The Antivirus Industry

Abstract

For twenty years, the first thing you installed on a new PC was the thing that would slow it down: antivirus software. Born in 1987 when John McAfee, Germany’s G Data, and Slovakia’s ESET independently shipped the first scanners, the industry rode the PC virus boom (signature databases racing an exponential flood of malware from a few hundred samples a year to millions) into a multi-billion-dollar consumer business built on fear. Then it was disrupted by the operating system itself: Microsoft bundled Windows Defender, made it good, and made it free, gutting the paid market. Along the way antivirus proved two uncomfortable things: that perfect virus detection is mathematically impossible (Fred Cohen, 1987), and that the all-seeing, kernel-level scanner is itself one of the most dangerous programs on the machine. Its longest-lived legacy may be a marketing myth it helped kill: that Macs don’t get viruses.

Creeper, Brain, and the First Scanners

The virus predates the cure. Creeper (1971) crawled DEC PDP-10s on ARPANET printing “I’M THE CREEPER, CATCH ME IF YOU CAN”; Reaper was written to chase it down, arguably the first antivirus, and itself a self-replicating program (see Fun Fact: Reaper, the First Antivirus). Elk Cloner (1982) hit Apple II floppies (see Fun Fact: Elk Cloner); Brain (1986), written by two brothers in Lahore, became the first widespread IBM PC virus (see The History of Hacking).

The response industry crystallized in a single year, 1987, independently in several countries: Bernd Fix documented removing the Vienna virus, G Data shipped an Atari ST scanner, Czechoslovak developers wrote what became ESET’s NOD32, and John McAfee founded the company and product (VirusScan) whose name became a household word (and whose founder became a cautionary tale of an entirely different kind). Peter Norton’s brand, acquired by Symantec in 1990, launched Norton AntiVirus in 1991 and, with McAfee, defined the consumer category through the decade. Russia’s Kaspersky Lab, Britain’s Sophos, and Spain’s Panda filled out a global industry within a few years.

That same year came the theorem that should have humbled all of it: Fred Cohen (who had coined “computer virus” as a graduate student under Leonard Adleman) proved that no algorithm can perfectly detect all viruses. Detection is undecidable, a cousin of the halting problem. Every antivirus product ever sold is, provably, an approximation.

The Signature Treadmill

The core method was signature scanning: keep a database of byte-patterns unique to known malware, scan files against it. It worked while malware was scarce and static, and it defined the business model, a subscription to definition updates, the antivirus company’s real product. Two escalations broke it. Polymorphic and metamorphic viruses encrypted or rewrote themselves each infection so no fixed signature matched, forcing heuristics, detecting virus-like behavior and code families rather than exact bytes. And then the internet turned a trickle into a firehose: macro viruses hiding in Word documents (Melissa, 1999), then mass-mailing worms that needed no host file at all: ILOVEYOU (2000, see Fun Fact: The ILOVEYOU Virus), Code Red, SQL Slammer, Blaster, spreading globally in hours, far faster than any signature could be written and shipped (see Cybersecurity: The Invisible War). Unique malware samples went from a few hundred a year in the early 1990s to millions annually by 2007. The treadmill could not be won; it could only be run.

By the 2010s the industry conceded the point, rebranding around behavioral detection, cloud lookups, machine learning, and (for enterprises) EDR (endpoint detection and response), which assumes infection is inevitable and focuses on catching it in the act. The signature database never died, but it stopped being the whole game.

The Cure as Disease

Antivirus is the most privileged software most people run: kernel-level, auto-updating, scanning every file, trusted absolutely. That makes it a spectacular attack surface and a spectacular liability.

False positives as self-inflicted malware. Symantec (2007) and McAfee (2010) shipped definition updates that identified core Windows system files as viruses and quarantined them, knocking huge numbers of PCs worldwide out of commission, the antivirus doing more damage in an afternoon than the viruses it hunted (compare Famous Software Disasters).
A backdoor by design. Security researchers (notably Google’s Project Zero; see The Vulnerability Disclosure Debate) found critical remote-code-execution holes in the parsing engines of major antivirus products: because the scanner inspects every untrusted file with high privileges, a bug in it is a worst-case vulnerability. Intelligence agencies reportedly exploited exactly this access.
Geopolitics. Kaspersky (technically well-regarded) was banned from US government systems (2017) and then US sale (2024) over its Russian jurisdiction: the trust antivirus demands is unenforceable across a hostile border.

Disrupted by the OS

The consumer paid-antivirus business was killed by “good enough and free.” Microsoft Security Essentials (2009) became Windows Defender, bundled into Windows 8 (2012) and steadily improved until it scored among the top products in independent AV-TEST rankings, default, invisible, gratis. Apple’s XProtect did the same silently on macOS. Why buy Norton when the OS already guards you? Searches for “antivirus” have fallen since 2010; over half of Americans now rely on built-in protection. The survivors consolidated into a handful of holding companies: Avast bought AVG (2016), Gen Digital (Norton’s parent) rolled up Avira and Avast (2020–22), the classic end-state of a commoditized category: fewer brands, same underlying engines, upsold bundles of VPNs and password managers to a shrinking base of the worried.

Myth: Macs don’t get viruses.

Misconception. Apple’s “Get a Mac” ads (2006) openly claimed the Mac “doesn’t get PC viruses,” and the belief hardened into folklore. It rested on market share, not immunity: malware authors targeted Windows because that’s where the users were. The proof came in 2011–12 with the Flashback trojan, which exploited a Java flaw to infect over 600,000 Macs (~1% of all Macs) with no password required, spreading by merely visiting a web page. The delay was damning: Oracle patched Java on February 14, 2012, but Apple maintained its own Java build and shipped the fix only on April 3, after the infections. Apple quietly dropped the “doesn’t get PC viruses” language from its marketing around the same time. Macs get less malware; they were never immune, and Apple ships XProtect precisely because they aren’t. See Myths and Misconceptions.

⚠️ Dead End: The Standalone Scanner

The paid consumer antivirus (a separate product you bought, installed, and renewed) is a fading category, killed by the same logic that killed the standalone word processor and the standalone GPS: once the function is good enough as a built-in feature of the platform, the standalone product loses its reason to exist. But the deeper dead end is the signature-scanning model of security itself, the belief that safety comes from enumerating all the bad things and blocking them. Cohen proved in 1987 that the list can never be complete, and forty years of malware outrunning definitions confirmed it empirically. The field’s center of gravity moved to approaches that assume breach: memory-safe languages that prevent whole vulnerability classes, sandboxing and least privilege that limit what any code can do, zero-trust architectures, and behavioral EDR. Antivirus was the security industry’s first mass-market product and its longest-running act of faith in a provably impossible goal (catch every virus) sold, profitably, for a generation.