When Your Antivirus Becomes the Risk

Here is a scenario that would have seemed absurd in 2015: a cybersecurity company — founded to protect computers from threats — becomes itself the subject of national security concerns at the highest levels of the US government, gets banned from the country it served for decades, and then triggers fresh controversy by silently replacing its own software on users’ machines with an entirely different product. Without asking.

That is the Kaspersky Lab story in 2026 — and it is not primarily a story about whether a specific virus scanner works well. Kaspersky’s technical detection rates remain among the highest in the industry. The issue is something more structurally complex: what happens when the legal environment surrounding a software vendor creates potential risks that its technical quality alone cannot mitigate?

This guide aims to answer that question as fairly, completely, and practically as possible. We will cover what actually happened, what the evidence shows, what we don’t know, what the regulatory landscape looks like today, and — most importantly — what organisations and individuals should do with this information. If you are running Kaspersky on US infrastructure, read this today. If you are outside the US, read this as a framework for evaluating any cybersecurity vendor in a world where geopolitical software risk is a real and growing category of enterprise concern.

What Are Geopolitical Software Risks? A Clear Definition

Traditional software risk evaluation focuses on technical factors: detection rates, false positives, performance overhead, update frequency, zero-day response. Geopolitical software risk adds an entirely different dimension: who controls the company, what legal authorities can compel that company to act, and whether those legal authorities are aligned or in conflict with your own national or organisational interests.

This framework has become increasingly important as technology increasingly crosses borders, as geopolitical tensions reshape the technology landscape, and as regulators worldwide develop new frameworks for managing software supply chain risk. The Kaspersky case is, in many ways, the world’s most extensively documented example of geopolitical software risk in action — which is exactly why studying it carefully provides so much insight for enterprise security professionals.

The Three Dimensions of Geopolitical Software Risk

The Kaspersky Geopolitical Timeline — Key Milestones

Understanding the current situation requires understanding how it developed. The Kaspersky geopolitical concern is not a 2024 development — it is the culmination of a progression that began nearly a decade ago.

What the Evidence Actually Shows — and Doesn’t

One of the most important things to understand about the Kaspersky case is the distinction between legal risk environment and confirmed wrongdoing. This distinction matters enormously for how we assess the situation and what conclusions we draw.

The 2017 NSA contractor incident — in which classified documents were allegedly taken from a contractor’s home computer running Kaspersky — is the most cited specific incident. However, the precise mechanism of what occurred has never been fully publicly established, and Kaspersky’s investigation suggested the files may have been inadvertently uploaded as part of threat detection analysis.

What this means practically: the risk to most private individuals and non-regulated businesses is significantly lower than the risk to government agencies, defence contractors, critical infrastructure operators, and organisations handling classified or highly sensitive data. A small business owner using Kaspersky in the EU faces a very different risk profile than a US federal contractor doing so.

Enterprise Security Implications — What This Means for Organisations

For enterprise security professionals, the Kaspersky situation is a case study in cybersecurity vendor risk management — a discipline that has grown significantly in importance as software supply chain attacks have become a major threat vector.

The Silent Compliance Gap

The most immediate enterprise problem in 2026 is not actively using a banned product — it is not knowing you’re still running it. Bitsight’s telemetry data showing that approximately 40% of affected US organisations still have Kaspersky installed represents an audit and inventory failure as much as a geopolitical failure.

The risk for these organisations is nuanced: the software itself is no longer receiving threat intelligence updates, meaning it is progressively less effective against new malware. Additionally, running a product banned under ICTS regulations can have compliance implications for government contractors, publicly traded companies with SEC cybersecurity disclosure obligations, and organisations in regulated industries.

The Vendor Risk Management Framework

The Kaspersky case provides an excellent template for evaluating cybersecurity vendor risk more broadly. Security teams should ask these questions of every critical security vendor:

• 1
  Jurisdictional risk: In which country is the vendor headquartered? What legal obligations can the laws of that country place on the vendor? Does that country have a history of compelling tech companies to cooperate with intelligence services?
• 2
  Ownership transparency: Who ultimately owns the company? Are there state-owned or state-adjacent entities in the ownership chain? Have there been ownership changes that affect the risk profile?
• 3
  Data sovereignty: Where is user data processed and stored? Under whose legal jurisdiction? Is there an independent audit of data handling? Has the vendor moved data processing to mitigate concerns (as Kaspersky has done with Switzerland)?
• 4
  Code transparency: Has the vendor’s code been independently audited? Are security researchers able to review the product? Have audits found any unexpected data collection or exfiltration capabilities?
• 5
  Regulatory standing: What is the vendor’s status with relevant regulatory bodies? Have they been listed on government covered lists, subjected to procurement bans, or received formal national security assessments?
• 6
  Track record under pressure: How has the vendor behaved during geopolitical stress? The UltraAV incident — silent forced migration without user consent — is itself a trust signal worth weighing regardless of the geopolitical question.

The Global Regulatory Landscape — Country by Country

One of the most important nuances in the Kaspersky discussion is that regulatory status varies dramatically by geography. The US ban applies only in the US and creates US-specific legal obligations. Every other jurisdiction has its own rules, warnings, and decisions.

The important takeaway: the US ban is the most comprehensive formal action taken, and it is a US-specific regulatory response. European consumers and businesses are not under the same prohibition. However, organisations with US operations, US-domiciled data, or contracts with US government entities need to apply the US standard regardless of where they are headquartered.

Kaspersky’s Transparency Initiatives — What They Do and Don’t Address

It is important to give Kaspersky’s own response genuine consideration rather than dismissing it as purely defensive. The company has taken concrete, costly, and technically meaningful steps to address the concerns raised about it.

The Global Transparency Initiative (2017–Present)

Kaspersky’s Global Transparency Initiative includes several substantive measures. Their Swiss data centre, operational since 2019, moves the processing and storage of data from European, North American, and several other customer bases to Switzerland — a jurisdiction with strong privacy laws and significant political neutrality from US-Russia tensions.

Kaspersky has also established Transparency Centres in multiple locations worldwide, where government officials and qualified researchers can review source code, software updates, threat detection rules, and data-handling processes under controlled conditions. Independent cybersecurity assessments and audits have been commissioned and results published.

Kaspersky’s official statement on the US ban reads in part: “We view this decision as unjustified and baseless — influenced by geopolitical tensions rather than a thorough evaluation of Kaspersky’s products and operations. Kaspersky does not engage in activities which threaten US national security and, in fact, has made significant contributions with its reporting and protection from a variety of threat actors that targeted US interests and allies.”

This statement deserves to be taken seriously. Kaspersky has a documented history of reporting on Russian state-sponsored threat actors — it exposed APT28, Equation Group tools, and multiple other sophisticated operations that did not serve Russian state interests. This record is genuinely inconsistent with the portrait of a company fully captured by Russian intelligence.

The Best Kaspersky Alternatives in 2026 — Ranked & Reviewed

Whether you are in the US and required to migrate, or anywhere in the world and choosing to apply a precautionary approach, these are the cybersecurity products we recommend as replacements — each with a clearly documented geopolitical risk profile and strong independent lab performance. See our full Windows 11 antivirus guide and Android antivirus guide for detailed reviews of each.

Complete Antivirus Comparison — Post-Kaspersky Migration 2026

Beyond Antivirus: Building a Geopolitically-Aware Security Stack

The Kaspersky discussion highlights a broader principle: geopolitical vendor risk applies to every software product in your security stack, not just your antivirus. A complete security hygiene audit should examine every layer.

VPN Services — Jurisdiction Matters Here Too

The same logic that makes Kaspersky’s Russian jurisdiction a concern applies to VPN services. A VPN that logs your traffic and is legally compelled to share it with its home country’s intelligence services defeats the entire point. The best VPNs for trust-conscious users are those headquartered outside 5/9/14 Eyes alliance countries, with independently audited no-logs policies. See our best VPN for remote workers guide — in particular our coverage of NordVPN (Panama HQ) and our NordVPN vs Surfshark comparison.

Password Managers — Critical Data, Clear Jurisdictions

Password managers hold your most sensitive digital credentials. Jurisdiction matters as much here as it does for antivirus. Our best password manager guide covers the top options, and our 1Password vs Dashlane comparison breaks down the two leading choices by security architecture, jurisdiction, and trust framework.

Hardware Security Keys — The Phishing-Resistant Layer

For high-value accounts, hardware security keys provide authentication that cannot be compromised regardless of what software runs on your endpoints. FIDO2/WebAuthn hardware keys (YubiKey, Google Titan) eliminate the credential-phishing risk that antivirus software cannot fully address. These are manufactured by US-based and European companies with clear, auditable supply chains.

AI, Geopolitical Software Risk, and the Future of Cybersecurity Trust

The Kaspersky case will not be the last of its kind. As AI becomes embedded in security software — running increasingly autonomous analysis, decision-making, and response capabilities — the question of whose AI is analysing your network becomes even more consequential than the question of whose antivirus scans your files.

The same jurisdictional risk logic applies: an AI-powered security platform that sends telemetry data to servers in a country with compelled-disclosure laws presents the same category of risk as Kaspersky does — potentially amplified by the richness of the data AI systems collect. Enterprise security teams should build geopolitical vendor risk assessment into their evaluation criteria for all AI-powered security tools, not just traditional antivirus.

Several emerging frameworks are helping organisations structure this evaluation:

NIST Cybersecurity Framework (CSF) 2.0

NIST’s updated framework explicitly addresses supply chain and vendor risk management, providing a structured approach to evaluating third-party software providers that incorporates both technical and governance-level risk factors.

EU Cybersecurity Act and ENISA Guidelines

European organisations should familiarise themselves with ENISA’s guidance on geopolitical software risk, which provides a framework for public-sector and critical-infrastructure entities that is directly applicable to the Kaspersky type of situation.

Software Bill of Materials (SBOM)

The emerging requirement for software vendors to provide a complete inventory of components, including their origins and jurisdictions, is one of the most promising developments in geopolitical software risk management. An SBOM requirement for enterprise security software would make the kind of analysis we’ve applied to Kaspersky standardised and systematic.

Frequently Asked Questions

The Measured Verdict: What You Should Do

The Kaspersky Lab situation in 2026 is genuinely complex — and that complexity deserves to be respected rather than collapsed into a simple “it’s Russian, delete it” narrative or an equally simplistic “no proven espionage, keep using it” dismissal.

Here is the measured, factual verdict:

If you are in the United States: The decision has been made for you by law. Kaspersky is effectively banned, no longer receives updates, and running it creates both compliance and security risks. Migrate to Bitdefender, Norton 360, ESET, or Malwarebytes today. Run an endpoint audit to verify you’ve found every installation.

If you are in the EU or most other jurisdictions, as a consumer: The legal risk is lower and the practical risk for typical personal data is modest. The decision comes down to your comfort with the geopolitical context and your assessment of Kaspersky’s transparency measures. Alternatives like Bitdefender offer comparable technical performance with a significantly clearer risk profile — and switching costs are minimal.

If you are an enterprise, especially in a regulated industry, handling sensitive data, or with any US operations or obligations: The vendor risk framework answers this clearly. A security vendor whose home country’s legal system creates theoretical compelled-cooperation risk should not be part of your critical security infrastructure, regardless of its technical quality. The Kaspersky situation is the clearest possible lesson in why geopolitical vendor risk must be a standing element of your security evaluation criteria.

Finally: the broader lesson extends well beyond Kaspersky. As geopolitical tensions reshape the technology landscape, and as AI makes security software increasingly powerful and data-rich, the question of whose software you trust will only grow in importance. Build the evaluation framework now. Apply it systematically. And keep reading — the cybersecurity threat landscape evolves faster than any single article can track.

Further Reading from GuardedWorker

Build your complete, geopolitically-aware security understanding with these companion guides: