My own thought process on this is the following: Some parts of antivirus software do good work. Understanding that antivirus software is no substitute for real

My own thought process on this is the following: Some parts of antivirus software do good work. Understanding that antivirus software is no substitute for real security, but more like a helpful layer to try to catch things that otherwise might sneak in, helps a lot in using it successfully. On that level, software which scans downloaded files before opening them, and periodically scans the filesystem passively for any known threats, is not bad. I agree that patching the software of its bugs in the first place is a better goal, but it doesn't hurt to have an in-between option that helps out a little bit. Of course, such software rarely needs to be a third-party suite, as Microsoft's own Windows Defender software performs this task decently. Where things get hairy are antivirus suites in particular. It's one thing to passively scan files, but AV suites have a bad habit of hooking into the operating system and making other changes, usually in the name of real-time monitoring. This is where I feel their supposed benefits fall flat. It would be one thing if these hooks were also passive, but Windows and most other operating systems make it difficult to access the kernel's data on purpose, and I don't trust an antivirus suite to do so in a safe manner. It's one thing for an exploit to compromise passive scanner running with userland permissions, and another thing entirely to exploit an AV suite with direct kernel access. The latter can cause the security features to backfire pretty hard.