We’re sorry, your browser appears to be outdated.
To see the content of this webpage correctly, please update to the latest version or install a new browser for free, such as Avast Secure Browser or Google Chrome.

Not sure which solution is right for your business?
Data sheet

Behavior Shield

Our patented Behavior Shield technology, available in every tier of Avast Business Antivirus, plays a critical role in our Web, File, Email and Behavior four-shield security defense. Behavior Shield is designed to detect and stop any suspicious behavior in PCs that may indicate the presence of deeply entrenched malicious code and computer infections.

Monitors unusual behaviors in real-time
Analyzes the behavior of all PC processes, file system and registry access, and intracommunication in real-time for unusual activity.
Blocks all suspicious activity fast
Detects and stops malicious code, based on its behavior similarity to other known threats, from executing within PCs and compromising networks.
Detects ransomware and other zero-second threats
Detects zero-second threats and is especially powerful against new ransomware strains. Although ransomware samples evolve and morph rapidly, they exhibit specific behaviors that Behavior Shield is capable of detecting and stopping.

The competitive advantage

Behavior Shield earned a patent for its early innovation. It was introduced at a time when the majority of threat analysis relied on static file attributes rather than studying characteristics based on the behavior of PC processes, and file system and registry access. Behavior Shield was also critical in helping our Avast Threat Lab detect and stop WannaCry ransomware for more than 1 million customers in 150 countries worldwide.

Let’s take a closer look at Behavior Shield.

Let’s take a closer look at Behavior Shield.

Behavior Shield looks for suspicious behavior in processes, files, and applications installed and running on PCs and monitors them continuously in real-time. This includes any activity that isn’t normal behavior for processes and software on a PC – for example, a password capture program trying to install and capture keystrokes, a PDF trying to download something from the web, or even a calculator app trying to delete photos. It is designed to detect and stop the presence of malicious code or infections that could be deep inside a PC and getting ready to execute malware.

How does Behavior Shield work?

Behavior Shield’s patented technology works in conjunction with Avast’s real-time cloud intelligence to detect any characteristics that are similar to other known threats. Threats, often in the form of malware, will attempt to save and execute something on a local device to obtain information. For example, if a threat tries to install JavaScript to a PC, Behavior Shield will stop this action by first looking at its intention. It will then block it, even if the threat has not yet been added to the virus definitions database.

How does Sandbox work?

Sandbox can be used anytime, for any situation, to safely examine a file or code, while keeping it isolated from a PC and the company network.

What happens if Behavior Shield finds suspicious behavior?

If Behavior Shield notices unusual behavior, it will block the action. Once it blocks the action, Behavior Shield reports the behavior to the user and to our Avast Threat Lab for analysis.

What is the difference between our Behavior Shield and CyberCapture technology?

Where CyberCapture is designed to trap unknown threats before they can be unleashed, Behavior Shield is designed to actively monitor how a PC behaves to detect and stop existing malicious code that could be deeply entrenched within a PC.

Why is Behavior Shield unique?

Behavior Shield was patented for its detection innovation. It can not only detect malicious code before it executes within a PC, the technology can also expose unknown samples of malware – ransomware and other zero-second attacks – by looking at the behavior of the code before it executes. It then blocks and stops the threat.

Avast threat protection at work

Our hundreds of millions of users provide a continual stream of data that helps us quickly identify and destroy any threat – and predict future ones. Day and night, our immense cloudbased, machine-learning engine is evolving and learning, making our solutions smarter, faster, and growing more powerful by the second.

  • 1.5 billion malware attacks blocked monthly
  • 300 million new files checked monthly
  • 200 billion URLs checked monthly
  • 30 million executable files analyzed
  • 500 million visits to malicious websites blocked
  • 128 million ransomware attacks blocked last year

Behavior Shield FAQ Data Sheet


Almost done!

Complete installation by clicking your downloaded file below and following the instructions.

Initiating download...
Note: If your download did not start automatically, please click here.
Click this file to start installing Avast.
Click this file to start installing Avast