CyberGhost Security Suite for Windows review

You might think running a great VPN is enough to keep a company busy, but Romanian-based CyberGhost clearly has other ideas: it's expanded into a whole new market with the release of CyberGhost Security Suite for Windows, which the company calls its 'all-in-one privacy and security solution.'

The suite takes CyberGhost's excellent VPN as a starting point, then adds three new security tools. An Intego and Avira-powered antivirus provides real-time protection from malware, plus a Security Updater alerts you to outdated apps, and Privacy Guard makes it easy to lock down a mass of Windows privacy settings.

All CyberGhost customers also get access to its ID Guard service, a free tool which raises an alert if your email address appears in a data breach.

• You can sign up for CyberGhost Security Suite here

All this extra security power is available as an add-on to the VPN, in a plan called 'VPN + Security Bundle.' Pricing looks fair at $17.99 billed monthly, only $5 more than the VPN-only price. Opt for the annual plan, and the total price drops to $5.89 for the VPN and security bundle, compared to $3.99 for the VPN alone. Moving to the three-year plan costs $2.25 for the VPN, $3.25 when you add the security bundle, so you're getting the antivirus and everything else for just an extra $1 a month.

Keep in mind that CyberGhost plans cover up to seven devices, too, so that single $1 could get you antivirus for, say, up to seven Windows laptops. It's likely you'll use some of your device allowance solely for the VPN – a couple of mobiles maybe, a smart TV, a tablet, leaving only three free slots for the security suite – but that's still seriously cheap.

The lack of platform coverage is an issue, though. Avira, Bitdefender, Norton and others all have Windows security suites which include VPNs, and can also protect you from malware and other threats on Mac, Android and iOS. If you are buying CyberGhost Security Suite which only gives you Windows protection, so then you have to buy another suite for your other devices, it's maybe not such a great deal.

Is CyberGhost Security Suite really worth the upgrade cost, then? We'll drill down into the Security Suite modules to find out more. We're not going to be covering CyberGhost's VPN here, though: if you're looking to find out more about that, check our standalone CyberGhost VPN review.

Setup

CyberGhost has years of experience in building easy-to-use VPN apps, so it's no surprise that Security Suite installation is quick and easy. We weren't hassled by complicated options, it didn't demand we remove other security apps, or even that we reboot: we just ran the installer, and it was finished in a few seconds.

The antivirus module is advertised as 'powered by Intego', but that doesn't tell the whole story. Intego is expert at producing antivirus for Mac, but the firm turned to Avira to provide the engine and definitions in its own Windows products. So, installing CyberGhost Security Suite gets you Intego Antivirus installed in the background, and that, in turn, equips your system with Avira's engine.

Whatever antivirus you're using, it's important that it can protect itself from attack, as malware will often try to disable security software before infecting your system. To test for this, we tried to disable CyberGhost's antivirus by deleting files, killing processes, stopping services, removing drivers and more.

We found the suite had decent self-protection in some areas, but was poor in others. In particular, an attacker with admin rights could stop or even delete key services without difficulty, disabling some antivirus functionality.

This isn't very likely to happen, and if an attacker can run a script with administrator rights then you're already in a lot of trouble. And even when we stopped CyberGhost's service, Windows stepped in immediately, warned us of the problem and enabled Windows Defender, so we weren't left entirely unprotected. But this is still a worrying security flaw that we rarely see with the top antivirus providers.

Antivirus

At first glance, the CyberGhost Security Suite for Windows looks just like the VPN app. It shows the currently selected location, and there's the Connect/Disconnect button, plus the Settings icon bottom-left, as usual. But then you notice three tiny new icons on the left-hand sidebar which point you to the Antivirus, Privacy Guard and Security Updater.

We chose Antivirus and accepted its offer to activate the module. 'Installing Intego Antivirus', a panel informed us, disappearing after a minute or two and presenting us with CyberGhost's antivirus console.

This opened with an Activity panel, a detailed view of recent antivirus activities (scans, definition updates, quarantined files, more), a Quick Scan button, and easy access to more detailed status information and in-depth reports. This looks a little cluttered, and it's not always comfortable to use, but you'll find your way around within a couple of minutes.

Our first Quick Scan completed in what we thought was a speedy five minutes. But then we looked more closely at CyberGhost's report, which said it had scanned only 262 files. 262? That seemed hard to believe, so we checked the full report, and that had a more plausible total of 15,335. We don't know why the figures are different and in this case it's probably not important, but just seeing CyberGhost's console display apparently false information left us a little concerned. What other details should we question?

The real confusion began when we opened an Explorer window, right clicked a folder and noticed the new 'Scan with Intego' option. Shouldn't that be 'Scan with CyberGhost', we thought? Well, no, apparently not – when we chose 'Scan with Intego', an 'Intego Antivirus Premium' window opened, with an entirely different interface, new features and settings, and precisely no mention of CyberGhost, at all. Even the Support link took us to Intego's website, not CyberGhost.

The reason for this is, as we mentioned earlier, CyberGhost Security Suite's antivirus is really just a frontend for Intego Antivirus Premium, an entirely separate package which is also running permanently in the background.

This seems an odd scheme. Providing a simpler antivirus interface which integrates with the VPN app is a great idea, we've no problem with that. But if carrying out a really common task, like scanning an object from Explorer, forces you to use the full antivirus app, anyway, then many users will have to learn both apps and interfaces. That's not simpler, it's significantly more complicated, and it doesn't help that CyberGhost's support site has no word on any of this. We'd bet that many users won't even realize there's a second full antivirus package on their system until they launch a scan from Explorer, and this seemingly brand new app suddenly appears.

Worse still, we immediately spotted evidence that Intego and CyberGhost aren't working together as well as we'd like: although our Security Suite plan expired in June 2021, the Intego console told us 'your Premium subscription will expire on 3/5/2024.'

Apart from looking clumsy and unprofessional, this presents us with other alarming possibilities. If the expiry date can be incorrect, is it possible Intego Antivirus might think your account has expired early, and stop working, without warning you?

Maybe this won't matter in the long-term. The expiry date issue might disappear in the next round of bug fixes; if you don't perform right-click scans, you may never run into the Intego interface, and even if you do, it doesn't take long to learn. Still, the design here feels more like an ugly kludge to get the apps working together, than the polished integration we expected, and we just hope it'll improve over time.

Protection

CyberGhost Security Suite for Windows delivered some surprisingly slow scan times during our protection tests. It scanned 50GB of test executables in around 70 minutes, for instance, compared to 39 minutes for Bitdefender Antivirus Plus and 19 minutes for Kaspersky. And while Bitdefender and Kaspersky scan only new and changed files, hugely speeding up subsequent scans, CyberGhost takes around the same 70 minutes each time.

Scan speeds aren't as important as detection rates, though, so we also ran a few tests of own. The most interesting used scripting tricks to exploit common Windows tools, getting them to download potentially dangerous files. These are such well-known techniques that some antiviruses don't just block them, they assume our testing tools are malware, kill the processes and shove the executables in quarantine.

However, CyberGhost Security Suite detected only one of our tricks at the behavior level, and allowed the others to run. It still picked up the malicious files as soon as they hit our hard drive, so our system wasn't compromised, but this weak behavior monitoring could leave you more vulnerable to new threats.

Next, we ran our own custom ransomware on the test system. As we developed this ourselves, it's unlikely the antivirus engine would spot it from the file signature alone, making this another good behavior monitoring test.

Unfortunately, CyberGhost Security Suite didn't seem to notice the threat and allowed it to encrypt thousands of user documents. We don't know why, so can't draw any major conclusions from this, but the top engines do significantly better. In their last tests, both Bitdefender and Kaspersky not only detected and killed our test ransomware almost immediately, they even managed to recover the handful of files it managed to encrypt.

CyberGhost Security Suite and Intego Antivirus Premium don't appear in the current testing reports from any of the big independent labs, so there's currently no detailed way to compare them against the competition. But as they're both powered by Avira's engine, checking Avira's results gives us a reasonable starting point, and right now they're looking a little mixed.

The latest AV-Test Home Windows report saw Avira average a 99.6% detection rate, for instance, enough to earn it a maximum 6/6 Protection score. Sounds good, but many did even better. Avast, AVG, Bitdefender, F-Secure, Kaspersky, McAfee, Northguard, Norton and even plain old Microsoft Defender all blocked 100% of threats in the same test.

AV-Comparatives' February-March 2021 Real-World Protection Test didn't bring any better news, with Avira's 98.9% protection earning the company only 13th place out of 17.

Put it all together, and although CyberGhost Security Suite's antivirus has some detection skills, they're a long way from leading edge, and the app doesn't appear to offer the level of protection you'll get with the top competition.

Privacy Guard

Windows collects a lot of data on your system, apps and their activities and regularly sends this information back to Microsoft. There are plenty of settings you can use to address this, at least in theory, but in practice it doesn't work that way. Windows' privacy settings are spread so widely around the operating system that not only are they hard to find, but most people don't even know they exist.

CyberGhost's Privacy Guard aims to help by providing a central location where you can view 76 key settings (disabling everything from Bluetooth ads to Microsoft's Inventory Collector and its 'typing habits data collection'), browse their current values and get advice on how best to set them up.

If adjusting individual settings sounds too much like hard work, no problem, there's an easier way. Choose a privacy profile, accept the default options, and Privacy Guard automatically updates all your core settings with the recommended values, no manual tweaking required.

There's always the chance that Windows, another app or maybe someone else who uses your PC might change a setting back, but CyberGhost has thought of that, too. A Monitor feature keeps track of your privacy settings and lets you know if they change.

This is well-presented, works as advertised and can help to improve your privacy. There's often a trade-off, though, where choosing the highest privacy setting might break a feature you need, or maybe have some other undesirable effect.

Privacy Guard includes settings which disable the ability to show characters in passwords, for instance, and prevents cloud results appearing in Windows search. The ability to 'Disable Microsoft SmartScreen for Microsoft Store Apps' stops Windows sending some URLs you visit to Microsoft, which sounds great for privacy. But turn it off and Windows might not be able to prevent you accessing malicious web content, which is probably not what you want.

Privacy Guard warns you about some of these risks in its descriptions of settings, and even if you don't read those, you can revert your system to the previous settings if you run into problems. You may not realize for a while, though, and if, two weeks later, you notice some Windows feature isn't working as it should, you might not even connect that to Privacy Guard's changes. And perhaps you'll then spend hours trying to troubleshoot the problem before you figure it out.

Put it all together and although Privacy Guard could be a handy tool for experienced users, it might cause problems for less technical types, and we're not convinced that it adds a lot of value to the suite.

Security Updater

CyberGhost's Security Updater is a simple tool which scans your installed applications, and reports on any missing updates.

The module (apparently based on the Chocolatey package installer) appears to support a decent range of apps, including many internet-facing and other popular products: Acrobat Reader, Chrome, Firefox, Opera, Paint.net, IrfanView, the .NET Framework, and VPN apps for CyberGhost (obviously), Windscribe, ExpressVPN, NordVPN and more.

Although this worked well for us in highlighting missing updates, Security Updater doesn't do a whole lot more. It won't automatically install, or even download the updates, for instance. All it offers is an Update link which is supposed to help you find the missing patch, but even that was often useless in our tests.

When we clicked the Mozilla Thunderbird Update link, for instance, it opened at the home page, rather than with the downloads list. Oh, and although we were testing from the UK, it presented us with the German site.

Security Updater made even less effort when we clicked Update for Microsoft Visual Studio, opening a browser tab with the Google search results for 'Microsoft.'

The Firefox link looked more promising, opening a web page and automatically downloading an installer. But then we ran it, and, no, it was a German, rather than English language version. This may not have much effect on your security – Firefox handles its' own updates fairly well – but our concern is that if Security Updater gave us the wrong update here, how can we be sure it won't do the same elsewhere? And next time, if the issue isn't as obvious as language, and so we install the update without noticing anything, we could run into more problems later on.

In real-world use, we might turn to Software Updater, just occasionally, to make sure we haven't missed an important update somewhere, but then find and install the updates ourselves. That's a benefit worth having, but it's also easy to find elsewhere. Avira and Avast both offer similar software updaters along with their free antivirus, for instance, and although CyberGhost Software Updater appears to support more apps, that doesn't make up for the glitches and hassles we saw during testing.

Final verdict

CyberGhost is a great VPN, but Security Suite for Windows doesn't live up to the company name. Its antivirus can't compete with the best providers, and the Privacy Guard and Security Updater don't add enough value to justify the price.

• We've also highlighted the best antivirus software