Sources & how to read the data264 sources

Neither is collected from anywhere, so neither appears above or in the count: there is no file to fetch and no date to show.

Vendors and the public

Submissions through Add my product and corrections through Suggest a correction. Reviewed by a person before anything is published, and attributed. A vendor’s own statement about their own product can never reach “independently verified” on their word alone.

CSI research, AI-assisted

Country, headquarters, founding year, website, market segment, whether a product is free or paid, and its headline capabilities. CSI assembled these values itself with AI assistance, drawing on what a model had already learned rather than on a document it can cite. Every one is recorded as machine-read rather than checked by a person, so they can be told apart from the rest of the site at a glance and re-checked later, and none of them reaches independently verified on this basis. Anything above overrules them.

Estimates

Where a vendor publishes no figure for its revenue, customers, users or headcount, or for how many scanning engines a product uses, CSI may show an estimate made with an AI model. It is always marked as estimated by LLM, is never presented as the vendor’s figure, and is replaced as soon as a published one is found. Test results and certifications are never estimated.

Coverage is uneven and visibly so. Most products carry a vendor, a version and a platform list and little else, because that is what the catalogue states — the rest of each row is marked unknown rather than filled with plausible guesses. What that means is set out next.

Most product comparison tables have one empty state, and readers interpret it as “no”. That is the single most common way such a table lies. CSI stores and renders four distinct absences, and never turns any of them into a no, a zero or a blank.

Support itself is not a boolean either. A capability can be native, an optional paid module, integrated, third-party, partial, deprecated or not supported. “Yes” hides the difference between a feature you already own and one that costs extra.

Every published fact carries how CSI came to believe it.

Verified

CSI stands behind this — confirmed against an authoritative source CSI retrieved itself, or asserted by CSI’s own editors.

Vendor submitted

Supplied by someone CSI could tie to the vendor — their email domain matches the vendor’s own site. Reviewed for plausibility and cited, but not independently confirmed. A vendor submission can never be promoted to verified on the vendor’s word alone.

Community submitted

Sent in by someone whose connection to the vendor CSI has not established: a correction request, or a vendor-form submission CSI could not tie to the vendor. Same review, weaker attribution.

Unverified

Recorded from a single weak source and not yet checked.

Unknown

No verification has been attempted.

Claims are append-only. Correcting a fact writes a new claim and closes the old one; the superseded value stays in the record and is visible on the change feed and in every evidence inspector.

Release date is when the vendor shipped something. Last verified is when CSI last checked that a fact was still true. They answer different questions and CSI never conflates them: a product released last week can hold a price CSI has not confirmed since last year. Neither is the last read date on a source above, which is when CSI fetched that publisher’s file and says nothing about when the publisher changed it.

The dot beside a value shows freshness against that field’s staleness budget: within budget, overdue, stale, never verified. Budgets differ by field — a capability checked 120 days ago is fine, a price is not.

A row is only as fresh as its stalest contributing fact, so the “last verified” shown for a product is the minimum across everything feeding it, not the most recent touch.

Results from independent test labs — AV-TEST, AV-Comparatives, SE Labs, NetSecOPEN and MITRE ATT&CK Evaluations today — are their work, published under their terms. CSI stores only three things per result:

• the figures as published — AV-TEST’s protection, performance and usability scores; AV-Comparatives’ protection rate, false positives and impact score; SE Labs’ protection, legitimate and total accuracy ratings and its award; NetSecOPEN’s share of exploits blocked, HTTPS throughput and HTTPS connections per second; the results MITRE publishes from its ATT&CK Evaluations,
• a deep link to the lab’s own report, and
• an attribution naming the lab, the run and the publication date.

CSI does not mirror report text, copy a lab’s charts or commentary, or re-rank labs against each other. A test run’s page lists the products CSI holds a result for in that run, each with the figures the lab published; the lab’s own report, linked from it, is the complete record. Every score is shown with its run and date, because a protection score from a two-year-old run is not comparable with a current one.

A product tested on several platforms can have a different result on each, and each is shown with its platform. Where a chart or a filter needs one figure per product, it uses the average across the platforms tested, and says so.

A lab column reading not tested means no result has been recorded for that product — most often because the lab did not include it in that run. It never means the product scored badly, and filtering by a score leaves those products out rather than counting them as low.

A category’s products are listed in a default order until you sort by a column yourself; your sort always replaces it. The default is decided in this order:

1. Vendors under US, EU or UK government restrictions come last, whatever else applies. Their products stay listed, and their product and vendor pages say which restriction applies.
2. In some categories, CSI’s editors choose which products lead, and in what order. That is an editorial judgement, not a score, and not a test result.
3. The rest follow by independent evidence on antimalware tables — first, how many independent labs have tested the product; among products tested by as many labs, the better overall result across those tests; then how many certifications it holds; then its name — and alphabetically elsewhere.

A product’s place in that order is not a rating, and being lower in it says nothing about a product. CSI has no “best” list: to compare products, sort or filter by the evidence that matters to you.