Norton Internet Security 2010 (1 User, 3 PCs)

The good: Norton Internet Security 2010 treads surprisingly lightly CPU power, while bolstering last year's reputation-based detection engine with a new behavioral-detection system.

The bad: Despite dramatic performance improvements during the past two years, Norton still doesn't leave the smallest footprint on your CPU, and new efficacy results show that while it continues to be in the top five apps at detecting malicious software, it still doesn't have the highest rate of detection.

The bottom line: Norton Internet Security 2010 builds on the immense progress it made in last year's version, maintaining a low system profile while strengthening its security framework. It's not perfect, but even Symantec's detractors should check it out.

Review:

Dramatic improvements to its Norton suite during the past two years indicate that Symantec has been listening to the needs and complaints of its customers. The company's strong and surprising changes to Norton's impact on system performance that it introduced last year are maintained in this new version, and a new behavioral detection engine called Quorum shows that Symantec can juggle performance and protection.

Quorum incorporates behavioral detection with Norton Insight, a program-reputation engine introduced in the2009 version of Norton. The purpose of these features, according to Symantec, is to respond faster to mutating threats, while also watching for hibernating infections that pose a potential, but not immediate threat. In the 2010 version, Insight has been split to address four main areas of concern: Download Insight for in-progress program downloads, System Insight for diagnosing system slowdowns, File Insight for file analysis, and Threat Insight for digging deeper into threat origins. Also included is a new enterprise-level antispam algorithm that, according to Symantec, shouldn't require any "training" to use. These features were acquired by Symantec with its purchase of Brightmail more than five years ago. Norton Internet Security also includes OnlineFamily.Norton, Symantec's new parental control system, and Norton SafeWeb, which is a search results and e-commerce rating component.

Photo gallery:
Internet Security 2010

Full efficacy analysis isn't yet available for Norton Internet Security 2010, but last year's version scored better-than-average results, and what is available for the new release indicates that it will score similarly.

Installation
Former users of Norton should try installing this latest version, if only to see that this former sluggish beast now offers a smooth and fast operation. Once you run the installer, the program is ready to operate in about a minute--impressively fast, considering its past performance. The installation process is also the first time that you will interact with Quorum, the new behavior-based detection engine. You'll be asked to participate by sending anonymous data to Symantec's cloud. Opting out of the data submission, according to Symantec, will not affect your security.

Running the trial of Norton also requires free registration at the Symantec Web site--you can't download the installer without it. Uninstalling the software left about 10 Registry entries behind, but no other traces were detectable. Overall, Norton's installation experience was fast and hassle-free, with a minimum of configuration options--but the ones that did come up appeared necessary.

Interface and features
Robust and well designed, Norton Internet Security 2010 gives you a deep but uncluttered toolbox from which to keep your computer safe, maintain a high level of security, and access system management features. Norton's Quorum is the big new feature this year--combined with the expanded Norton Insight, Symantec is looking to improve security while riding on the news of its overhauled performance.

Like its competitors, such as Kaspersky and Trend Micro, that also offer cloud-based, crowd-sourced behavioral detection engines, Norton gives you the option to opt out of submitting information during installation. Unlike most apps, Norton shows you the information that will be shared in detail.

From the main window of NIS, click the Details link next to the Insight Protection option. A window will open that shows you how many files have been detected throughout the network, with a column graph split into "known good files" in green, "known bad files" in red, and a middle gray area for files that are still being evaluated. Over time, that gray area should shrink as more files are recognized as safe or not. It also reveals how many total files have been judged, how many trusted files reside on your computer, and how many times Norton has used Insight and Quorum to evaluate one of your files. This is a good start, although we'd like a quick jump from here to the Norton Insight window that exposes which files those are.

Norton starts with a dark-themed window, accentuated by yellow and white font. On the left of the application is a persistent performance meter, measuring the percentage of CPU that's being used and what percentage of that Norton is using. As a response to its past performance problems, this is a bit much--but it's better to err on the side of exposing more data, rather than less. Below the meter is a button that flips the screen to expose more detailed performance data, but you also get to see an unnecessary animation of the window "flipping."

The performance window defaults to showing two charts--this is the System Insight feature, and makes Norton's system optimizing features some of the strongest and most detailed we've seen. The chart on the bottom shows your current overall CPU usage and the percentage of CPU that Norton has used for the past 90 minutes. You can change this to show as much as a month of history or as recently as the last 10 minutes. You can also change the chart to show memory only.

The second chart, at the top, shows important system incidents over the past month. Marked with their own icon for clarity are installations, downloads, optimization occurrences, and threat detections. You can mouse over an incident to reveal more information about it. You can also force a system optimization to run from a link at the top of the chart.

Below the performance link is a link to Application Ratings. This takes you to the Norton Insight window that exposes how your installed programs have been rated, their average resource usage, and their executable file name. The window defaults to all running processes, but you can filter it through a drop-down menu to all files, start-up items, high performance programs, user-trusted files, and untrusted files.

Here, you can also set what kind of trust-level they want using the same pill-shaped slider that's present throughout the program. The default trust exempts Norton Trusted files from scans, a full scan checks everything regardless of trust, and high trust excludes Norton Trusted files and your local files rated as "good." At the bottom of the application ratings window, nestled nearly out of sight, is a link to check a specific file. This opens a file browser in your system directory and lets you choose a file to check. The process took fewer than five seconds.

A somewhat hard to see link at the top left of the performance window opens up a Web page that explains in detail how to use System Insight. For some reason, useful links are occasionally placed in hard-to-see corners. Since Symantec made nearly every link in the interface text-based and in the nondescript Arial font, the text links are hard to see. We're not suggesting using Wingdings here, but perhaps a better way to show how to access these features should be found. Notably, the shade of yellow chosen shouldn't impede those with color-blindness from using the interface.

The center and right side of the main window are taken up by Norton's core protection features: computer scanning, network defenses, and Web protections. To the right of each feature are quick toggles for key subfeatures, and to the right of each of those is an "i" icon that reveals more detailed information when you mouse over it. Next to the network defenses, for example, you can toggle the firewall, intrusion prevention, and e-mail protection.