I think the reason it was put on hold is because of this word in the title: > **sufficient** Consider Users `A`, `B`, and `C`: ## User A - A user on the network of something highly sensitive, like a military weapons research network, a nuclear reactor, etc. which happens to need (limited) Internet access, or no Internet but can still receive files through some gated system that runs AV on incoming files. Probably runs Windows 7 or Windows 10 Enterprise. - Highly technical user, generally given yearly refresher training with all kinds of paranoid topics like "insider threat", don't pick up USB keys in the parking lot, keep your system patched and let IT know if you get any errors, don't install unapproved software, etc. - Secrets being safeguarded are so sensitive that the organization is likely to be very suspicious of the motives of AV vendors' own software, and selects their AV solutions *very* carefully - Organizational IT security policy enshrines "defense in depth" at the cost of performance or convenience; biometrics, two or three-factor auth, mandatory super complicated passwords, smartcards, etc. are used to safeguard all systems. All standard computers in the organization likely have multiple levels of AV, intrusion detection, active defense internally *and* at the network edge, Mandatory Access Control out the wazzoo, maybe even bespoke defense tools if we're talking, like, an intelligence agency. ## User B - A standard home user who uses their Windows Home PC for writing papers for school and browsing the news. - Doesn't conduct financial business online. - Social networking is kept to a minimum. - User's IT knowledge might be extremely minimal; if they didn't encounter a problem with it causing them to disable it, they might be running Windows Defender. - Probably not using the latest version of Windows (Win7 32-bit is still very common) on old hardware (circa 2011). - System is only kept up to date with the latest security patches when the OS forcibly restarts for them. User is not security proactive. - User has no valuable data to steal on the system (except for other students who might want to cheat on an assignment), and may or may not be networked to other casual users who might conduct small value transactions online (e.g. Amazon). ## User C - An enthusiast who runs the latest Windows version (maybe even Beta), usually the more expensive edition. - Conducts plenty of financial business online; might also do work from their personal computer. - Might have very capable gaming or GPGPU hardware that can be used to mine Bitcoin or Ethereum by malware. - User's IT knowledge is about where you'd expect for a high-rep SU user. - User has a thoughtful security posture, but probably values performance highly enough that an AV solution that slows them down will get uninstalled quickly in favor of something faster. - User has plenty of identity and financial data on their system for the taking, which is relatively valuable compared to user B, but pretty insignificant compared to User A. The problem is, each of these users will have a *vastly* different opinion on what `"sufficient"` means when referring to any particular security solution. - For User A, they probably have a several-hundred-page, standards-backed, perhaps classified document describing in excruciating detail what criteria must be met by the scanning/IDS/AV/AM tools installed on each system. They also probably have several layers of scanning at the network edge, a forced HTTP proxy for all clients inside the network, and so on. What they run for AV might look more like a list of products than anything you'd ever consider running on your home PC. - For User B, *literally any* sort of security solution is probably sufficient, as long as it's enabled in some way. Heck, even that might not be very important if the user never leaves the beaten path of their university website and maybe the occasional Facebook. What's the worst that can happen? The hackers can know where Susie graduated from high school and what she ate when she was on vacation in Malibu? - For User C, they probably shopped around a little to determine which AV solution they like, in terms of its intrusiveness, accuracy and performance, also cost. A paranoid User C type might have MBAM plus something else like BitDefender. So what's *sufficient*? **For who?** I think that's the main reason your question got put on hold, keeping in mind that: - There is **no** set of security defenses that 100.0% guarantees you are invulnerable to malicious compromise of your system or exfiltration of data. - MalwareBytes employees themselves seem to have a conflicting set of marketing messages: on the one hand, they want you to feel comfortable enough with their product that you can just use it alone, but on the other hand, they continue to maintain that their product is "not a replacement" for AV. - The level of security vs. cost/performance/convenience required/desired by each user will vary depending on their exact circumstances, preferences, and the amount and nature of data at risk on their system (as well as their technical knowledge; not all useful security tools are just plug-and-play, and require you to know what you're doing to get good security benefits from them.) A more objective question would be: > **How does MalwareBytes 3.0 Premium's antivirus protection compare against other antivirus solutions?** Then the question would be *answerable* based on a link like [this](https://www.av-comparatives.org/wp-content/uploads/2017/03/avc_sp_pcpitstop_201702_en.pdf).