When a file is scanned, it is labelled as clean or malicious. If a file has a number of questionable characteristics, it is labelled as suspicious.

Suspicious behaviour refers to files exhibiting questionable behaviour, such as copying themselves to a system folder, when they are run on a computer.

Runtime protection helps protect against suspicious files by analysing the behaviour of all the programs running on your computer and blocking any activity that looks as if it could be malicious.