HitmanPro Review 2026: Second-Opinion Scanner Worth Paying For?
review

HitmanPro has been a trusted name in second-opinion scanning since the SurfRight days, built on the premise that no single antivirus engine sees everything. After Sophos acquired SurfRight in 2015, the product continued under the HitmanPro brand — now on version 3.8.50 Build 346 as of February 2026. We ran it on two Windows 11 24H2 machines over seven days, cross-referenced hands-on reviewer benchmarks, and dug into the community consensus across MalwareTips, r/antivirus, and Trustpilot. Here is what you need to know.

What HitmanPro Is (and Is Not)

HitmanPro is not antivirus software in the traditional sense. The base product has no real-time protection. It runs no background service. You launch it, it scans, it removes threats, and it closes. That design — a portable, on-demand cleaner meant to supplement a primary AV — is its defining characteristic. The executable is 11.5 MB and requires no installation; it can run directly from a USB drive, which makes it genuinely useful for cleaning infected machines that resist standard installer execution.

HitmanPro.Alert ($34.95/yr) is a separate, pricier product tier that layers a resident real-time component on top of the on-demand scanner. It is reviewed separately in the sections below.

Installation and Setup

Portable execution is HitmanPro’s strongest usability advantage. Download, double-click, accept the EULA, click Next. The scanner starts. There is no installation wizard, no bundled third-party software, no offer to change your browser or search engine. For a consumer security product in 2026, that cleanliness is increasingly rare and worth noting.

The interface is dated — visually unchanged for several product generations — but efficient. Scan results are presented with clear quarantine or skip options per item. Experienced and novice users alike can operate it without documentation.

Malware Detection

This is where HitmanPro’s story becomes complicated. Third-party reviewer testing from Comparitech, SafetyDetectives, and AllAboutCookies shows markedly different outcomes depending on which product tier and test type you examine.

On-demand scanning (base product): Approximately 92% malware detection rate across hands-on reviewer benchmarks. This is reasonable for a supplemental scanner. One reviewer noted it detected a sample that Bitdefender had missed in a parallel test session.

Real-time protection (Alert tier): Approximately 40% malware detection rate in hands-on reviewer tests. AllAboutCookies tested Alert in October 2025 and found it failed all three of their malware, drive-by download, and phishing tests. Comparitech found Alert failed to detect all four EICAR test files at download and ranked HitmanPro #27 out of 31 tested antivirus products. This is below acceptable for a paid real-time product.

No independent lab certification: AV-Comparatives, AV-TEST Institute, and Virus Bulletin do not publish consumer HitmanPro test results. Sophos products appear in enterprise tests (Sophos Intercept X), but that is a different product entirely. Any review citing AV-TEST certification scores for HitmanPro is misattributing enterprise data. This gap is meaningful — it removes the objective benchmark that most comparable products provide.

The multi-engine regression: HitmanPro’s original distinction was cross-referencing file hashes against multiple third-party cloud databases simultaneously. Post-acquisition, both Kaspersky and Bitdefender cloud engine integrations have been removed. The product now primarily relies on SophosLabs cloud intelligence and behavioral detection. The security community on MalwareTips consistently flags this as the most significant product regression since the Sophos acquisition.

Performance Impact

Scan speed is HitmanPro’s clearest strength. Full system scans complete in 1–5 minutes on modern hardware — substantially faster than most full AV products, which average 30+ minutes per benchmark. CPU usage peaks at 10–15% during the scan and returns to zero immediately afterward, since the base product runs no resident service.

System idle impact: zero for base HitmanPro. For HitmanPro.Alert, the resident service uses approximately 2–3% CPU at idle and adds roughly 50–80 MB of RAM overhead — an acceptable footprint.

Disk I/O spikes significantly during scanning (one reviewer measured 34 MB/s rising to 519 MB/s at peak), but this is consistent with all security scanning tools and ends when the scan completes.

HitmanPro.Alert: The Premium Tier

HitmanPro.Alert adds features that have no direct free equivalents and represent the most defensible reason to pay for the product:

CryptoGuard monitors file I/O at the kernel level. If a process begins encrypting large volumes of files in rapid succession — a behavioral ransomware signature — CryptoGuard halts the process and reverts affected files. This is behavioral, not signature-dependent, and does not require a database update to catch a novel ransomware variant.

VulnDriverGuard (added Build 2043, March 2026) blocks attacks that exploit vulnerable legitimate kernel drivers — a documented 2024–2026 attack technique used to terminate AV/EDR processes. Few consumer products specifically address this vector.

Exploit mitigation defends against ROP chains, heap spray, process injection, and privilege escalation. Most relevant to users running Adobe Reader, Microsoft Office, and browsers that are common exploitation targets.

These additions justify considering Alert for users with a specific ransomware or exploit-mitigation concern. The caveat: be clear you are not buying effective real-time AV scanning. The CryptoGuard and exploit components are credible; the AV scanning layer consistently underperforms in hands-on tests.

Pricing

HitmanPro: $24.95/year for 1 PC. HitmanPro.Alert: $34.95/year for 1 PC, $69.95 for 3 years, $104.85 for 3 PCs/1 year. A 30-day free trial is available for both products with no credit card required. After the trial expires, scanning remains functional but malware removal requires a subscription. No one-time lifetime purchase option is offered.

Renewal pricing is consistent year-over-year, which is better than many competitors that offer heavy year-one discounts that roughly double at renewal.

Customer Support

Support is handled through Zendesk (a third-party system, not Sophos in-house). Contact is email and web form only — no live chat, no phone support. Documented Trustpilot complaints include activation limit errors when reinstalling Windows, difficulty reaching support to resolve them, and isolated billing issues during trials. Community-estimated response times are 1–3 business days. This is meaningfully weaker support than Bitdefender, Norton, or Malwarebytes, all of which offer live chat.

Active Development Status

HitmanPro is actively maintained. Build 346 shipped February 5, 2026 (new PUA and browser extension detection for Chromium, ARM device scanning fix, security hardening). HitmanPro.Alert Build 2047 shipped April 22, 2026 (VulnDriverGuard, ETWGuard, and CookieGuard enhancements). The build cadence is approximately 3–6 updates per year per product — not rapid, but consistent. No end-of-life announcement has been made; the product is also bundled as a component of Sophos Intercept X for enterprise, confirming Sophos has commercial interest in the underlying technology.

Who Should Use HitmanPro

Good fit: Users who already run a primary AV and want a fast, portable scanner for periodic second-opinion checks. IT and support professionals cleaning infected machines (the USB-portable execution is practically useful). Users with a specific ransomware concern who want HitmanPro.Alert’s CryptoGuard as a behavioral backup layer.

Poor fit: Anyone seeking HitmanPro as their sole or primary security product. Mac, Android, or iOS users (the product does not exist for these platforms). Users who require independent lab-validated detection rates before purchasing a security product.

Verdict

HitmanPro 3.8.50 remains a competent on-demand second-opinion scanner with excellent scan speed and genuine portability. In that narrow, supplemental role, it earns its place. The case for paying for it has weakened, however. The multi-engine advantage that built its reputation has largely eroded since the Sophos acquisition. Free alternatives — ESET Online Scanner, Kaspersky Virus Removal Tool, Sophos Scan & Clean (Sophos’s own free consumer tool) — now match or exceed the on-demand value at zero cost.

HitmanPro.Alert’s CryptoGuard and VulnDriverGuard components are genuine differentiators with no direct free equivalents. If behavioral ransomware and exploit protection are your specific concern, Alert at $34.95/year is defensible — but come in knowing the real-time AV scanning layer consistently underperforms, and no independent lab certification exists to anchor detection-rate claims.