ByNeil J. Rubenking
Many security vendors build their security suites by starting with the standalone antivirus and adding firewall, spam filtering, parental control, and other such useful components. Webroot SecureAnywhere Internet Security Plus is indeed based on Webroot's excellent antivirus, but it's a bit different.
For starters, firewall protection is already included at the standard antivirus level.
And Webroot doesn't bother with spam filtering or parental control. Rather, this suite adds password management and Android protection.
As long as you're among the many who don't need antispam and parental control, this can be a very good security suite. A single license for this product costs $49.99 per year; you get a three-license pack for $59.99. You can use each license to install protection on a PC, a Mac, or an Android device. Note that the Android product costs just $4.99 per year as a standalone, so using your licenses for PC or Mac protection may be more cost-effective. The suite's main window is identical to that of the standalone antivirus.
There isn't even a different window title.
Both just say "Webroot SecureAnywhere." You don't see a difference until you click the Password Manager button.
If you've installed the suite, you'll see two buttons, Start Now and Learn More.
In the antivirus, you just see Learn More.
Click Learn More and you learn that to get password management you must upgrade from antivirus to suite. Shared AntivirusWebroot SecureAnywhere AntiVirus is an Editors' Choice for commercial antivirus.
All of the same components and capabilities are found in this suite. Please read my review of the antivirus if you'd like more detail than found in the summary that follows. Webroot uses a cloud-based detection system that's different from that of most of its competitors.
It leaves known good programs alone and wipes out known bad programs.
If it encounters a suspicious unknown program, it puts a hold on any irreversible actions such as transmitting private data, and it journals all actions taken by the program. Meanwhile, automated systems and human experts back at Webroot HQ put the unknown program under the microscope.
If the verdict is guilty, your local Webroot utility terminates the program and reverses its journaled actions. When a new, unknown program requires human analysis, the investigation can take 45 to 90 minutes, according to my Webroot contact.
That makes Webroot incompatible with most standard antivirus lab tests.
I don't have anything to report from the six labs I usually follow. However, Webroot has done very well in tests by London-based MRG-Effitas. A Webroot scan takes just a few minutes.
If it finds and removes malware, it runs another scan to be sure all is well.
In my malware-blocking test, Webroot went through several rounds of scanning and wiped out all of my malware samples for 100 percent detection and a perfect score of 10 points.
Avira Antivirus Pro 2016, the only other product tested with the same new sample set, managed 94 percent detection but earned only 8.5 points due to incomplete blocking of some samples. In my hands-on malicious URL blocking test, Webroot prevented all access to 38 percent of the sample URLs and eliminated another 46 percent during the download process, for a total of 84 percent protection, the same as Lavasoft Ad-Aware Total Security 11, ESET Smart Security 9, and several others. Only a handful of products have done better.
Avira holds the top score: 99 percent protection. Webroot also proved quite effective at steering the browser away from fraudulent sites that attempt to steal login credentials, also known as phishing sites.
I use Symantec Norton Security Premium as a touchstone in this test, as it does better than almost every competitor. Webroot and Bitdefender Internet Security 2016 are the only recent products that have beaten Norton. See How We Test Malware Blocking See How We Test Antiphishing More Shared Features This suite includes the same firewall protection found in the antivirus.
It's a bit different from the norm. Webroot relies on Windows Firewall to handle stealthing ports and blocking attacks from the outside, because it handles those tasks just fine. Like Norton, Webroot allows all network access by known good programs, destroys known bad programs, and monitors unknowns. By default, Webroot warns the user of network access attempts by unknown programs only when the system is infected, meaning that Webroot has detected malware but has not finished removing it.
At that point, it asks the user whether to block access, allow access just once, or always allow it. You can tweak the settings so Webroot always warns you when an untrusted program attempts network access. Of course, if you do so you'll see more of those pop-up warnings. The suite and the standalone antivirus share a large collection of advanced features, though most users should leave these alone unless instructed otherwise by tech support. You can create logs for analysis by support, run special cleanup scripts supplied by support agents, and reverse some common malware-caused system changes. Other advanced features include the ability to manually remove malware, set Webroot to block a specific program, and easily reboot into Safe Mode.
There's even a sandbox feature that allows tech experts to run unknown programs under specific restrictions that keep them from doing permanent harm to the system. Familiar Password Manager If you know LastPass, you'll recognize Webroot's password manager, since it's a licensed and rebranded version of LastPass. Note that this is not parallel to the current LastPass 4.0 Premium. Rather, it corresponds to version 3.2.
That means you won't get features added in version 4, such as password inheritance and shared password folders, and you won't see anything like version 4's updated user interface. Webroot doesn't include every single feature from the version of LastPass that it does support.
It doesn't attempt application password management, two-factor authentication, or password sharing. You can't create secure notes, or define multiple identities within the program.
And it doesn't offer the impressive Security Challenge report that helps LastPass users improve their password security. Webroot's equivalent to the LastPass Vault is reached by logging in to your Webroot account online.
The login process is a bit more complex than simply entering a password, though it's not precisely two-factor.
In addition to the password, you define a six-digit PIN. Once you've entered the password, the site asks for two specific digits out of that PIN, a different pair each time, so as to foil any kind of key-logging attack. Though Webroot lacks some of LastPass's features, it's still packed with capabilities.
It captures credentials as you log in and replays them when you revisit a site. You can name sites and put them in folders at capture time, or organize them later.
If you like, you can create a tree of folders and subfolders. When you click the browser toolbar button, these become a set of menus and submenus holding your saved sites.
Select one and Webroot both navigates there and logs you in. Websites that use a nonstandard login form baffle some password managers. Webroot handles these sites by letting you manually capture data from all fields of the form. Just fill in your username, password, Erdos number, or whatever other information is required.
Then click the browser toolbar button and choose Tools, then select Save All Entered Data. A powerful password generator lets you create a random, unique password when signing up for a new site or updating an old, weak password. You can import passwords from almost two dozen competing products, among them Dashlane 4 and RoboForm Everywhere 7, or import a generic CSV file. Like many password managers, Webroot can fill Web forms with your saved information. You can create multiple profiles, each of which can contain personal data, contact data, one credit card, one bank account, and any custom fields that you need. You can also add any number of credit cards separately. When Webroot detects a fillable form, it offers a menu that lets you choose a profile to fill the form, or choose a profile and a credit card. Note that if you try to fill personal information on a page that's not secure, Webroot will warn you there's a problem. I ran into one oddity in testing. While the form-filling feature worked fine in Chrome and Firefox, it just didn't work in Internet Explorer. My Webroot contacts confirmed that this is a known problem as of a few weeks ago, and will be fixed in an upcoming build.
Also, the dialog box to create or edit a profile has an extremely dated look.
I was especially surprised to find a dropdown list of months containing month1, month2, and so forth, rather than the actual month names or numbers. The password manager feature does its job, although it looks dated overall. While it's based on LastPass, it doesn't have all the features of LastPass.
For two bucks more than this product's price, you could buy both the standalone Webroot antivirus and the latest, greatest version of LastPass Premium.
If you don't use any Android devices, it might be worth considering. Mobile SupportAnyone can use Webroot's free mobile security product for Android, but your suite subscription lets you install the paid edition, Webroot SecureAnywhere Mobile Premier.
This is a full-scale mobile security tool, with antivirus, antitheft, app analysis, and more. To get started, you go to the Play store and install the free Webroot Mobile Security. Once it's installed and ready, you activate premium features using the keycode that use used to install the suite on your PC. The installer also directs you to install Webroot's SecureWeb browser. At the time of this test, Webroot was in the process of updating apps in the Google Play store, so I had to enable installation from unknown sources in order to get SecureWeb loaded; that should be fixed soon.
To complete the installation you enable various components and configuration settings. The antivirus component requests a full scan at installation and automatically runs a full scan every week.
It scans new apps, scans any downloaded files, and scans apps at launch. Of course, you can manually request a full scan any time. You manage anti-theft features through the online console.
If you've mislaid your device around the house, you can log in and select Scream.
Be warned, the sound it makes literally sounds like someone screaming.
If you suspect the device has been stolen, you can lock it remotely, or lock it and add a custom message. You can query its location, which also locks it.
And if all else fails, you can remotely wipe it. When you choose to lock or locate the device, or make it scream, you define a temporary PIN of four to 16 digits.
If you recover the device, you'll have to enter that PIN to unlock it. The useful App Inspector flags apps that can access your messages, cost you more money, access sensitive information, track your location, or drain your battery.
Initially it just shows how many apps match each category.
Tapping a category gets a full list, and tapping any app takes you to the Android uninstall page for that app.
There's also a battery monitor to identify battery-hog apps, and a somewhat geeky network monitor. When you use the SecureWeb browser, you get the same kind of protection against malware-hosting URLs and phishing sites that the Windows-based browser add-ons offer.
It's also your entrée to the password manager. Note that even when you've logged in with your master password, password management isn't quite as automatic as the Windows version.
To start, it doesn't capture logins, just plays them back. You have to navigate to a secure site, choose Vault from the menu, and then choose AutoFill. You fill forms in much the same way. When you access the Vault itself on Android, you just get an alphabetical list of saved sites, without any categories. You can tap an item to visit the site (after which you'll use AutoFill as above) or view the site details.
But there's no ability to edit the items the way you can in Windows.
I checked with Mobile Security Analyst Max Eddy that LastPass (for Android) has virtually all the same features as LastPass on a PC, including the ability to create and edit new logins, securely share passwords, and leave your passwords to an inheritor in the event of your demise. Webroot does support iOS as well, to a small degree.
Specifically, you can install the free SecureWeb app on your iOS devices and thereby get protection against bad sites and access to Webroot's password manager. Zero Performance HitWith its minuscule installer and tiny presence on disk, Webroot has always done very well in my hands-on performance tests. When I last tested it, the average of its performance impact in my three tests came out to 1 percent. Those three tests measure boot time, the time to move and copy a large collection of files, and the time to zip and unzip that same collection.
For each test, I run a number of repetitions with no suite installed, and average that as a baseline.
After installing the suite, I again average the results from a number of repetitions and compare the results. This time around, Webroot did even better.
It didn't display any appreciable slowdown in any of the tests.
In fact, the boot time test average with Webroot in place was actually smaller than with no suite.
Go figure! The main point is, this suite will not slow you down. See How We Test Security Suites for Performance Great Antivirus, but… Webroot SecureAnywhere Internet Security Plus has all the top-notch features that make Webroot SecureAnywhere Antivirus an Editor's Choice, and it adds a password manager and Android support.
The password manager is based on LastPass, but lacks many features found in LastPass itself.
And of course, this suite is only suited to users who don't require spam filtering or parental control. If you're looking for a full-featured security suite, our Editors' Choice products are Bitdefender Internet Security 2016 and Kaspersky Internet Security (2016).
If you need to protect a ton of devices, you'll like the unlimited licenses of McAfee LiveSafe (2016), or the 10 licenses plus online backup offered by Symantec Norton Security Premium, which are also top picks. Sub-Ratings:Note: These sub-ratings contribute to a product's overall star rating, as do other factors, including ease of use in real-world testing, bonus features, and overall integration of features.Firewall: Antivirus: Performance: Antispam: n/aPrivacy: Parental Control: n/a
For starters, firewall protection is already included at the standard antivirus level.
And Webroot doesn't bother with spam filtering or parental control. Rather, this suite adds password management and Android protection.
As long as you're among the many who don't need antispam and parental control, this can be a very good security suite. A single license for this product costs $49.99 per year; you get a three-license pack for $59.99. You can use each license to install protection on a PC, a Mac, or an Android device. Note that the Android product costs just $4.99 per year as a standalone, so using your licenses for PC or Mac protection may be more cost-effective. The suite's main window is identical to that of the standalone antivirus.
There isn't even a different window title.
Both just say "Webroot SecureAnywhere." You don't see a difference until you click the Password Manager button.
If you've installed the suite, you'll see two buttons, Start Now and Learn More.
In the antivirus, you just see Learn More.
Click Learn More and you learn that to get password management you must upgrade from antivirus to suite. Shared AntivirusWebroot SecureAnywhere AntiVirus is an Editors' Choice for commercial antivirus.
All of the same components and capabilities are found in this suite. Please read my review of the antivirus if you'd like more detail than found in the summary that follows. Webroot uses a cloud-based detection system that's different from that of most of its competitors.
It leaves known good programs alone and wipes out known bad programs.
If it encounters a suspicious unknown program, it puts a hold on any irreversible actions such as transmitting private data, and it journals all actions taken by the program. Meanwhile, automated systems and human experts back at Webroot HQ put the unknown program under the microscope.
If the verdict is guilty, your local Webroot utility terminates the program and reverses its journaled actions. When a new, unknown program requires human analysis, the investigation can take 45 to 90 minutes, according to my Webroot contact.
That makes Webroot incompatible with most standard antivirus lab tests.
I don't have anything to report from the six labs I usually follow. However, Webroot has done very well in tests by London-based MRG-Effitas. A Webroot scan takes just a few minutes.
If it finds and removes malware, it runs another scan to be sure all is well.
In my malware-blocking test, Webroot went through several rounds of scanning and wiped out all of my malware samples for 100 percent detection and a perfect score of 10 points.
Avira Antivirus Pro 2016, the only other product tested with the same new sample set, managed 94 percent detection but earned only 8.5 points due to incomplete blocking of some samples. In my hands-on malicious URL blocking test, Webroot prevented all access to 38 percent of the sample URLs and eliminated another 46 percent during the download process, for a total of 84 percent protection, the same as Lavasoft Ad-Aware Total Security 11, ESET Smart Security 9, and several others. Only a handful of products have done better.
Avira holds the top score: 99 percent protection. Webroot also proved quite effective at steering the browser away from fraudulent sites that attempt to steal login credentials, also known as phishing sites.
I use Symantec Norton Security Premium as a touchstone in this test, as it does better than almost every competitor. Webroot and Bitdefender Internet Security 2016 are the only recent products that have beaten Norton. See How We Test Malware Blocking See How We Test Antiphishing More Shared Features This suite includes the same firewall protection found in the antivirus.
It's a bit different from the norm. Webroot relies on Windows Firewall to handle stealthing ports and blocking attacks from the outside, because it handles those tasks just fine. Like Norton, Webroot allows all network access by known good programs, destroys known bad programs, and monitors unknowns. By default, Webroot warns the user of network access attempts by unknown programs only when the system is infected, meaning that Webroot has detected malware but has not finished removing it.
At that point, it asks the user whether to block access, allow access just once, or always allow it. You can tweak the settings so Webroot always warns you when an untrusted program attempts network access. Of course, if you do so you'll see more of those pop-up warnings. The suite and the standalone antivirus share a large collection of advanced features, though most users should leave these alone unless instructed otherwise by tech support. You can create logs for analysis by support, run special cleanup scripts supplied by support agents, and reverse some common malware-caused system changes. Other advanced features include the ability to manually remove malware, set Webroot to block a specific program, and easily reboot into Safe Mode.
There's even a sandbox feature that allows tech experts to run unknown programs under specific restrictions that keep them from doing permanent harm to the system. Familiar Password Manager If you know LastPass, you'll recognize Webroot's password manager, since it's a licensed and rebranded version of LastPass. Note that this is not parallel to the current LastPass 4.0 Premium. Rather, it corresponds to version 3.2.
That means you won't get features added in version 4, such as password inheritance and shared password folders, and you won't see anything like version 4's updated user interface. Webroot doesn't include every single feature from the version of LastPass that it does support.
It doesn't attempt application password management, two-factor authentication, or password sharing. You can't create secure notes, or define multiple identities within the program.
And it doesn't offer the impressive Security Challenge report that helps LastPass users improve their password security. Webroot's equivalent to the LastPass Vault is reached by logging in to your Webroot account online.
The login process is a bit more complex than simply entering a password, though it's not precisely two-factor.
In addition to the password, you define a six-digit PIN. Once you've entered the password, the site asks for two specific digits out of that PIN, a different pair each time, so as to foil any kind of key-logging attack. Though Webroot lacks some of LastPass's features, it's still packed with capabilities.
It captures credentials as you log in and replays them when you revisit a site. You can name sites and put them in folders at capture time, or organize them later.
If you like, you can create a tree of folders and subfolders. When you click the browser toolbar button, these become a set of menus and submenus holding your saved sites.
Select one and Webroot both navigates there and logs you in. Websites that use a nonstandard login form baffle some password managers. Webroot handles these sites by letting you manually capture data from all fields of the form. Just fill in your username, password, Erdos number, or whatever other information is required.
Then click the browser toolbar button and choose Tools, then select Save All Entered Data. A powerful password generator lets you create a random, unique password when signing up for a new site or updating an old, weak password. You can import passwords from almost two dozen competing products, among them Dashlane 4 and RoboForm Everywhere 7, or import a generic CSV file. Like many password managers, Webroot can fill Web forms with your saved information. You can create multiple profiles, each of which can contain personal data, contact data, one credit card, one bank account, and any custom fields that you need. You can also add any number of credit cards separately. When Webroot detects a fillable form, it offers a menu that lets you choose a profile to fill the form, or choose a profile and a credit card. Note that if you try to fill personal information on a page that's not secure, Webroot will warn you there's a problem. I ran into one oddity in testing. While the form-filling feature worked fine in Chrome and Firefox, it just didn't work in Internet Explorer. My Webroot contacts confirmed that this is a known problem as of a few weeks ago, and will be fixed in an upcoming build.
Also, the dialog box to create or edit a profile has an extremely dated look.
I was especially surprised to find a dropdown list of months containing month1, month2, and so forth, rather than the actual month names or numbers. The password manager feature does its job, although it looks dated overall. While it's based on LastPass, it doesn't have all the features of LastPass.
For two bucks more than this product's price, you could buy both the standalone Webroot antivirus and the latest, greatest version of LastPass Premium.
If you don't use any Android devices, it might be worth considering. Mobile SupportAnyone can use Webroot's free mobile security product for Android, but your suite subscription lets you install the paid edition, Webroot SecureAnywhere Mobile Premier.
This is a full-scale mobile security tool, with antivirus, antitheft, app analysis, and more. To get started, you go to the Play store and install the free Webroot Mobile Security. Once it's installed and ready, you activate premium features using the keycode that use used to install the suite on your PC. The installer also directs you to install Webroot's SecureWeb browser. At the time of this test, Webroot was in the process of updating apps in the Google Play store, so I had to enable installation from unknown sources in order to get SecureWeb loaded; that should be fixed soon.
To complete the installation you enable various components and configuration settings. The antivirus component requests a full scan at installation and automatically runs a full scan every week.
It scans new apps, scans any downloaded files, and scans apps at launch. Of course, you can manually request a full scan any time. You manage anti-theft features through the online console.
If you've mislaid your device around the house, you can log in and select Scream.
Be warned, the sound it makes literally sounds like someone screaming.
If you suspect the device has been stolen, you can lock it remotely, or lock it and add a custom message. You can query its location, which also locks it.
And if all else fails, you can remotely wipe it. When you choose to lock or locate the device, or make it scream, you define a temporary PIN of four to 16 digits.
If you recover the device, you'll have to enter that PIN to unlock it. The useful App Inspector flags apps that can access your messages, cost you more money, access sensitive information, track your location, or drain your battery.
Initially it just shows how many apps match each category.
Tapping a category gets a full list, and tapping any app takes you to the Android uninstall page for that app.
There's also a battery monitor to identify battery-hog apps, and a somewhat geeky network monitor. When you use the SecureWeb browser, you get the same kind of protection against malware-hosting URLs and phishing sites that the Windows-based browser add-ons offer.
It's also your entrée to the password manager. Note that even when you've logged in with your master password, password management isn't quite as automatic as the Windows version.
To start, it doesn't capture logins, just plays them back. You have to navigate to a secure site, choose Vault from the menu, and then choose AutoFill. You fill forms in much the same way. When you access the Vault itself on Android, you just get an alphabetical list of saved sites, without any categories. You can tap an item to visit the site (after which you'll use AutoFill as above) or view the site details.
But there's no ability to edit the items the way you can in Windows.
I checked with Mobile Security Analyst Max Eddy that LastPass (for Android) has virtually all the same features as LastPass on a PC, including the ability to create and edit new logins, securely share passwords, and leave your passwords to an inheritor in the event of your demise. Webroot does support iOS as well, to a small degree.
Specifically, you can install the free SecureWeb app on your iOS devices and thereby get protection against bad sites and access to Webroot's password manager. Zero Performance HitWith its minuscule installer and tiny presence on disk, Webroot has always done very well in my hands-on performance tests. When I last tested it, the average of its performance impact in my three tests came out to 1 percent. Those three tests measure boot time, the time to move and copy a large collection of files, and the time to zip and unzip that same collection.
For each test, I run a number of repetitions with no suite installed, and average that as a baseline.
After installing the suite, I again average the results from a number of repetitions and compare the results. This time around, Webroot did even better.
It didn't display any appreciable slowdown in any of the tests.
In fact, the boot time test average with Webroot in place was actually smaller than with no suite.
Go figure! The main point is, this suite will not slow you down. See How We Test Security Suites for Performance Great Antivirus, but… Webroot SecureAnywhere Internet Security Plus has all the top-notch features that make Webroot SecureAnywhere Antivirus an Editor's Choice, and it adds a password manager and Android support.
The password manager is based on LastPass, but lacks many features found in LastPass itself.
And of course, this suite is only suited to users who don't require spam filtering or parental control. If you're looking for a full-featured security suite, our Editors' Choice products are Bitdefender Internet Security 2016 and Kaspersky Internet Security (2016).
If you need to protect a ton of devices, you'll like the unlimited licenses of McAfee LiveSafe (2016), or the 10 licenses plus online backup offered by Symantec Norton Security Premium, which are also top picks. Sub-Ratings:Note: These sub-ratings contribute to a product's overall star rating, as do other factors, including ease of use in real-world testing, bonus features, and overall integration of features.Firewall: Antivirus: Performance: Antispam: n/aPrivacy: Parental Control: n/a