Why was my question put on hold as opinion-based?

Question

The question in... question, is mine:

Is it sufficient to run MalwareBytes 3.0 as my sole antimalware/antivirus tool?

It was put on hold as primarily opinion-based. I don't believe this is the case, the question confidently satisfies almost every single one of the guidelines on constructive subjective questions in the Help Center:

I made it clear several times within the question that I was primarily looking for answers that cite empirical tests and data.

As I see it, there are a few possibilities here:

a) That data exists out there somewhere and hasn't yet been brought to popular attention. In this case, it'd be a massive shame to have closed the question prematurely as that's exactly the kind of content SU thrives on.

b) That data doesn't currently exist because no-one's yet conducted such tests or published such papers. In this case, it's still worth keeping the question open to allow it to attract such answers from future browsers of the site/search engine visitors, as its existence may be the catalyst for someone conducting those tests themselves. Closing it just because no-one can currently offer that data seems unfair and counter-productive.

c) The worst case scenario, where that data hasn't yet been conducted and never will be. Even in this scenario, the site's users are still able to respond to this question with their own experiences, and in the absence of empirical evidence, expert anecdotal evidence is the next best thing. These are experiences, not opinions, meaning they fall well into SU's scope of constructive subjective questions above.

Based on all of the above, I believe keeping the question open is of far more value to SU than closing it. Thanks.

Answer 1

I think the reason it was put on hold is because of this word in the title:

sufficient

Consider Users A, B, and C:

User A

• A user on the network of something highly sensitive, like a military weapons research network, a nuclear reactor, etc. which happens to need (limited) Internet access, or no Internet but can still receive files through some gated system that runs AV on incoming files. Probably runs Windows 7 or Windows 10 Enterprise.
• Highly technical user, generally given yearly refresher training with all kinds of paranoid topics like "insider threat", don't pick up USB keys in the parking lot, keep your system patched and let IT know if you get any errors, don't install unapproved software, etc.
• Secrets being safeguarded are so sensitive that the organization is likely to be very suspicious of the motives of AV vendors' own software, and selects their AV solutions very carefully
• Organizational IT security policy enshrines "defense in depth" at the cost of performance or convenience; biometrics, two or three-factor auth, mandatory super complicated passwords, smartcards, etc. are used to safeguard all systems. All standard computers in the organization likely have multiple levels of AV, intrusion detection, active defense internally and at the network edge, Mandatory Access Control out the wazzoo, maybe even bespoke defense tools if we're talking, like, an intelligence agency.

User B

• A standard home user who uses their Windows Home PC for writing papers for school and browsing the news.
• Doesn't conduct financial business online.
• Social networking is kept to a minimum.
• User's IT knowledge might be extremely minimal; if they didn't encounter a problem with it causing them to disable it, they might be running Windows Defender.
• Probably not using the latest version of Windows (Win7 32-bit is still very common) on old hardware (circa 2011).
• System is only kept up to date with the latest security patches when the OS forcibly restarts for them. User is not security proactive.
• User has no valuable data to steal on the system (except for other students who might want to cheat on an assignment), and may or may not be networked to other casual users who might conduct small value transactions online (e.g. Amazon).

User C

• An enthusiast who runs the latest Windows version (maybe even Beta), usually the more expensive edition.
• Conducts plenty of financial business online; might also do work from their personal computer.
• Might have very capable gaming or GPGPU hardware that can be used to mine Bitcoin or Ethereum by malware.
• User's IT knowledge is about where you'd expect for a high-rep SU user.
• User has a thoughtful security posture, but probably values performance highly enough that an AV solution that slows them down will get uninstalled quickly in favor of something faster.
• User has plenty of identity and financial data on their system for the taking, which is relatively valuable compared to user B, but pretty insignificant compared to User A.

The problem is, each of these users will have a vastly different opinion on what "sufficient" means when referring to any particular security solution.

• For User A, they probably have a several-hundred-page, standards-backed, perhaps classified document describing in excruciating detail what criteria must be met by the scanning/IDS/AV/AM tools installed on each system. They also probably have several layers of scanning at the network edge, a forced HTTP proxy for all clients inside the network, and so on. What they run for AV might look more like a list of products than anything you'd ever consider running on your home PC.

• For User B, literally any sort of security solution is probably sufficient, as long as it's enabled in some way. Heck, even that might not be very important if the user never leaves the beaten path of their university website and maybe the occasional Facebook. What's the worst that can happen? The hackers can know where Susie graduated from high school and what she ate when she was on vacation in Malibu?

• For User C, they probably shopped around a little to determine which AV solution they like, in terms of its intrusiveness, accuracy and performance, also cost. A paranoid User C type might have MBAM plus something else like BitDefender.

So what's sufficient?

For who?

I think that's the main reason your question got put on hold, keeping in mind that:

• There is no set of security defenses that 100.0% guarantees you are invulnerable to malicious compromise of your system or exfiltration of data.
• MalwareBytes employees themselves seem to have a conflicting set of marketing messages: on the one hand, they want you to feel comfortable enough with their product that you can just use it alone, but on the other hand, they continue to maintain that their product is "not a replacement" for AV.
• The level of security vs. cost/performance/convenience required/desired by each user will vary depending on their exact circumstances, preferences, and the amount and nature of data at risk on their system (as well as their technical knowledge; not all useful security tools are just plug-and-play, and require you to know what you're doing to get good security benefits from them.)

A more objective question would be:

How does MalwareBytes 3.0 Premium's antivirus protection compare against other antivirus solutions?

Then the question would be answerable based on a link like this.