Security guides
Four longer explainers, each about a mechanism rather than a product. They are written to be read in any order, and none of them requires you to buy anything.
How detection engines decide
What actually happens between a file appearing on your disk and a verdict: signatures, static heuristics, behavioural rules, cloud reputation and the sandbox — and why false positives are the hard part.
Ransomware: what actually helps
The stages of an incident, where each defence gets its chance, and the uncomfortable fact that backups matter more than detection once encryption has started.
Phishing and social engineering
Six checkable signals in a fraudulent message, why urgency is the payload, and what to do after you have clicked something you should not have.
Passwords and two-factor authentication
What password entropy really measures, why a manager beats a memorable rule, and which second factors resist phishing rather than merely adding a step.
How these are written
Each guide is written by Isla Ward, carries a publication date, links to primary or independent sources rather than to secondary coverage, and hedges anything we could not verify. Every diagram is an original SVG drawn for the page it appears on. The standards we hold ourselves to — and the things we refuse to publish — are set out in the editorial policy.
The guides carry advertising, disclosed at the top of each page and beside every commercial link. See the affiliate disclosure.
Start with the main article
If you are choosing a security product rather than trying to understand one, the main article on how antivirus software works covers the whole category, including a platform matrix showing what such software can and cannot do on Windows, macOS, Android and iOS.