Antivirus suites aren’t perfect: you can get false positives and false negatives. Here’s how it happens and what you can do about it.
Millions of people rely on antivirus software to keep their devices safe, but these programs aren't perfect. An antivirus tool can provide a false positive or negative to a user, giving them a false sense of security. So, what exactly are antivirus false positives and negatives, and how can you spot or avoid them?
When you install an antivirus program, regular scans will often be conducted on your behalf. You can also manually carry out scans if that's your preference, but in both scenarios, the antivirus software will comb your device for suspicious and dangerous files.
If your device is free of such files, the antivirus will notify you that all is well. Most users get this result the majority of the time, and it's often good news. In other instances, the antivirus will tell you that it has picked up on one or multiple shady files, which it will then quarantine, block, or delete.
You can usually trust your antivirus program to give you accurate results if you're using a reputable and highly-rated product. Providers like McAfee, Norton, and Kaspersky have detection rates of over 99 percent, which is undeniably reassuring.
But no matter how high an antivirus program's detection rate is, there is still room for error.
This is where false positives and false negatives can occur.
An antivirus false positive takes place when your antivirus program identifies a benign file as harmful. Though rare, an antivirus tool can mistakenly label a file as dangerous, when in reality, there is no danger at all.
False positives are problematic because they can result in the deletion of important files. The majority of antivirus programs will automatically delete files that they deem a risk, meaning you are not consulted before termination. If you're using a shoddy app, or you simply run into a spot of bad luck, your antivirus software can permanently get rid of harmless files, leading to the loss of crucial data.
In certain false positive scenarios, your antivirus software may delete a swathe of files without your knowledge.
Along with the frustration of having benign files deleted, false positives can also cause the user unnecessary stress. Malware can be highly dangerous and cause a lot of damage, so it's always worrying to be notified that your device has been targeted. When there is no real threat, this may lead to you taking mitigation measures that will ultimately be a waste of time.
Antivirus false negatives occur when your antivirus software tells you that your device is free of malware when that is not the case.
When antivirus programs conduct scans, they search for all kinds of malicious files, including:
During malware searches, the antivirus software may simply come across a malicious file and fail to flag it as dangerous. We'll discuss some factors that lead to this a little later.
But regardless of what causes a false negative, the consequences can be dire. If a malicious file is present on your device and your antivirus software hasn't flagged it, there's no knowing what damage can be done without you realizing what's going on. If your antivirus program repeatedly fails to detect this file, it can remain on your device for weeks, months, or even years.
There are a few key factors that can lead to a false positive or negative result in an antivirus program, starting with software updates.
Software updates often bring new features, higher security, and bug patches, all of which are helpful to users. But there are sometimes downsides that come with these updates, such as further software bugs. If you update your antivirus program, a new flaw may lead to false positives and negatives.
On the other hand, a lack of software updates can also lead to false scan results, especially if the program is using an outdated malware and virus database.
False negatives sometimes occur when the antivirus program does not have a particular file within its database. When scanning for malicious files, antivirus tools use a pre-made log of known malicious files. If your device is infected with an unidentified malicious program, chances are that your antivirus software won't be able to tell that it is even there.
So, if you don't update your antivirus software regularly, this can also lead to false positives or negatives.
What's more, some kinds of malware are specifically designed to evade antivirus detection. As antivirus programs evolve, cybercriminals are developing new ways of staying under the radar. If a given malware program manages to dodge your antivirus suite's keen eye, it's likely you'll get a false negative after a scan.
It's impossible to ensure that your antivirus provides a totally accurate scan result all the time. No antivirus tool is perfect, so there's always a chance that a malicious file will slip through the cracks, or a harmless program will fall out of the program's favor.
So, if you're looking to make your antivirus software 100 percent airtight, you may be disappointed.
But there are things you can do to avoid inaccurate scan results.
It's always tempting to opt for a free antivirus program over a paid service, but many of these come with drawbacks, including lackluster security features. A free antivirus program may not be equipped to effectively search for malicious files or may be more prone to setting off false alarms.
However, there are a few trusted free antivirus programs out there that you can try. We have a list of the best free Mac antivirus programs, as well as the best free Android antivirus apps, if you're interested in learning more.
While software updates can lead to issues now and then, they're usually a net positive for users. This is why you should update your antivirus software relatively frequently so that you're getting the latest security features and database additions.
If you're concerned about false positives or negatives on your antivirus client, it might be worth talking to customer support to see if they can lend a hand.
If you're very security-focused and aren't working with a tight budget, you might want to use two antivirus programs, or an antivirus and antimalware program simultaneously, to further decrease the chance of getting a false result.
If you've discovered that your antivirus has flagged a false positive or given a false negative, report it to your provider. This can help to weed out common issues and prevent other users from running into the same problems. Your false result may be down to a simple software bug, which can often be quickly patched once the provider is aware of it.
Regardless of the type of antivirus program you're currently using, the possibility of false positives or negatives remains. This possibility is usually slim, but it's best to consider some of the tips above to make sure you're getting an accurate result as frequently as possible.
By subscribing, you agree to our Privacy Policy and may receive occasional deal communications; you can unsubscribe anytime.
Katie has been writing about tech-based topics for two years, with a specific interest in cybersecurity, AI, and cryptocurrency. Katie has covered a variety of topics during her time at MUO, including crypto explainers, cybersecurity guides, VPN reviews, recent hacks, and software tutorials. With a passion for emerging tech, Katie is also excited to see what new devices and digital platforms the coming years will bring.
