Antivirus and Encryption: October 2013


OPSWAT releases periodic market share reports for several sectors of the security industry. This report includes worldwide market share for antivirus and encryption applications. The data used in this report was collected on October 1, 2013.  Please note that OPSWAT is not a research institution and makes no claims on accuracy of this data in the real world marketplace; this report aims to distribute the unique data collected to inspire public discussion, not to make any claims as to why changes have occurred. To see a description of the data collection and its limitations, see the data collection section of this report.


OPSWAT is a San Francisco based software company that provides solutions to secure and manage IT infrastructure. Founded in 2002, OPSWAT delivers solutions that provide manageability of endpoints and networks, and that help organizations protect against zero day attacks by using multiple antivirus engine scanning and detailed file filtering. OPSWAT’s intuitive applications and comprehensive development kits are deployed by SMB, enterprise and OEM customers to more than 100 million endpoints worldwide. To learn more about OPSWAT’s innovative and unique solutions, please visit

Worldwide Antivirus Vendor Market Share

As seen in past reports, Microsoft leads worldwide antivirus vendors with more than a quarter of the market, and Avast follows closely behind with 23.6%. The remaining antivirus vendors all show market shares in the single digits, with AVG, Symantec, and ESET leading this tier. The top ten antivirus vendors control 92% of the market. Only antivirus products with real time protection (RTP) enabled are included in this comparison. A product with RTP enabled is currently actively protecting a user’s machine, while a product without RTP enabled is expired or disabled. In the table to the right, clicking each vendor name will reveal the distribution of component products within it.

worldwide antivirus vendors market share - october 2013

Antivirus Vendor (click to expand)

Market share



Microsoft Security Essentials 67.7%
Windows Defender 30.7%
System Center Endpoint Protection 1.2%
Other <1%



avast! Free Antivirus 83.4%
avast! Internet Security 12.7%
avast! Premier 1.9%
avast! Pro Antivirus 1.7%
Other <1%



AVG Anti-Virus Free Edition 57.9%
AVG Internet Security 35.7%
AVG AntiVirus 4.6%
Other 1.0%



Norton Internet Security 42.2%
Norton 360 22.1%
Symantec Endpoint Protection 20.1%
Norton AntiVirus 14.7%
Other (each less than 1%) 1.0%



ESET Smart Security 56.3%
ESET NOD32 Antivirus 34.4%
ESET Endpoint Security 5.7%
ESET Endpoint Antivirus 3.6%



Avira Free Antivirus 85.1%
Avira Internet Security 8.8%
Avira Antivirus Premium 5.0%
Other 1.0%

GKaspersky Lab


Kaspersky Internet Security 58.4%
Kaspersky PURE 18.5%
Kaspersky Anti-Virus 13.9%
Kaspersky Anti-Virus for Windows Workstations 4.0%
Kaspersky Small Office Security 2.9%
Kaspersky Endpont Security 2.3%



McAfee VirusScan 69.8%
McAfee VirusScan Enterprise 26.7%
Total Protection for Small Business 3.5%



Bitdefender Total Security 49.1%
Bitdefender Internet Security 30.9%
Bitdefender Antivirus Plus 14.5%
Endpoint Client by Bitdefender 1.8%
Endpoint Security by Bitdefender 1.8%
BitDefender Business Client 1.8%



antivirus vendors worldwide,  real time protection enabled users, October 2013

While the comparison above only includes data from products with real time protection (RTP) enabled, OPSWAT also looked at data for all installed products, including those that are expired or disabled. If RTP is not enabled, the product is installed on the user’s machine but not actively protecting it. When RTP status is not a factor, Microsoft’s lead in market share increases by 8%, while Avast’s share decreases by 5%. Similarly, all the other top vendors show decreased market share in this comparison. This result reveals that a high number of users who have Microsoft antivirus products installed on their machines do not have these products running. The next section, which shows comparisons by product, gives more insight into the difference in RTP status between Microsoft’s products.

Worldwide Antivirus Product Market Share

In the worldwide market of antivirus products with real time protection (RTP) enabled, avast! Free Antivirus ranks as the leader, with a share of 19.6%. Microsoft claims the next two positions, with Security Essentials and Windows Defender at 17.2% and 7.8%. The other products that showed more than four percent of the market include Avira Free Antivirus, AVG Anti-Virus Free Edition, and ESET Smart Security. The top ten products control 72.1% of the market. A product with RTP enabled is actively protecting a user’s machine, as opposed to products that are expired or disabled. Only these active antivirus products are included in this section of the report.

worldwide antivirus products market graph, October 2013
  Antivirus Product Market Share
A avast! Free Antivirus 19.6%
B Microsoft Security Essentials 17.2%
C Windows Defender 7.8%
D Avira Free Antivirus 5.8%
E AVG Anti-Virus Free Edition 4.8%
F ESET Smart Security 4.0%
G Kaspersky Internet Security 3.8%
H Norton Internet Security 3.2%
I avast! Internet Security 3.0%
J AVG Internet Security 2.9%
K ESET NOD32 Antivirus 2.5%
L McAfee VirusScan 2.2%
  Other 23.2%
antivirus products worldwide, real time protection enabled users, October 2013

The ranking of all installed antivirus products, regardless of whether real time protection (RTP) is enabled, shows one big difference from the graph above. In this expanded set of data, which includes expired and disabled products, Windows Defender tops the list with almost 20% of the market. This is more than double the product’s market share when only products with RTP enabled are compared. This huge adjustment caused by Windows Defender in this data set causes every other top antivirus product to lose market share in the comparison. Besides the change in Windows Defender, the ranking of products is the same as that seen in the RTP enabled comparison. One noteworthy conclusion drawn from this data set is that Windows Defender is much more likely to be disabled on a person’s computer compared to other top antivirus products.



Worldwide Antivirus Product Comparisons

This graph shows a comparison between desktop and laptop users within each top antivirus, and considerable differences are seen across products. The only product with noticeably more users on laptops, as opposed to desktops, is McAfee VirusScan, with a 65/35% ratio. Windows Defender leans very slightly toward desktop users, but all other top antivirus products show significantly more desktop users. The products with the highest percentage of desktop users are Kaspersky Internet Security, with 66.3%, followed by Norton Internet Security at 62.8%. These results only include products with real time protection enabled.

Antivirus products by desktop and laptop users, October 2013

Antivirus products in Windows operating systems, October2013

This section features a cross comparison between windows operating systems and the top antivirus products found on them. Only the top six products, and only those with real time protection enabled are included in this comparison. Windows Defender is by far the most common antivirus product found on Windows 8 operating systems. Microsoft Security Essentials is evenly represented across Windows XP and Windows 7, and avast! Free Antivirus is most commonly found on computers with Windows 7. If only Windows XP users are considered, Avira Free Antivirus becomes the second-ranked antivirus product, and ESET Smart Security follows. These results only include products with real time protection enabled.

Multiple antivirus products installed, by antivirus, October 2013

This comparison shows the percentage of users of each antivirus product that also have an additional product installed on their machine. This could be due to any number of reasons, such as difficulty in uninstallation, low confidence in the product, or low interference with other products. Previous comparisons in this report showed that Windows Defender was much more likely to have real time protection disabled compared to other antivirus products. With Windows Defender inactive, one would expect most users to have another product installed to protect their machines. This holds true, as machines with Windows Defender show the highest rate of multiple antivirus products installed, with around 65%. Out of the remaining products, McAfee VirusScan shows the highest rate, while Microsoft Security Essentials shows the lowest. These results include all products, whether or not real time protection is enabled.


multiple antivirus installed by operating system, october 2013

In the previous comparison, computers with Windows Defender installed were the most likely to have another antivirus product installed. Windows Defender, as an antivirus product, is only available on Windows 8, where it is pre-installed, integrated in the operating system, and impossible to remove without hacking the system. The result is that Windows 8 users, at almost 65%, are much more likely to have another antivirus product installed than are users of other operating systems, which are each around 20% or lower. Windows XP is lowest at around 9%. This comparison includes all products, whether or not they have real time protection enabled.

Encryption Products

According to the data, very few users have encryption actively running on their machines. However, laptops are much more likely to have at least one drive encrypted than are desktops. Around 53% of computers in this data set had encryption software installed. Out of all laptop computers with encryption software installed, 2.8% were found to have at least one drive encrypted, as opposed around 1% of desktop users. This higher rate of encryption in laptops is expected; since laptops are more easily stolen, protection of sensitive data is a higher priority.

windows operating system market share, august 2013 device types in market share report, august 2013

Data Collection

This report shows comparisons for antivirus applications on Windows systems from data collected from users of OPSWAT’s Security Score and free GEARS Cloud tools. These free products use the detection capabilities of OPSWAT GEARS technology to collect information regarding the applications installed on endpoint computers. Security Score is a personal security monitoring tool available at and also at various download sites across the web. GEARS Cloud is a network monitoring tool available at and is free to manage up to 25 devices. Only free GEARS Cloud users are included in this report. These tools are used around the world by home and business users, both expert and inexperienced in security software. For the purpose of the report, the sample of more than 4000 users is assumed to be representative of the market, based on the wide accessibility of the tools to a large range of users. However, these results are likely to differ from those in the real world (see below for more details). GEARS Cloud and Security Score run continuously in a user’s system as security tools. This allows for continuous reports over time from each user, as long as the application is installed. For this report, the data was collected to show what was on each user’s computer from the most recent data transfer that was sent before the time of collection on 10/1/2013.

This is the first market share report to include data from GEARS Cloud users. The previous report used only Security Score data, and other past reports that used data from OPSWAT’s AppRemover tool ( By combining data from GEARS Cloud and Security Score, the results are expected to contain a wider variety of users, potentially representing a more accurate representation of the real world market. However, several attributes inherent in way the data is collected may cause the results in this report to differ from what exists in the real world. OPSWAT makes no claims as to the accuracy of the data in the real world market and is continuously working on ways to overcome the following obstacles:

  • On average, GEARS Cloud and Security Score users more are likely have to better functioning security on their computers than would be seen in the market as a whole. Security Score continuously provides information to its users about the strength of their security measures, and GEARS Cloud allows IT administrators to monitor users who are not security compliant. In both cases, the act of gathering OPSWAT’s market share data also serves to remind users to increase their security capabilities.
  • The data was collected only a short time after the release of new data collection technology in Security Score and GEARS Cloud, making for a small sample. The sample size will continue to increase in each report since the data is collected from every current user of these products. More data in the future will allow for several in-depth comparisons that have not been included in past reports.
  • These applications are marketed in OPSWAT’s own channels. Users sampled may not be representative of the general population. For example, this report may contain a different distribution of Windows operating systems and device types compared to what exists in the real world. While this report contains more than 20% Windows 8 users, Net Applications reports that only around 8% of all Windows users currently operate under Windows 8.
windows operating system market share, october 2013 device types in market share report, october 2013
  • Although the free version of Security Score is only available for Windows users, GEARS Cloud is available for both Windows and Mac. However, Mac applications are not included in this report, and products that are available on both Mac and Windows would presumably have different market shares in the real world. Market share for Mac users is expected to be added in future reports.
  • While Security Score and GEARS Cloud are used on devices around the world, their use is not commensurate with worldwide population distribution. Only English-language versions of this tools is available, so countries that have higher numbers of English speakers are expected to use these applications at higher rates, as well as countries that have been exposed to more coverage of these tools by press and partners. For example, the Chinese antivirus vendor Qihoo 360 recently reported that it had 440 million users of its internet security products, but it did not make the list of top vendors in this set of data.
worldwide data distribution
  Country Market Share
A Brazil 23.3%
B United States 18.1%
C Russia 6.6%
D Netherlands 5.3%
E Italy 4.7%
F Portugal 3.5%
G Belgium 3.4%
H United Kingdom 3.0%
I Japan 2.6%
J Canada 2.4%
K Australia 2.4%
L Ukraine 1.9%
M India 1.8%
N Indonesia 1.4%
O France 1.4%
  Other 18.2%



Stay tuned for the next market share report in January, which will feature new comparisons and in-depth comparisons of product usage. OPSWAT is working to increase global usage of Security Score, GEARS Cloud, and other free applications. Mac application data will also be added in the future.

Vendors of antivirus, P2P, patch management, backup, encryption, and other applications interested in inclusion in these reports, GEARS Cloud, and OESIS Framework are encouraged to contact to learn how to partner with OPSWAT.

OPSWAT Products and Services

GEARS Cloud is the only cloud-based network security and manageability solution for IT professionals that provides visibility and management for many application types from antivirus to hard disk encryption and public file sharing, as well as the ability to remove non-compliant applications. Monitor up to 25 devices for free! Visit to learn more and sign up.

Security Score
OPSWAT Security Score is a free tool that scans your computer for the status of your installed security applications and provides a score along with recommendations on how to improve both the score and the security of your device. Download and install it now to find out your security score at

OESIS Framework is a cross platform, open development framework that enables software engineers and technology vendors to develop products that detect, classify and manage thousands of third-party software applications. OESIS is perfect for SSL VPN, network access control (NAC) and other manageability solutions, and is already deployed on an estimated 100 million endpoints worldwide. To learn more, visit

OPSWAT Certification
The OPSWAT Certification Program is a free interoperability program designed to enable technology partnerships between independent software vendors and leading network and technology solution vendors, by verifying that their security applications will work seamlessly with solutions employing the OESIS Framework. Additional information is available at

opswat certification badges

OPSWAT offers several multi-scanning solutions to enable fast, powerful content scanning. Because no single antivirus engine is perfect, using multiple engines significantly improves the likelihood of detecting malware.

Metascan technology powers each of OPSWAT’s multi-scanning solutions, enabling IT professionals and software engineers to enhance network security by scanning with up to 30 built-in antivirus engines from market leaders such as ESET, Norman, AVG and many others. Metascan allows for custom implementations, such as integration with other engines of your choice, and can be used for rapid malware analysis and to implement sophisticated data loss prevention systems.

For specific multi-scanning needs, OPSWAT also offers Metascan Client, which quickly scans endpoints’ running processes and memory for key loggers, viruses and other malware, and Metadefender, which scans removable media such as USB drives, CDs, DVDs, and memory cards.

A free demo of Metascan technology is available at

The free AppRemover utility enables the thorough uninstallation of security applications like antivirus and antispyware from your computer. AppRemover is available for commercial licensing if you wish to deploy multiple copies of AppRemover within an organization or entity, or if you wish to bundle AppRemover with hardware, software or other services. More information is available at

Disclaimer of Warranty

OPSWAT Inc. makes no representation or warranties, either express or implied by or with respect to anything in this document, and shall not be liable for any implied warranties of merchantability or fitness for a particular purpose or for any indirect special or consequential damages.

Copyright Notice

OPSWAT, OESIS, Metascan, Metadefender, AppRemover and the OPSWAT logo are trademarks and registered trademarks of OPSWAT, INC. All other trademarks, trade names and images mentioned and/or used herein belong to their respective owners. No part of this publication may be reproduced, stored in a retrieval system or transmitted, in any form or by any means, photocopying, recording or otherwise, without prior written consent of OPSWAT Inc. No patent liability is assumed with respect to the use of the information contained herein. While every precaution has been taken in the preparation of this publication, OPSWAT Inc. assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice.