Key findings
- ESET was the lightest conventional suite in our Windows table.
- Webroot was lightest overall, but not directly comparable because of its cloud-offload architecture.
- Microsoft Defender landed mid-pack — lighter than about half the paid suites.
- Norton and ZoneAlarm were among the heavier products by idle and boot impact.
- Raw footprint does not equal real-world task latency — read AV-Comparatives results alongside this dataset.
The data: 24 Windows products (main ranking)
Main ranking — 24 Windows productsEvery figure is reproduced 1:1 from that product’s own hands-on review on this site, measured on the same laptop against a fixed ~280 GB full-scan set. Ranges, not point values — see Methodology.
| # | Product | Idle RAM, MB | Scan CPU peak | Full scan, min | Boot delta, s |
|---|---|---|---|---|---|
| 1 | Webroot SecureAnywhere | <10 | cloud-offload | <5 | ~0 (in noise) |
| 2 | Spybot Search & Destroy | 40–70 | 18–25% | 14 | ~2 |
| 3 | Zemana AntiMalware | 45–70 | 18–25% | 11 | 2–3 |
| 4 | HitmanPro (on-demand) | 45–70 | on-demand | 11 | n/a |
| 5 | PC Matic | 70–110 | 30–40% | 42 | 3–5 |
| 6 | Malwarebytes | 80–130 | — | n/a (Threat Scan)† | 1–2 |
| 7 | Panda Dome | 90–130 | 28–38% | 22 | 2–4 |
| 8 | ESET HOME | 95–120 | 8–22% | 18 | <2 |
| 9 | Microsoft Defender | 95–180 | 28–38% | 21 | 1–2 |
| 10 | Bitdefender Total Security | 110–140 | 20–35% | 23 | 2–3 |
| 11 | Avast (Free/Premium) | 110–140 | 25–35% | 21 | 2–3 |
| 12 | VIPRE | 130–160 | 28–38% | 22 | 3–5 |
| 13 | Avira | 130–170 | 35–50% | 28 | 3–5 |
| 14 | Trend Micro | 130–170 | 40–55% | 32 | 3–5 |
| 15 | Scanguard | 135–170 | 28–38% | 23 | 3–5 |
| 16 | AVG Internet Security | 140–180 | 28–38% | 21 | 3–4 |
| 17 | McAfee+ | 140–180 | 30–40% | 26 | 3–5 |
| 18 | Emsisoft | 140–170 | 28–40% | 14 | 2–3 |
| 19 | Sophos Home | 140–180 | 15–20% | 38 | 3–5 |
| 20 | TotalAV | 140–175 | 28–38% | 22 | 3–5 |
| 21 | PC Protect | 140–175 | 28–38% | 22 | 3–5 |
| 22 | Kaspersky | 145–185 | 28–38% | 22 | 2–3 |
| 23 | Norton 360 Deluxe | 180–220 | 35–45% | 24 | 4–6 |
| 24 | ZoneAlarm | 180–240 | 40–55% | 32 | 8–12 (largest boot delta) |
† Malwarebytes Premium runs a targeted Threat Scan (~9 min), not a full-disk scan — listed n/a rather than ranked against full-disk times it can’t be compared to.
↓ Download the full dataset (CSV)Idle RAM, lightest to heaviest
Full-disk scan time, fastest to slowest
Six things the numbers show
- The lightest conventional suite of 2026 is ESET — 95–120 MB idle, single-digit-to-22% scan CPU, an 18-minute full scan, sub-2-second boot impact. Webroot is lighter still, but it’s an architectural outlier (cloud-offload agent, <10 MB on disk).
- “Free = bloated” is dead: Microsoft Defender sits mid-pack (95–180 MB, 21-minute scan) — lighter than roughly half the paid suites we measured.
- Raw footprint ≠ real-world slowdown. Sophos Home shows one of the lowest scan-CPU peaks we logged (15–20%) — yet Sophos had the highest Total Impact Score among the 20 consumer products tested by AV-Comparatives in April 2026.
- The boot-time tax ranges 0–12 seconds. The top tier (Bitdefender, ESET, Kaspersky, Avast, Defender) added ≤3 s; ZoneAlarm showed the largest boot delta at 8–12 s. Norton 360 Deluxe had one of the heavier idle footprints (180–220 MB) among the major paid suites.
- Platform siblings benchmark like siblings. TotalAV, PC Protect and Scanguard cluster within a few MB; Avast and AVG (shared engine) share a near-identical scan profile.
- Full-disk scan time spans under 5 to 42 minutes in the main 24-product table — Webroot finishes in under 5 minutes, while PC Matic reaches 42 minutes. (Among the additional products measured outside the main ranking, 360 Total Security reached 52 minutes with the optional Bitdefender engine enabled.)
Additional products measured (not ranked)
Not ranked — older / regional / on-demand / multi-engineLogged on the same rig but kept out of the main ranking to keep it like-for-like.
| Product | Idle RAM, MB | Scan CPU peak | Full scan, min | Boot delta, s |
|---|---|---|---|---|
| Adaware | 140–180 | — | 32 | 6–9 |
| Comodo | 220–280 | 40–55% | 32 | — |
| 360 Total Security | 220–290 | 30–40% / 45–55%² | 28 / 52² | 6–9 |
² 360 TS: first figure = native QVM II + Cloud engines; second = with the optional Bitdefender engine toggled on.
macOS (separate rig)
Separate rig — macOS, not comparable to Windows rows| Product | Idle RAM, MB | Scan CPU peak | Full scan, min | Boot delta, s |
|---|---|---|---|---|
| Intego | 95–130 | — | 11 (180 GB) | 1–2 (Apple Silicon) |
| MacKeeper | 180–240 | 45–55% | 9 (320 GB) | — |
How we measured
Every product was installed and run on the same physical laptop: Intel Core i5-12450H, 16 GB DDR5, NVMe SSD, Windows 10 22H2 (cross-checked on Windows 11 24H2), on mains power, wired Ethernet, balanced power plan.
- Idle RAM = sum of the product’s background processes’ working-set memory (Task Manager / Resource Monitor), read after ~5 minutes idle post-boot.
- Scan CPU peak = highest sustained CPU during a first full system scan of a fixed ~280 GB set (macOS: 180–320 GB).
- Full scan, min = wall-clock time for that first full scan.
- Boot delta = time-to-usable-desktop with the product active vs a clean baseline image.
- Ranges, not point values: consumer hardware introduces run-to-run variance; we report the band we observed.
What this is: editorial hands-on measurement, indicative of real-world behaviour on a typical mid-range laptop. What this is not: a controlled lab benchmark — independent labs revert to a clean disk image between products and take multiple repeated runs with median values. Our single-rig ranges complement that work; they don’t replace it. Community reports were used only as a sanity check, not as a source for the published measurements.
Limitations
- Single physical laptop, not multiple rigs.
- First full scan only — not steady-state or repeat-scan behaviour.
- Vendor cloud behaviour can shift scan time and CPU run-to-run.
- Boot delta is approximate (time-to-usable-desktop).
- On-demand tools (e.g. HitmanPro) are not directly comparable with full security suites.
- Webroot’s cloud-offload architecture is not directly comparable with conventional suites.
- Malwarebytes’ Threat Scan is not ranked as a full-disk scan.
- macOS rows are a separate rig and not comparable to Windows rows.
- Snapshot in time (June 2026) — products update engines and footprints.
What this data is — and isn’t — for
How our numbers compare to independent labs
We measure footprint (RAM, scan CPU, scan time, boot). Independent labs measure task latency — how much a product slows everyday actions like copying files, installing apps and browsing. The two correlate loosely. A few takeaways from AV-Comparatives’ Performance Test, April 2026 (20 consumer products, Windows 11):
- The test ranks task impact, not raw footprint.
- Sophos carried the highest total impact score of the 20 products tested.
- Several mainstream suites we rate well on footprint (Kaspersky, ESET, McAfee) also placed among the lighter products.
Lab comparison refers to the exact AV-Comparatives-tested product/version where available; suite names may differ from our reviewed retail package (they test Norton Antivirus Plus / Avast Free / AVG Free / McAfee Total Protection; our table covers Norton 360 Deluxe / Avast & AVG paid tiers / McAfee+). We link to and summarise their findings; we do not reproduce their results table.
How to cite this report
The dataset is free to reuse with attribution. ↓ Download CSV
Frequently asked questions
Which antivirus uses the least RAM in 2026?
Webroot (<10 MB, cloud architecture); among conventional full suites, ESET (95–120 MB).
Does antivirus still slow down computers in 2026?
Top-tier suites add ≤3 s to boot and are hard to notice on modern hardware; the tail is real — 8–12 s boot (ZoneAlarm), 40-minute-plus scans (PC Matic in the main table; 360 Total Security among the additional products measured).
Is Windows Defender lighter than paid antivirus?
It’s mid-pack — lighter than about half the paid suites we measured, heavier than the lightest (ESET, Webroot). More in our Microsoft Defender review.
Why does Sophos look light in your table but heavy at AV-Comparatives?
Different things measured: our table shows scan-CPU footprint; AV-Comparatives measures task latency, where Sophos carried the highest impact score of 20 products in April 2026.
What hardware did you test on?
One Intel i5-12450H / 16 GB / NVMe laptop (Windows 10 22H2, cross-checked Windows 11 24H2); a separate M2 MacBook for the macOS rows. June 2026.
Can I reuse this data?
Yes — with attribution and a link back (see How to cite). The CSV is free to download.
Report version
Version 1.0 — June 2026 (initial release). This first edition includes:
- 24-product Windows ranking measured on one fixed rig, plus an appendix of additional products and a separate macOS table;
- idle-RAM and full-scan-time charts;
- a downloadable CSV dataset (main ranking + additional + macOS rows);
- methodology and a limitations section;
- a comparison with AV-Comparatives’ April 2026 task-latency test.
We re-measure products on review refreshes; dated, itemised changes to this dataset will be appended here in future revisions.
Related guides
Pairing protection with footprint: best antivirus for Windows 10, Windows 11, best free antivirus, and how we test.
Press & citation resources: citing this report or reusing the data? See our Press & Data page for citation rules, the dataset license and downloadable media assets.