.16 per month. The renewal price on the other hand is the most expensive on the list, sitting at $199.99, so the cost over two years is somewhere in the middle.

Overall, for the number of features and the excellent level of protection, this is definitely a worthwhile investment to keep your files and devices safe.

Best McAfee Alternative for multi-device protection

Features:

When it comes to features, AVG Ultimate offers a good range, but maybe not quite everything you're looking for.

It includes all the essentials such as antivirus, malware removal, firewall, safe browsing and payment protection, scam protection, a VPN and breach monitoring, but doesn't include a cloud backup, password manager, or parental controls like Norton 360 Deluxe does.

But considering you can protect 10 devices with everything you need to keep your data safe and your device free from malware, its quite a good feature set overall.

Security:

In AV-Comparatives testing, AVG scored slightly lower than Norton with a protection rate of 99.3%, and a false positive rate of 13, making it a highly capable bit of kit that might recognize a few more of your programs as malware.

Recent AV-Test testing saw AVG score very well, with a 6 in protection, 5.5 in performance, and 6 in usability. AVG might make it take slightly longer for your other programs to launch while your system is being scanned, but the impact is negligible.

Price:

The initial cost for AVG Ultimate is slightly more expensive than Norton 360 Deluxe, with a first year price of $59.88, rounding out at about $4.99 per month. However, the renewal cost is $139.99, making it a potential option for those looking for long term protection across a large range of devices.

Best McAfee Alternative for protection score

Features:

Bitdefender Total Security gives you protection across up to 5 devices, alongside a firewall, safe browsing protection, online payment and scam protection, and a system optimizer.

Additionally, Bitdefender Total Security includes a VPN with a 200MB/day limit, and dark web monitoring for breached accounts.

However, just like AVG Ultimate, you don't get access to a password manager, cloud backup, or parental controls.

Security:

Bitdefender has consistently been one of the highest performing antivirus solutions on the market, frequently raking in top marks in our own testing and in the testing done by the third-party labs.

Bitdefender received an 'Outstanding' rating by AV-Test in their latest results, with a 6/6 for performance, protection, and usability, also earning Bitdefender the Top Product award.

The latest AV-Comparatives test from June 2025 place Bitdefender's protection at 99.8% with just 3 false positives, making it the most capable antivirus in terms of real-world protection.

Price:

Bitdefender Total Security puts a premium on such high performance, with an initial cost of $59.99, or $4.99 per month. The renewal cost is one of the lowest however, at just $109.99, making it a fairly good choice for a long term budget.

Best McAfee alternative for PC performance

Features:

Avast Ultimate's feature set is fairly sparse compared to the other options on this list. Outside of the essentials (antivirus, malware removal, firewall, safe browsing and payment protection, and scam protection), Avast only includes a VPN. However, if you are looking to have your device perform at the optimal level, this could be the choice for you.

Avast's Cleanup Premium is included in this plan, giving you tracking protection, junk cleanup that can be automated, and a disk-cleaner to keep your storage optimized and free from clutter.

Security:

Avast also offers great antivirus protection. In the latest testing from AV-Comparatives, Avast blocked an impressive 99.5% of threats, but had a rather high false-positive rate, detecting 15 normal files as malware.

When it comes other lab testing, Avast scored top marks from AV-Test, achieving a maximum score of 6/6 across protection, performance, and usability, awarding Avast the Top Product badge.

Price:

Avast Ultimate has the highest initial cost on this list at $69.99, or $5.83 per month for the first year. This compounded by the fact that you only get protection on a single device, also making it the most expensive option on a per-device-protection level.

After the first year, things don't get much better. The renewal cost is $139.99, but for the suite of device cleanup and optimization tools, it could be worth it for some.

Comparison

Check out our guide to the best antivirus software for even more alternatives

For two decades now, Bitdefender has been offering great features in the antivirus software and anti-malware space, protecting over 500 million devices across the globe.

Its Ultimate Security Plus package covers almost everything you may need from an antivirus suite; however, that doesn’t mean that there are no alternatives to it. If you want to move away from Bitdefender or simply see what else is out there as a good alternative, then you’re in the right place.

Below, we present our best alternatives to Bitdefender antivirus as well as features that would make us switch.

Check out our guide to the best antivirus software for even more alternatives

Best Bitdefender alternative overall

Features:

The Norton 360 with LifeLock is probably the most comprehensive security suite you can get. It includes Norton's award winning antivirus software, alongside numerous privacy and security features, and LifeLock identity theft protection with credit monitoring.

On the security side, you'll pick up a configurable firewall, safe browsing and payment protection, dark web monitoring, and Genie scam protection.

On the privacy side, Norton also throws in a password manager, VPN with kill switch and IP rotation, and a 250GB cloud backup for important files and documents. All of the security and privacy features are available across 10 devices.

The identity theft protection is some of the best in the industry, with Norton offering LifeLock protection that includes up to $1,000,000 for lawyer fees, up to $1,000,000 stolen funds reimbursement, and up to $1,000,000 personal expense reimbursement.

LifeLock also includes three bureau credit monitoring alongside 401(k) and Investment Account monitoring.

The one thing Norton doesn't have is a built in performance optimizer. Luckily, Norton frequently scores very well in third party testing and our own testing for having a very minimal impact on system performance while running.

Security:

Norton is one of the best performing antivirus solutions on the market, and has been for some time. In the latest tests, Norton antivirus was awarded three stars from AV-Comparatives in their real-world scenarios. Norton detected 99.5% of the sample threats with 9 false-positives, making it more than capable of replacing your Bitdefender protection.

Price:

Norton 360 with LifeLock has an introductory rate of $99.99 for the first year, putting the per month cost at $8.33. For comparison, Bitdefender Ultimate Security Plus costs $119.99 for the first year.

The renewal price does jump to $189.99. While not the most expensive renewal cost on this list the pricing can appear quite steep. But for the cost, you are getting a comprehensive security suite for 10 devices with some of the strongest identity theft protection around.

Best Bitdefender Alternative for budget

Features:

Avast Ultimate is another antivirus suite that offers an excellent range of features to replace your existing Bitdefender antivirus. You'll have access to Avast's signature antivirus software complete with firewall, and safe browsing protections including secure payment and scam protection across up to 10 devices.

Alongside access to an unlimited VPN with over 50 server locations, Avast Ultimate also includes several performance management tools, including an automatic software updater, app optimizer, disk cleanup, and a driver updating tool.

Avast Ultimate doesn't include identity theft protection, nor does it have a password manager or cloud backup, but as a replacement for Bitdefender, Avast is a solid choice in both protection and pricing.

Security:

Similar to Norton and Bitdefender, Avast has been a brand that offers award winning antivirus protection. Avast scored top marks from AV-Test, achieving a score of 6/6 across protection, performance, and usability. Avast blocked 99.5% of threats in the latest testing from AV-Comparatives, but detected 15 safe files as malware.

Price:

Currently, Avast sits at a very fair price point, especially with the current discount that cuts the introductory cost to $69.48 for the first year, which to translates to $5.79 per month.

The renewal price is also very fair, and offers an excellent long term solution as an alternative to Bitdefender, with the price after the first year sitting at $139.99.

Best Bitdefender Alternative for data protection

Features:

ESET is a lesser-know antivirus software that offers good levels of protection, with a set of particularly good features that revolve around data security.

In the Home Security Ultimate package, you'll get antivirus, a firewall, malware removal, safe payment, scam, and browsing protection, alongside a password manager and dark web monitoring. ESET also include a VPN with unlimited bandwidth. The plan covers 5 devices.

On the identity side of things, ESET Home Security Ultimate offers up to $1,000,000 in reimbursement if your identity is stolen, with 1 bureau credit monitoring.

Now, the data protection features include file and folder security settings, so only programs you approve can modify or access your files, an encryption tool to keep documents and external drives secured even if they are lost, and the ability to remove metadata from images before uploading.

Security:

Despite being a smaller name than the big providers, ESET is also tested by the third party labs. In a recent AV-Comparatives test, ESET protected against 99.1% of malware samples, giving it the lowest score on this list, but still providing excellent protection. During the test it only picked up 3 false-positive detections. In AV-Test testing, ESET scored 6/6 across the board.

Price:

ESET Home Security Ultimate is the most expensive software on this list, with a first year price of $125.99, or $10.49 per month. The renewal price matches the others on this list at $179.99.

The price may be a bit steep for some, but for those looking for a solid antivirus suite with a focus on data protection, ESET is the pick for you.

Comparison