Antivirus, Backup, and P2P: August 2013


OPSWAT releases periodic market share reports for several sectors of the security industry.  This report includes worldwide market share for antivirus, public file sharing (peer-to-peer), backup, and antiphishing applications. The data used in this report was collected on August 13, 2013.  Please note that OPSWAT is not a research institution, and makes no claims on accuracy of this data in the real world marketplace; this report aims to distribute the unique data collected to inspire public discussion, not to make any claims as to why changes have occurred. To see a description of the data collection and its limitations, see the data collection section of this report.


OPSWAT is a San Francisco software company that provides technologies to secure and manage IT infrastructure. Founded in 2002, OPSWAT delivers intuitive applications and comprehensive software development kits for SMB, enterprise and OEM customers, which are deployed to more than 100 million endpoints worldwide. OPSWAT’s cloud-based solution, GEARS Cloud, provides network administrators with visibility and manageability of applications installed on devices and the current status of those security applications. OPSWAT also develops products to help give organizations greater control over dataflow into and out of their network and to help protect against zero day attacks using multiple antivirus engine scanning and detailed file filtering. To learn more about OPSWAT’s innovative and unique solutions, please visit

Worldwide Antivirus Vendor Market Share

With more than 25% of the worldwide market, Microsoft ranks with the highest share of any antivirus vendor in this report, followed closely behind by Avast at 23.6%. The remaining competitors, each with a market share in the single digits, are led by AVG and Symantec at 9.1% and 8.4%. According to the data, the top ten antivirus vendors control more than 93% of the market. Only antivirus products with real time protection (RTP) enabled are included in this comparison. A product with RTP enabled is currently running on a user’s machine, while a product without RTP enabled is expired or disabled.

worldwide antivirus vendors market share - August 2013

Antivirus Vendor (click to expand)

Market share



Microsoft Security Essentials 69.4%
Windows Defender 29.7%
System Center Endpoint Protection <1%



avast! Free Antivirus 83.8%
avast! Internet Security 12.0%
avast! Premier 2.1%
avast! Pro Antivirus 1.7%
avast! Endpoint Protection Plus <1%
avast! Endpoint Protection Suite Plus <1%



AVG Anti-Virus Free Edition 64.0%
AVG Internet Security 32.6%
AVG AntiVirus 2.3%
AVG CloudCare Antivirus <1%



Norton Internet Security 48.9%
Norton 360 21.6%
Symantec Endpoint Protection 15.2%
Norton AntiVirus 14.2%



ESET Smart Security 59.8%
ESET NOD32 Antivirus 37.5%
ESET Endpoint Security 2.2%
ESET Endpoint Antivirus <1%



Avira Free Antivirus 82.4%
Avira Internet Security 9.3%
Avira Antivirus Premium 7.6%
Avira Professional Security <1%

GKaspersky Lab


Kaspersky Internet Security 56.1%
Kaspersky PURE 19.1%
Kaspersky Anti-Virus 15.3%
Kaspersky Anti-Virus for Windows Workstations 4.5%
Kaspersky Endpoint Security 3.2%
Kaspersky Small Office Security 1.9%



McAfee VirusScan 76.8%
McAfee VirusScan Enterprise 20.7%
Total Protection for Small Business 2.4%



Bitdefender Total Security 52.8%
Bitdefender Internet Security 37.7%
Bitdefender Antivirus Plus 5.7%
Endpoint Client by Bitdefender 1.9%
BitDefender Business Client 1.9%



antivirus vendors worldwide,  real time protection enabled users, August 2013

While the comparison above only includes data from products with real time protection (RTP) enabled, OPSWAT also looked at data for all installed products, including those that are expired or disabled. When RTP status is not a factor, Microsoft’s market share increases dramatically, accounting for about a third of all antivirus installations, while Avast trails at 19.1%. The remaining products all show a reduced share due to Microsoft’s increase in the number of data points. This change in ranking indicates that more Microsoft antivirus products are likely to be disabled, in comparison to the products of other top antivirus vendors. In the section below that covers antivirus products, this discrepancy is attributed  to Windows Defender’s low rate of RTP activation.

Worldwide Antivirus Product Market Share

In the worldwide market of antivirus products with real time protection (RTP) enabled, avast! Free Antivirus ranks as the leader, with a share of 19.7%. Microsoft Security Essentials follows closely behind at 18%. These two leaders are far ahead of the remaining products on the list, which are led by Windows Defender and AVG Antivirus Free Edition at 7.6% and 5.8%. The top ten products make up 74% of the worldwide antivirus products that were detected. A product with RTP enabled is currently running on a user’s machine, as opposed to products that are expired or disabled. Only these active antivirus products are included in this section of the report.

worldwide antivirus products market graph, August 2013
  Antivirus Product Market Share
A avast! Free Antivirus 19.5%
B Microsoft Security Essentials 18.3%
C Windows Defender 7.7%
D AVG Anti-Virus Free Edition 6.1%
E Avira Free Antivirus 5.5%
F Norton Internet Security 4.1%
G ESET Smart Security 4.1%
H Kaspersky Internet Security 3.2%
I AVG Internet SEcurity 3.1%
J avast! Internet Security 2.8%
K ESET NOD32 Antivirus 2.5%
L McAfee VirusScan 2.4%
  Other 20.9%
antivirus products worldwide, real time protection enabled users, August 2013

The ranking of all installed antivirus products, regardless of whether real time protection (RTP) is enabled, tells a different story. In this expanded set of data, which includes expired and disabled products, Windows Defender tops the list with more than 19% of the market, with little change among the remaining products compared to the previous data set. This dramatic jump from a distant third to a comfortable lead indicates that Windows Defender has a very low rate of activation compared to other top antivirus products. Windows Defender is pre-installed on all computers that contain Windows 8. A high proportion of Windows 8 users in this data set have opted to disable Windows Defender and, in most cases, have installed other antivirus products that are actively scanning their machines. Furthermore, this data set contains a higher percentage (22.3%) of Windows 8 users than is found by other sources. For example, NetMarketShare found Windows 8 users to make up about 5.8% of the Windows market.

After further filtering, the antivirus product data shows that about 65% of Windows 8 users have an additional antivirus product (with real time protection enabled) on their machines. Security Essentials, Microsoft’s second product at the top of the list, shows much different characteristics. Most users who have Security Essentials installed do not have an additional antivirus product installed that has RTP enabled. This comparison is illustrated in the pie charts below.

Windows Defender users, August 2013 Microsoft Security Essentials users, August 2013
Antivirus products, North America, real time protection enabled users, August 2013

RTP status can be seen as a metric for product usability and/or effectiveness; if a user views an antivirus product as effective and easy to operate, the user is more likely to have that product actively running on his or her machine. In the set of data used in this report, nearly all products have RTP enabled at a rate of at least 80%. The exception is Windows Defender, which has a much lower rate of around 30%. As explained in the earlier in this section, this product is natively installed with Windows 8, and the majority of these users are actively using a different antivirus product. On the other end of the spectrum, Microsoft’s other antivirus product, Security Essentials, has the highest rate of RTP being enabled, at 98%, followed closely by Avira Free Antivirus at 97.4%. McAfee VirusScan (95.6%) and Norton Internet Security (94.9%) also rank high on the list.

Peer-to-peer, Backup, and Antiphishing Products

Peer-to-peer Products

In a comparison of public file sharing, or peer-to-peer (P2P), products, µTorrent dominates, with more than 50% of the market. BitTorrent, which is owned by the same company, follows at 7.4%. Ares, Free Download Manager, and Vuze lead the remaining products, each with between four to six percent of the market. Though the overall data includes many other detected products, the top ten P2P products make up of 91.5% of the market.  Products are included in this section regardless of whether or not they are running.

peer-to-peer products market share, August 2013
  P2P Product Market Share
A uTorrent 54.5%
B BitTorrent 7.4%
C Ares 6.0%
D Free Download Manager 5.2%
E Vuze 4.2%
F Pando 4.0%
G MediaGet 2.8%
H qBittorrent 2.4%
I eMule 2.4%
J BitComet 2.3%
  Other 8.5%

Backup Product Worldwide Market Share

The market for backup products is much more evenly distributed when compared to the public file sharing application market. Google Drive leads the the ranking with 22.3%, followed by Dropbox, SkyDrive, and iCloud, each in the double digits. The top ten products make up 83.3% of the market, which means that several competitors that did not make the list make up a significant portion of the backup product market. Both Windows Backup & Restore and Windows File History have been removed from the data set since they are built into computers running on certain Windows operating systems.

backup products market share, august 2013
  Backup Product Market Share
A Google Drive 22.3%
B Dropbox 19.5%
C Microsoft SkyDrive 15.4%
D Apple iCloud 10.0%
E Acronis True Image 4.6%
F Macrium Reflect 3.0%
G Norton Online Backup 2.8%
H Norton 360 2.2%
I Paragon Backup & Restore 2.1%
  Other 18.2%

Antiphishing Usage

For the first time, this report includes data related to antiphishing products. Out of all users in the data set, 92.1% have antiphishing enabled in at least one of their browsers.

antiphishing usage and activation, august 2013

Data Collection

This report shows comparisons for antivirus, peer-to-peer, backup, and antiphishing applications on Windows systems from data collected from users of OPSWAT’s Security Score tool, a free product that utilizes the detection capabilities of OPSWAT GEARS  to collect information regarding the applications installed on endpoint computers. Security Score is available at and also at various download sites across the web. This tool is used around the world by home and business users, both expert and inexperienced in security software. For the purpose of the report, the sample of more than 3000 users is assumed to be representative of the market, based on the wide accessibility of the tool to a large range of users.  However, these results are likely to differ from those in the real world (see below for more details).

This is the first market share report that exclusively uses Security Score data, as opposed to past reports that used data from AppRemover. For the purposes of the report, data collection from Security Score is expected to be an improvement over data compared to AppRemover for the following reasons:

  • Since it is a security monitoring tool, Security Score runs continuously in a user’s system. This allows for continuous reports over time from each user, as long as the application is installed. For this report, the data was collected to show what was on each user’s computer from the most recent data transfer that Security Score received from the user. AppRemover, on the other hand, is used only one time or a handful of times by each user, at a different point in time for each user, and is not continuously running on the machine.
  • Security Score provides a more realistic representation of the installed products that are actually being implemented by the user. Since AppRemover is an uninstallation application, some products that were detected in previous reports may have been in the process of being uninstalled by the user.

However, several attributes inherent in way the data is collected may cause the results in this report to differ from what exists in the real world.  OPSWAT makes no claims as to the accuracy of the data in the real world market and is continuously working on ways to overcome the following obstacles:

  • Although these tools are also used in a business setting, the majority of Security Score users are on home computers. Future reports might possibly differentiate between home and business users.
  • The data was collected only a short time after the release of new data collection technology in Security Score, making for a small sample. The sample size will continue to increase in each report since the data is collected from every current user of Security Score.
  • These applications are marketed in OPSWAT’s own channels. Users sampled may not be representative of the general population. For example, this report may contain a different distribution of Windows operating systems  and device types compared to what exists in the real world. While this report contains more than 20% Windows 8 users, NetMarketShare reports that around 5.8% of all Windows users currently operate under Windows 8:
windows operating system market share, august 2013 device types in market share report, august 2013
  • The free version of Security Score is only available for Windows users. Mac applications are not included in this report, and products that are available on both Mac and Windows would presumably have different market shares in the real world. Market share for Mac users is expected to be added in future reports.
  • While Security Score is a popular tool worldwide, its use is not commensurate with worldwide population distribution. Only English-language versions of this tools is available, so countries that have higher numbers of English speakers are expected to use these applications at higher rates, as well as countries that have been exposed to more coverage of these tools by press and partners. For example, the Chinese antivirus vendor Qihoo 360 recently reported that it had 440 million users of its internet security products, but it did not make the list of top vendors in this set of data.

Stay tuned for the next market share report in October, which will feature new comparisons and in-depth comparisons of product usage. OPSWAT is working to increase global usage of Security Score and other free applications. Mac application data will also be added in the future.

Vendors of antivirus, P2P, backup, and other applications interested in inclusion in these reports and GEARS Cloud are encouraged to contact to learn how to partner with OPSWAT.

OPSWAT Products and Services

OPSWAT Certification
The OPSWAT Certification Program is a free interoperability program designed to enable technology partnerships between independent software vendors and leading network and technology solution vendors, by verifying that their security applications will work seamlessly with solutions employing the OESIS Framework. Additional information is available at

opswat certification badges

GEARS Cloud is the only cloud-based network security and manageability solution for IT professionals that provides visibility and management for many application types from antivirus to hard disk encryption and public file sharing, as well as the ability to remove non-compliant applications. Monitor up to 25 devices for free! Visit to learn more and sign up.

Security Score
OPSWAT Security Score is a free tool that scans your computer for the status of your installed security applications and provides a score along with recommendations on how to improve both the score and the security of your device. Download and install it now to find out your security score at

OESIS Framework is a cross platform, open development framework that enables software engineers and technology vendors to develop products that detect, classify and manage thousands of third-party software applications. OESIS is perfect for SSL VPN, network access control (NAC) and other manageability solutions, and is already deployed on an estimated 100 million endpoints worldwide. To learn more, visit

OPSWAT offers several multi-scanning solutions to enable fast, powerful content scanning. Because no single antivirus engine is perfect, using multiple engines significantly improves the likelihood of detecting malware.

Metascan technology powers each of OPSWAT’s multi-scanning solutions, enabling IT professionals and software engineers to enhance network security by scanning with up to 30 built-in antivirus engines from market leaders such as ESET, Norman, AVG and many others. Metascan allows for custom implementations, such as integration with other engines of your choice, and can be used for rapid malware analysis and to implement sophisticated data loss prevention systems.

For specific multi-scanning needs, OPSWAT also offers Metascan Client, which quickly scans endpoints’ running processes and memory for key loggers, viruses and other malware, and Metadefender, which scans removable media such as USB drives, CDs, DVDs, and memory cards.

A free demo of Metascan technology is available at

The free AppRemover utility enables the thorough uninstallation of security applications like antivirus and antispyware from your computer. AppRemover is available for commercial licensing if you wish to deploy multiple copies of AppRemover within an organization or entity, or if you wish to bundle AppRemover with hardware, software or other services. More information is available at

Disclaimer of Warranty

OPSWAT Inc. makes no representation or warranties, either express or implied by or with respect to anything in this document, and shall not be liable for any implied warranties of merchantability or fitness for a particular purpose or for any indirect special or consequential damages.

Copyright Notice

OPSWAT, OESIS, Metascan, Metadefender, AppRemover and the OPSWAT logo are trademarks and registered trademarks of OPSWAT, INC. All other trademarks, trade names and images mentioned and/or used herein belong to their respective owners. No part of this publication may be reproduced, stored in a retrieval system or transmitted, in any form or by any means, photocopying, recording or otherwise, without prior written consent of OPSWAT Inc. No patent liability is assumed with respect to the use of the information contained herein. While every precaution has been taken in the preparation of this publication, OPSWAT Inc. assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice.