Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm in a small software company and getting ready to begin supporting 7 remote sales guys out on the road. They all have recent ultrabooks and most of the tools they will be using are in in the "cloud" (SaaS tools such as Salesforce, Box.com, Office365 etc.). They all currently have Microsoft Security Essentials installed, but I'd like to be able to centrally manage things including updates and alerts.

I'm looking at Webroot's SecureAnywhere Business Endpoint Protection since it is centrally managed and "cloud-based" meaning that I don't have to manage the server that manages the clients.

Webroot claims to have a tiny footprint, but I'm wondering what their reputation is for effectiveness.

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

An independent review of various AV products by AV Comparitives put it in 20th position out of 22 tested - hardly a glowing review. You can get the PDF of the report for free.

It scored 1/3 for detection rates, 0/3 for proactive detection, 3/3 for suite performance, 3/3 for AV performance, and 3/3 for anti-phishing[pg.3]. However, this rating is only for scanning when internet access is available, since it uses cloud-based scanning. If no internet access is available, the detection rate drops significantly and misleading alerts are logged about various networking operations being monitored[pg.177]. If they're out in the field and might not always have internet access, I'd probably avoid this solution.

Possible alternatives in terms of performance are ESET and avast!, both of which have a reasonably low footprint. If you're looking for maximum protection, you may want to look at BitDefender or Kaspersky. If you're hoping to heavily leverage cloud-based scanning, Panda Cloud AV might be what you want, though it does hog resources a little.

share|improve this answer
    
AV performance penalty is insignificant in everyday usage. Look at the PCMark results. av-comparatives.org/images/docs/avc_per_201210_en.pdf PCMark emulates real computer usage patterns. –  Cristian Dobre Jan 10 '13 at 22:58
    
@CristianDobre It does, but it doesn't emulate a lot of things like web browser startup (high paging rate), file searches and disk backpus (high disk I/O), etc. Also, you have to consider that "insignificant" is relative. If the AV produces a 2% increase in the total time it takes for me to do everyday tasks, that's an hour lost in a typical work week. –  Polynomial Jan 11 '13 at 9:01
    
The PCMark score is a measure of general system performance so I'm interpreting the impact on performance is like having a CPU + disk that is 2% slower. PCMark has a suite of application startup tests and one for disk tests. The problem is that a lot of tests (graphics, multimedia, encoding) are not impacted by AV but still count to the general score. –  Cristian Dobre Jan 12 '13 at 0:09
add comment

Brian,

It is worth noting that the these tests do not emulate real world end points and are not a good reading for true efficacy. There is a need for reform regarding how new AVs are put through the grinder and rated, which will hopefully be coming soon.

When it comes to Webroot Business Endoint Security, there is a test that shows some great results and might be of interest to you regarding your small enterprise solutions. It accurately exposes true efficacy, and is the "Removal of further malicious components and remediation of critical system modifications" test.

This looks at how well you are able to remove additional payloads of an infection and to restore a system to a state before infection.

Webroot scored 85% http://www.av-test.org/no_cache/en/tests/test-reports/?tx_avtestreports_pi1[report_no]=121434 vs. Symantec's score of 54% http://www.av-test.org/no_cache/en/tests/test-reports/?tx_avtestreports_pi1[report_no]=121455

If anything, it never hurts to just give Webroot a try with the trial program, and then make the conclusion based off your experience: http://bit.ly/XOWCpI

Best of luck with your solution hunting.


To answer the question of "What tests are you referring to? And why aren't they a good measure? – D.W.", I am going to quote directly from the product developer as I cannot explain it any better.

Hi - This is Mike Malloy with Webroot. I am responsible for product development. Its easy to be concerned when you see test results like the recent AV Comparatives tests. We believe that these types of tests do not simulate a real user's experience with SecureAnywhere.

I feel like the parents whose child gets good grades in school but does poorly on tests. Tests like these were designed for the traditional, signature-based AV products and use samples provided by the vendors in the test. For example, in one recent test they put us on a PC with 985,000 pieces of malware which had been provided by some of the vendors. If your computer had nearly a million viruses on it, it would no longer be a computer! In the case of AV-C, I have asked my team to work more closely with them to understand their methodology and see if it could be made to more closely resemble what actual human users see. I respect AV-C and the individuals in it. I am concerned that these tests are not providing consumers the information they need to make an informed security decision. I also note that some other vendors have begun withdrawing from tests like these because they no longer represent (if they ever did) what actual users might see in terms of protection.

On the other hand, we're seeing stunning statistics in our customer satisfaction and overall efficacy. We survey a large group of customers every month. In our April survey of 958 customers, 96.6% said they were likely or highly likely to recommend WSA to their friends and family (while only 3 people said they were highly unlikely to.) Because of the Webroot cloud intelligence engine, we know exactly what we catch and exactly what we don't catch across our users and we're very proud about how well it's working so far. Seeing tests not accurately reflecting this is disheartening and a concern for us but as we learn more about how these tests work, we're starting to understand why our existing systems don't gel accurately with their methodology.

We are confident that you and the millions of other SecureAnywhere customers are getting the best protection in the security industry.

Mike Malloy, Webroot EVP Products and Strategy

*Source: www.community.webroot.com/t5/Webroot-SecureAnywhere-Complete/AV-Comparatives-April-results/td-p/4861#M480

share|improve this answer
2  
I see your account was created today... Can I ask if you represent web root in any way? –  BrianAdkins Jan 10 '13 at 22:10
    
"these tests do not emulate real world end points and are not a good reading for true efficacy" - What tests are you referring to? And why aren't they a good measure? –  D.W. Jan 10 '13 at 23:30
    
Brian - I am a representative of Webroot. I wanted to chime just to make sure both sides were represented so you could make the most informed decision. D.W. - I am updating my post to best answer your question. –  Richard Jan 14 '13 at 18:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.