Kaspersky AntiVirus

Description

In 1989, Eugene Kaspersky sat down to his Olivetti M24 work computer and discovered it was infected with the Cascade virus. Kaspersky, who at the time was a software engineer with a background in cryptography from the KGB Higher School, spent some time decoding the virus, and created a tool to remove it. He kept the sample. Then he collected more.

By 1990, that collection had become a small group at KAMI, a Russian technology company, where Kaspersky and colleagues created the AntiViral Toolkit Pro — AVP. In 1994, Hamburg University conducted a worldwide competitive evaluation of antivirus software. AVP came first.

In 1997 Eugene Kaspersky, his then-wife Natalya, and colleague Alexey De-Monderik left KAMI and founded Kaspersky Lab. They brought AVP with them. An American company had already registered the AVP trademark in the US, so the product became Kaspersky Anti-Virus.

The company grew quickly. Between 1998 and 2000, annual revenue grew 280 percent, and close to 60 percent of revenue came from outside Russia. Kaspersky became the first antivirus company to push database updates on an hourly basis, which became an industry standard. As of 2024, the company has $822 million in annual revenue and approximately 400 million users across the world.

THE PRODUCT LINE

Kaspersky restructured the naming structure of its consumer products in 2023 when the company switched to subscriptions. The previous names — Kaspersky Anti-Virus, Internet Security, and Total Security — are retired in favor of three tiers: Standard, Plus, and Premium. A free version, Kaspersky Free, is still available with basic real-time scanning.

Kaspersky Standard is the entry-level paid tier. It offers real-time malware scanning, a behavioral detection engine, anti-ransomware protection, firewall, and vulnerability detection that identifies outdated software with unpatched security flaws.

Kaspersky Plus includes an unlimited VPN, password manager, storage optimization tools, HDD health monitor and Safe Money — a hardened browser mode that isolates banking sessions in a protected environment, verifying valid certificates and blocking screen capture attempts.

Kaspersky Premium adds everything in Plus and adds parental controls, identity monitoring that checks personal data against breach databases and priority customer support. Identity features differ in extent from country to country.

All paid tiers cover one to ten devices depending on plan and market.

THE DETECTION ENGINE

Kaspersky’s detection is based on multiple parallel mechanisms.

Signature scanning compares files with a constantly updated database of known malware patterns. Updates come in the background without the need to restart the product.

The Kaspersky Security Network (KSN) is a cloud-based threat intelligence system. When a Kaspersky product detects an unknown file, it sends identifying information to KSN, which collects signals from hundreds of millions of endpoints around the world. A new threat detected anywhere in the network can cause detections elsewhere in the network within minutes. Participation is opt-in.

Heuristic analysis involves analyzing the structure of unknown files to identify those that are similar to known malware families, in order to detect variants of malware that have been modified by attackers to bypass pattern-based detection.

Behavioral monitoring — marketed as System Watcher — monitors running processes in real time, seeing what code actually does: what files it reads or writes, whether it tries to encrypt other files (a ransomware indicator), whether it injects code into other processes. When behavior matches attack patterns, the system terminates the process and rolls back changes the malicious code already made.

In independent evaluations through 2024 and 2025, Kaspersky ranked first among major testing organizations. AV-Comparatives gave it a Top-Rated Product designation for 2024, and AV-TEST gave it perfect 6/6 protection scores on Windows 11 up to mid-2025.

THE THREAT RESEARCH Division

Kaspersky’s profile in enterprise and government security is built heavily on GReAT — the Global Research and Analysis Team — whose discoveries influenced the understanding of state-sponsored cyberwarfare.

In 2010, GReAT collaborated with Microsoft to analyze Stuxnet, a worm that infected industrial control systems at Iranian nuclear facilities using four simultaneous zero day vulnerabilities. Kaspersky’s analysis concluded the attack required nation-state resources.

In 2012, GReAT discovered Flame, espionage software 20 megabytes in size — about 40 times larger than Stuxnet — capable of capturing keystrokes, recording audio, taking screenshots and extracting Bluetooth data.

In January 2013, GReAT released results of Red October, a cyber espionage campaign active since at least 2007. It retrieved information from hundreds of diplomatic institutions and government agencies in 39 countries, targeting desktops, network equipment, and smartphones at the same time.

In 2015, GReAT discovered Duqu 2.0 running inside Kaspersky’s own network — malware designed to collect intelligence on Kaspersky’s methods of detection. The company revealed the attack publicly, which is uncommon in the security industry.

THE GOVERNMENT CONTROVERSY

In September 2017, the US Department of Homeland Security ordered federal agencies to remove Kaspersky software from their systems, citing concerns about possible connections to Russian intelligence. Russian law obliges tech companies to cooperate with domestic intelligence services and antivirus software has deep system access. Congress extended the ban to military computers in December 2017.

Kaspersky denied any cooperation with the government. Eugene Kaspersky offered to let US officials review the company’s source code — an offer that went unanswered. In 2018, Kaspersky launched the Global Transparency Initiative, which moves data processing for European and North American users to two data centers in Zurich, Switzerland, and opens Transparency Centers in over a dozen cities where government stakeholders can review source code, update procedures and threat detection rules.

In June 2024, the Biden administration extended the US action. The Department of Commerce announced that Kaspersky would not be able to sell its software in the United States anymore and that updates would cease on September 29, 2024. Kaspersky shut its US office in July and fired about 50 employees.

On September 19, 2024, Kaspersky sent an auto update to its remaining one million US customers that silently uninstalled Kaspersky and installed UltraAV from Pango Group. Many users found unknown software on their computers with no warning. UltraAV was not tested by any major independent testing laboratory at the time. The incident attracted a great deal of criticism.

Australia bans Kaspersky from government devices in February 2025 The UK, Canada and Germany had previously restricted government use. These restrictions apply to public sector networks rather than private use.

Kaspersky believes that government decisions are politically motivated. The company cites its independent test scores, data infrastructure in Switzerland and open source code reviews as a basis for that position. The US government has not made its classified evidence public.

AVAILABILITY

Users in the United States are not able to purchase Kaspersky products and are unable to receive updates for installed versions. Users in Canada, the UK, Germany and Australia are not subject to any commercial restrictions on private use — government restrictions apply to public sector devices only. Users from other parts of the world have full access to the current versions with continuous updates. The decision to use Kaspersky outside restricted regions is one of weighing strong, independently verified technical performance against structural concerns around a Russian-headquartered company subject to Russian law.