Antivirus Market Analysis: December 2012

Introduction

OPSWAT releases quarterly market share reports for several sectors of the security industry. This report includes both worldwide and North American market share for antivirus software and Windows operating systems. The data used was collected between November 16, 2011 and November 15, 2012, and features comparisons across the two 6-month periods spanning these dates. Please note that OPSWAT is not a research institution; this report aims to distribute the unique data collected to inspire public discussion, not to make any claims as to why changes have occurred.

About OPSWAT

Founded in 2002, OPSWAT provides software engineers and IT professionals with development tools and data services to power software management and security solutions. The company’s flagship product, OESIS Framework, is a software management solution licensed by major technology companies like Cisco Systems, Juniper Networks, Citrix, Microsoft, HP, and many others. As the industry standard for enabling endpoint application management and compliance regulation, OESIS has already been deployed on an estimated hundred million endpoint systems worldwide. To learn more about OESIS, please visit the product page at www.opswat.com/products/oesis-framework.

The Research

This report shows usage data for security applications on Windows systems. The data was collected using OPSWAT’s AppRemover tool, which utilizes the detection capabilities of the OESIS Framework to collect information regarding the applications installed on endpoint computers. This tool is free for download on www.appremover.com and various download sites around the web, and is used around the world by home and business users, both expert and inexperienced in security software. The sample is assumed to be representative of the market for this report, based on the wide accessibility of the tool to a large range of users.

When the AppRemover user runs the tool, a report of the applications installed on the computer is created. These reports are compiled to generate the market share calculations in this report. More than 150,000 data points were compiled for this report.

OPSWAT acknowledges that not every antivirus application is included in this report, and specific data may not be available for each included product. Vendors of antivirus and other security applications interested in inclusion in these reports and the OESIS Framework are encouraged to contact certification@opswat.com to learn how to partner with OPSWAT.

Worldwide Antivirus Vendor Market Share

AVAST continues to lead the worldwide antivirus vendor market, but Microsoft is quickly closing the gap. While AVAST’s share (17.5%) has changed little over the last six months, Microsoft has increased by 3.6% to a 16.8% market share. No other vendor increased by more than 1% during this period, although three vendors—ESET, AVG, and Kaspersky Lab—posted decreases of around 1% of their respective market shares. In spite of decreasing shares from many products, the top ten vendors, with the help of Microsoft, continue to increase their combined hold on the market. The share of the top ten vendors increased by 0.7% to account for almost 90% of the market.

worldwide antivirus vendors market share - December 2012
AV Vendor Market Share Gain / Loss
AVAST 17.5% 0.1%
Microsoft 16.8% 3.6%
ESET 10.8% -0.3%
Symantec 10.5% 0.2%
Avira 10.4% 0.8%
AVG 8.8% -1.3%
Kaspersky Lab 5.9% -0.8%
McAfee 4.4% -0.5%
Trend Micro 2.6% -0.2%
Panda 2.0% -0.9%
Other 10.3% -0.7%
antivirus vendors worldwide,  real time protection enabled users, December 2012

While the above data shows the market share of all installed AV products (including expired and disabled products), OPSWAT also looked at the market share of only antivirus applications that had real time protection (RTP) enabled. Using RTP as an indicator that a product is in use, the graph to the left shows the market share of active AV products. Microsoft leads the market with a nearly 20% share, followed by AVAST at 18.3% and Avira at 12.2%. These top three products all carry a higher market share when only RTP-enabled users are considered, showing that they are the most actively used products. The increase for Microsoft is higher than that for AVAST, resulting in Microsoft leading the market in this section. Looking only at active users also increases Avira’s standing from fifth to third. Most of the other top vendors lose market share when only RTP-enabled users are considered.

North America Antivirus Vendor Market Share

In the North American market, Microsoft showed a very large increase of 10% over the last six months for a 32% share and very strong lead. Symantec, at 15.7%, continues to hold onto the second spot with a comfortable margin and a small gain. AVAST, in the third spot at 11.3%, showed a slightly larger increase, while most of the remaining top vendors showed small decreases. The exception was Lavasoft, at twelfth place, showing a 0.9% gain. Overall, the top vendors have increased their share of the North American market, largely due to the growth by Microsoft. Over the last six months, the top twelve vendors increased their share by 1.3%, for a total of about 89% of the market.

North America antivirus vendors market share, December 2012
AV Vendor Market Share Gain / Loss
Microsoft 32.0% 10.0%
Symantec 15.7% 0.6%
AVAST 11.3% 0.8%
AVG 9.5% -1.7%
ESET 5.7% -1.3%
McAfee 5.3% -0.9%
Trend Micro 3.0% -0.5%
Kaspersky Lab 2.7% -0.5%
Avira 2.6% -0.3%
Lavasoft 1.6% 0.9%
Other 10.8% -1.3%
antivirus vendors north america, real time protection enabled users, December 2012

As with the worldwide market, the above results show the market share of all installed antivirus products. When looking at only activated products in North America (that is, products with real time protection enabled), the vendor market share shifts, as shown in the graph to the left. While the ranking of the top five North American vendors does not change, Microsoft’s dominance in the market does further increase. When only active products are considered, Microsoft holds more than 37% of the North American AV market. The remaining top five vendors each hold a lower share in these results than they did in the original comparison, although the combined share of the top ten vendors increases.

Worldwide Antivirus Product Market Share

For the first time in an OPSWAT market share report, Microsoft Security Essentials is the top product worldwide. With a 2.3% increase for a total of 15.3%, the product has overtaken avast! Free Antivirus as the world’s most widely-used product. With an insignificant gain and a share of 13.6%, avast! Free Antivirus is comfortable in the second position, followed by Avira Free Antivirus at a 9% share after an increase of 1.5%. This increase, only surpassed by that of ESET Smart Security, makes these two products the second and third fastest growing (after Security Essentials). The biggest loss in market share came from ESET NOD32 Antivirus, at -1.5%, although its 6.8% share was still enough to maintain the fourth position. Although the worldwide market over the last six months was slightly more volatile than the market in North America, showing larger gains or losses amongst the top products, the combined share of the top products showed less change.

worldwide antivirus products market graphantivirus products worldwide, change in market share, December 2012
  AV Product Market Share Gain / Loss
A Microsoft Security Essentials 15.3% 2.3%
B avast! Free Antivirus 13.6% 0.1%
C Avira Free Antivirus 9.0% 1.5%
D ESET NOD32 Antivirus 6.8% -1.5%
E AVG Anti-Virus Free Edition 6.2% -0.6%
F ESET Smart Security 4.3% 1.6%
G Norton Internet Security 3.5% 0.7%
H McAfee VirusScan 3.5% -0.6%
I Norton AntiVirus 3.2% -1.1%
J Norton Internet Security 3.2% -0.4%
K AVG Anti-Virus 2.0% -1.3%
L avast! Internet Security 1.9% 0.0%
  Other 27.6% -0.5%
antivirus products worldwide, real time protection enabled users, December 2012

The above data shows the market share of all installed AV products (including expired and disabled products). OPSWAT also looked at the market share of only antivirus applications that had real time protection (RTP) enabled. Using RTP as an indicator that a product is in use, the graph to the left shows the market share of active AV products. In this refined sample, the ranking of the top five vendors does not change. However, Microsoft’s dominance in the market further increases, with almost 20%, while the next two products--avast! Free AntiVirus and Avira Free AntiVirus--show smaller increases. Overall the RTP sample increases the combined share of the top vendors by 5%, for a total market share of about 72%.

North America Antivirus Product Market Share

Microsoft Security Essentials continued to make very large gains in North America, increasing 9.1% over the past six months to hold more than 30% of the market. Trailing far behind, but stable in the second position is avast! Free Antivirus, with 8.7% and a small increase of 0.4%, followed by AVG Anti-Virus Free Edition, Norton Internet Security, and Norton AntiVirus. Behind Security Essentials, Norton Internet Security showed the biggest gain, while Norton AntiVirus showed the biggest loss in the ranking. Besides the large gain from Security Essentials, the North American market over the last six months was slightly less volatile than the market worldwide. The combined share of the top antivirus products increased by 1.4% in this market, for a total of 25.2% share.

antivirus products, North America market share, December 2012Antivirus products, North America, change in market share, December 2012
  AV Product Market Share Gain / Loss
A MS Security Essentials 30.4% 9.1%
B avast! Free Antivirus 8.7% 0.4%
C AVG Anti-Virus Free Edition 7.0% -0.7%
D Norton Internet Security 4.7% 1.2%
E Norton AntiVirus 4.5% -1.5%
F McAfee VirusScan 4.2% -1.0%
G ESET NOD32 Antivirus 3.9% -1.1%
H Norton 360 2.7% -0.1%
I Symantec Endpoint Protection 2.5% 0.2%
J Avira Free Antivirus 2.1% 0.2%
K AVG Anti-Virus 2.1% -1.0%
L ESET Smart Security 1.9% 0.4%
  Other 25.2% -1.4%
Antivirus products, North America, real time protection enabled users, December 2012

As with the worldwide market, the above results show the market share of all installed antivirus products. When looking at only activated products in North America (that is, products with real time protection enabled), the vendor market share shifts, as shown in the graph to the left. The market share of Microsoft Security Essentials in this sample is more than 37%, followed by avast! Free Antivirus at 10.8%. These results also adjust the position of McAfee VirusScan to fourth place, as opposed to its sixth position before real time protection (RTP) was taken into account. The results of Norton Internet Security, which showed the largest gains in the original sample, are tempered in the RTP-only results, at the seventh position with 3.5%.

Antivirus Product Usage: Real Time Protection and Virus Definition Updates

This section of the report compares user-controlled antivirus features across the most widely-used antivirus products worldwide. The features examined include real time protection (RTP), which indicates whether a product is currently active, and the time since the last virus definition update, which indicates whether a product is up-to-date and effective. It is expected that products with higher incidences of RTP being enabled and recently updated virus definitions are likely those that highlight or automate these features, which encourages users to take advantage of these options more frequently.

Users with multiple antivirus products installed, real time protection comparison, December 2012

Among all users with an antivirus product installed, 72.1% were found to have only one AV product installed, while 27.9% of users have more than one AV product installed on their machines. When users have only one antivirus installed on their machines, 84% have real time protection enabled on that product. One would expect that if a computer has multiple AV products installed, it would be less likely that both products are activated. As expected, the rate of RTP activation is lower when users had two or more products installed on their machines. In this situation, each product had 77.5% chance of having RTP enabled.

percent of users with real time protection enabled on antivirus products, December 2012

The graph to the left shows the percentage of users by product that have real time protection enabled. Microsoft Security Essentials, with a 94.2% rate of activation, is the product most likely to have real time protection enabled. McAfee VirusScan, avast! Free Antivirus, and Avira Free Antivirus follow, each with near 90% of users having RTP enabled. Norton Internet Security has the lowest rate of real time protection enabled, at 66.6%, behind Norton AntiVirus and Kaspersky Internet Security. The average across all products is near 83%, with seven of the top twelve products showing a rate higher than this average.

time since last definition update of antivirus product, December 2012

When looking at the time since a product's virus definitions were updated, Microsoft Security Essentials also leads, with more than 94% of users having received automatic or manual product updates within the last 7 days. With a rate of about 81% of users updating in the last 7 days, avast! Free Antivirus holds the second position, followed by Avira Free Antivirus, ESET NOD32 Antivirus, and AVG Anti-Virus Free Edition. At the other end of the scale, Norton AntiVirus and AVG AntiVirus show the lowest percentages of users who have updated in the last 7, and even 60, days. When the products from all users are averaged, about 73% had been updated in the last 7 days, 8% in the last 7-60 days, and 19% had not updated in more than 60 days.

Windows Operating System Deployments

Windows 7 usage continues to increase in both the Worldwide and North American markets. However, the operating system continues to be more widely-used worldwide than in North America, with North American users showing higher use of XP and Vista compared to the rest of the world. Over the past six months, Windows 7 usage increased nearly 4% worldwide and under 3% in North America, while XP decreased 6.6% and 5.3% respectively in these markets. Windows 8 was released three weeks before the end of the data collection period and is included in the market share report for the first time. Worldwide, this OS is more commonly used than it is in North America, though in both regions its use is still near or below 1%. Preview versions of Windows 8, which have been available for several months, are responsible for detections of the product before it was released.

Worldwide Windows operating systems comparison, December 2012North America Windows operating systems comparison, December 2012
change in Windows operating system users, worldwide, December 2012change in Windows operating system users, North America, December 2012