Antivirus Engine and Ownership Map: Who Owns What in 2026
Which antivirus brands share a corporate parent, and which run another company's detection engine — organised from AV-Comparatives' vendor list and company filings.
Quick answer: Four brands people compare as rivals — Norton, Avast, AVG and Avira — all belong to Gen Digital, and Norton and AVG run Avast's engine. Five more products run Bitdefender's engine under other names, and TotalAV and F-Secure run Avira's. Sharing an engine doesn't make two subscriptions equal, but it does change what counts as a genuine second opinion.
Why this map exists
Antivirus marketing is built on brand names. The industry underneath runs on a much smaller number of detection engines, licensed between companies that also buy each other regularly. Neither fact is secret — AV-Comparatives publishes which vendors license a third-party engine, and the ownership chain sits in company filings — but nobody keeps them in one place, dated, with the buying consequences spelled out.
That gap causes real mistakes. People install a "second opinion" scanner that shares its engine with the product that already missed the threat. They switch brands over a privacy record and land on another brand owned by the same company. They pay a premium for what they believe is a different engine and get a different interface.
Who owns which antivirus brand
Gen Digital is the outlier in scale: one company holding four of the most searched consumer antivirus brands. It came together through a chain of acquisitions — Avast bought AVG in 2016, NortonLifeLock bought Avira from Investcorp for $360 million in December 2020, and in 2022 NortonLifeLock and Avast merged into Gen Digital in a deal worth about $8.6 billion.
The rest of the market is more fragmented than the shelf suggests. Some owners come from outside consumer security altogether: Webroot sits inside OpenText, Panda inside WatchGuard, VIPRE inside the media group Ziff Davis, and ZoneAlarm inside enterprise vendor Check Point.
| Owner | Consumer brands | How it happened |
|---|---|---|
| Gen Digital | Norton, Avast, AVG, Avira, LifeLock, CCleaner | Formed in 2022 when NortonLifeLock bought Avast for $8.6bn. Avast had already acquired AVG in 2016; NortonLifeLock bought Avira from Investcorp for $360m in December 2020. |
| Microsoft | Microsoft Defender | Built into Windows rather than sold, which is why it has no renewal price and no upsell path. |
| OpenText | Webroot, Carbonite | Acquired as part of the Carbonite deal; Webroot keeps its own cloud-first engine. |
| WatchGuard | Panda | Panda's consumer line continues under a business-security owner. |
| Ziff Davis | VIPRE | A media group owner; VIPRE licenses Bitdefender's engine. |
| Check Point | ZoneAlarm | Enterprise security vendor; the consumer ZoneAlarm line runs Sophos technology. |
| Protected.net | TotalAV | Runs the heavily advertised TotalAV brand on Avira's engine. |
| Independent | Bitdefender, ESET, Kaspersky, Malwarebytes, McAfee, Trend Micro, Sophos, G Data, F-Secure | No consumer-antivirus parent above them, though several license their engine to others. |
Which product runs whose engine
The table below is the part worth bookmarking. "Licensed" means AV-Comparatives lists that product as running a third-party engine — the lab's own vendor list is the source, not vendor marketing.
Two clusters dominate. Avast's engine powers Norton and AVG in addition to Avast itself, which means Gen Digital's four brands rest on two engines between them. Bitdefender's engine is the most widely licensed in the consumer market: VIPRE, G Data, Emsisoft, Total Defense and Tencent all build on it.
| Brand | Detection engine | Owner |
|---|---|---|
| Avast | Own engine (Czech Republic) | Gen Digital |
| AVG | Avast (licensed) | Gen Digital |
| Norton | Avast (licensed) | Gen Digital |
| Avira | Own engine (Germany) | Gen Digital |
| Bitdefender | Own engine (Romania) | Independent |
| ESET | Own engine (Slovakia) | Independent |
| Kaspersky | Own engine (Russia) | Independent |
| Malwarebytes | Own engine (USA) | Independent |
| Microsoft Defender | Own engine (USA) | Microsoft |
| Sophos | Own engine (UK) | Independent |
| Webroot | Own engine (USA) | OpenText |
| McAfee | Own engine (USA) | Independent |
| Trend Micro | Own engine (Japan) | Independent |
| Panda | Own engine (Spain) | WatchGuard |
| TotalAV | Avira (licensed) | Protected.net |
| F-Secure | Avira (licensed) | Independent |
| VIPRE | Bitdefender (licensed) | Ziff Davis |
| G Data | Bitdefender (licensed) | Independent |
| Emsisoft | Bitdefender (licensed) | Independent |
| Total Defense | Bitdefender (licensed) | Independent |
| Tencent | Bitdefender (licensed) | Tencent |
| ZoneAlarm | Sophos (licensed) | Check Point |
| Quick Heal | Sophos (licensed) | Independent |
Engine column follows the “third party engine” designation in AV-Comparatives' consumer vendor list. Download the map as CSV (CC BY 4.0 — please cite and link this page).
What a shared engine does and doesn't mean
A shared engine is a floor, not a verdict. Products on the same core still differ in web filtering, behaviour rules, cloud reputation, default settings, update cadence and how aggressively they flag clean software — and the labs test each one separately.
The clearest illustration sits inside one company. Avast and AVG post identical current results, because they ship near-identical products with different interfaces. TotalAV and F-Secure both license Avira's engine and do not score alike. Same engine, different outcomes, because everything wrapped around the engine is also part of the product.
What the map does settle is where you shouldn't expect a difference. Choosing between Avast and AVG on detection grounds is choosing between two spellings of the same thing.
How to use this when you buy
Pick a genuine second opinion. An on-demand scanner is only a second opinion if it disagrees with the first. Pair a Bitdefender-based product with Microsoft, Kaspersky or Malwarebytes — not with G Data, VIPRE or Emsisoft, which share Bitdefender's detection logic.
Check the parent before switching on trust. Leaving Avast over its Jumpshot history and landing on AVG or Avira keeps you inside the same corporate group. Leaving over the US Kaspersky prohibition and landing on a licensee doesn't change the engine's origin either.
Don't pay a premium for a re-badged engine without a reason. Licensing is legitimate and often produces a better product — G Data and Emsisoft add their own layers on top. Just know what you're paying for: the wrapper, the support and the terms, not a different detector.
Re-check before quoting this. Licensing deals end and companies get bought. Every row here reflects the sources on August 5, 2026; the AV-Comparatives vendor list is the fastest place to confirm a row before you rely on it.
Frequently asked questions
Which antivirus companies are owned by the same parent?
Gen Digital owns Norton, Avast, AVG and Avira — four brands that many buyers compare against each other as if they were rivals. It also owns LifeLock and CCleaner. Everything else in our map answers to a different owner: Bitdefender, ESET, Kaspersky, Malwarebytes and McAfee are independent, Microsoft Defender is Microsoft's, Webroot belongs to OpenText, Panda to WatchGuard, VIPRE to Ziff Davis and ZoneAlarm to Check Point.
Do Norton and Avast use the same antivirus engine?
Yes. AV-Comparatives lists both Norton and AVG as running Avast's engine, and all three brands belong to Gen Digital. That does not make the subscriptions interchangeable — pricing, VPN, backup, identity services, support and renewal terms differ sharply — but it does mean you can stop shopping for a better detection engine between them.
Whose engine does TotalAV use?
Avira's. TotalAV is operated by Protected.net and licenses Avira technology, which is itself now a Gen Digital brand. F-Secure licenses the same engine. This is why TotalAV can post strong lab scores while remaining a very different purchase from Avira's own product on price and renewal terms.
How many products run on Bitdefender's engine?
Five in our map: VIPRE, G Data, Emsisoft, Total Defense and Tencent all license Bitdefender technology, alongside Bitdefender's own consumer suite. That makes Bitdefender the most widely licensed engine in the consumer market, which is worth knowing when a 'second opinion' scanner turns out to share the first opinion's detection logic.
Does a shared engine mean identical protection?
No, and the labs prove it. Products built on the same engine still differ in web filtering, behaviour rules, cloud reputation, default configuration and update cadence, and they are tested separately. Avast and AVG happen to post identical current results because they ship near-identical products; TotalAV and F-Secure share Avira's engine and do not score alike.
Why does engine licensing matter when I buy?
Two practical reasons. First, running two products that share an engine gives you far less of a second opinion than you think — pair a Bitdefender-based product with a Microsoft, Kaspersky or Malwarebytes scanner instead. Second, if you are switching brands because you distrust a vendor's ownership or privacy record, check the map: the alternative may answer to the same parent company.
Bottom line
Fifteen of the twenty-three consumer products in our map run their own detection engine. The other eight license one — mostly Bitdefender's, some Avast's, some Avira's, two Sophos's. And four of the biggest names answer to a single owner.
None of that makes any of these products bad, and none of it replaces the lab results on each product's own review. It just means the shelf has fewer independent choices than the logos imply, and the differences that remain live in price, features, false alarms and renewal terms — which is exactly where our reviews and comparisons put them.
Per-product evidence lives in our antivirus reviews; head-to-head decisions in our comparison library; renewal pricing in the Renewal Price Report.