Two basic functions every antivirus does are constant scanning and scanning on the user’s demand. The first protective function is to continuously scan the computer systems (or other device on where the protection is installed) for malware. The realization of this function should be invisible, not slowing down the operation speed of the device. The second protective function is aimed to identify threats at the user's request. Here we should pay attention to the time it takes to complete a full scan, since some antivirus programs require several hours to complete it. If there was a risk of infection, a long wait can drive any user crazy.
Some antivirus software for Mac offer extra coverage against ransomware – a new branch of hackers’ attacks. A ransomware virus gets inside personal data boxes blocking users’ files and demanding payments for unlocking. It encodes photographs, documents, etc. and asks for payments to decode your data. Another interesting function is encoding data when using unsafe Wi-Fi connections. You might have noticed that some networks are marked as not safe, e.g. Wi-Fi provided by a restaurant. This is where you may need extra defending coverage. The list of additional functions is definitely longer, it can include parental control, various managers, etc. One should read the description and decide whether those functions are necessary. Apparently, the basis of antivirus solutions is alike in every vendor, so if there is no need of extras, why pay more?