Why you can trust Tom's Guide Our writers and editors spend hours analyzing and reviewing products, services, and apps to help find what's best for you. Find out more about how we test, analyze, and rate.
UPDATED On Feb. 20, 2020, Google removed all Android apps developed by Cheetah Mobile from the Google Play store, apparently for violations of Google's ad guidelines. Until the apps are restored, we cannot recommend installing or using CM Security Master. We will update this review when we receive further information.
This review was originally published Oct. 26, 2017.
China's Cheetah Mobile is one of the largest mobile app developers out there, claiming more than 600 million active monthly users. The company's CM Security Master app has a clean, modern home screen and offers an extensive suite of features, with a number of add-on modules to deliver even more functionality.
However, the app's malware protection fluctuates from month to month in lab tests, even as most competitors' scores stay roughly the same. There's no way to remotely send anti-theft commands via SMS, the in-app ads can be annoying and the screens get more cluttered the further you get into the app.
In November 2018, Cheetah Mobile was accused of using seven of its Android apps, including CM Security Master, in a massive advertising click-fraud scheme that allegedly gave the company commissions for referrals that should have belonged to other app makers. The company has denied the allegations.
In March 2018, AV-Comparatives said that an antivirus app made by Cheetah Mobile was "risky" due to poor malware detection or a high rate of false positives. As Cheetah Mobile makes two antivirus apps, we cannot be certain that CM Security Master is the risky product.
CM Security is quite good for a free security app. But for free Android security software, we prefer Norton Mobile Security, which has more consistent malware protection. Among all Android security apps, we prefer the paid Bitdefender Mobile Security, which has unparalleled malware detection and is our top choices among the best Android antivirus apps.
MORE: Best Antivirus Software
Costs and What's Covered
CM Security Master (formerly CM Security) was completely free when we reviewed it last year, relying solely on ads for revenue. Since then, the app has undergone a complete visual overhaul and added a virtual private network (VPN) client to the core feature set. There's also a VIP subscription for $11.99 a month, $20.99 quarterly or $35.99 annually. (Most other premium Android antivirus apps cost $15 per year.)
The VIP subscription brings with it the ability to schedule "speed boosts" on your phone, but users are predominantly paying for unlimited VPN data usage. The free version is limited to 200MB of VPN data per month and the removal of ads from the app.
The latter feature was one of the wishes I expressed for the app when I reviewed it last year. But pairing this with the VPN service makes CM Security's VIP pricing hard to justify, unless you really need a VPN and want the integrated experience. There are certainly less-expensive VPN options on the market; $35.99 could also buy a year's subscription to Private Internet Access, which would cover all of your devices.
MORE: 21 Top Features of Android Oreo
Moreover, while the lack of ads in the premium version of the app is nice, the constant reminders to add or use other features of CM Security Master itself still make it feel like I'm being advertised to, even if it's only by CM.
Malware Protection
Another change to CM Security Master since we last reviewed it was the removal of the prominent button to scan for malware when you first open the app, which was a convenience I really appreciated. The app can be a bit overwhelming, with all of the options and add-ons that it throws at you. That button was one simple touch that allowed you to jump into the app, quickly scan for malware and get back out.
While the lack of ads in the premium version of the app is nice, the constant reminders to add or use other features of CM Security Master itself still make it feel like I'm being advertised to.
To access malware scanning, you now tap the Scan button in the lower-left corner of the main screen, and a scan begins immediately. The app then presents you with any issues it uncovers across three categories; Security, Internet and Privacy.
Gone is the concept of a quick scan versus a full scan. If you want to achieve the same result as the old full scan, you now need to follow up the main scan feature by opening the menu in the upper right and tapping Scan Files. In my case, this took an additional 5 seconds.
MORE: Best Mac Antivirus Software
The option to schedule a scan to occur daily, weekly or monthly is still available. We would still like more control over this feature, such as condition-based scans or specifically timed scans.
CM Security still lacks web protection, a feature that every other app we reviewed offers. Instead, it provides a private browser ("Safe Browser") that protects you when you're surfing the web on your device. You can add a shortcut to Safe Browser and even shortcuts to specific sites you want to use with Safe Browser. But, ultimately, this just isn't as convenient as being protected in the browser of your choice.
Malware Performance
CM Security Master's malware-detection rates fluctuate a bit more than some other vendors' detection rates. In German independent lab AV-TEST's September 2017 evaluations of Android security products, CM Security Master got a perfect score, detecting 100 percent of the 3,016 "real-time" malware threats used, as well as 100 percent of the 2,917 samples that had been collected in the previous four weeks.
But in a previous round of tests in July 2017, CM Security stopped only 99.0/99.3 percent. The latter score was below the average detection rate among the 19 Android security apps AV-TEST evaluated in July, and a big drop-off from the perfect 100/100 rates it had registered in May 2017. In March 2017, CM Security Master's scores were 99.8/100 percent.
Among the four other Android antivirus apps we reviewed whose makers submit them to AV-TEST, Norton Mobile Security and Bitdefender matched the 100/100 percent detection rate in September, followed by Avast Mobile Security (99.8/100 percent) and PSafe DFNDR (99.7/100 percent).
Norton and Bitdefender got exactly the same scores in July, May and March 2017. PSafe's were 99.9/99.9 percent in July and 99.4/100 percent in May, but bottomed out at 96.3/97.2 percent in March — the least consistent scores of any product we've recently reviewed. Avast was more steady, with 99.8/99.9 percent in July, 99.5/99.8 percent in May and 99.9/99.8 percent in March.
Lookout Mobile Security is the lone antivirus app we tested that is no longer submitted to AV-TEST.
Security Features and Tools
Safe Connect VPN
Though all users of CM Security Master have access to the company's Safe Connect VPN service, the free version of the app is limited to 200MB of data per day. That should have you covered if you are just looking to check your banking info or some other lightweight tasks. Anything more would require bumping up to the VIP plan, which unlocks both unlimited usage and the ability to select from a number of server locations.
The VPN feature is well laid out and simple to use, with a running track of your current data usage if you are on the free plan. Connecting initially took 2 seconds, as did switching server locations if you are looking to get around a regional restriction of some kind.
Whether you feel this feature is enough to sell you on the $35.99-a-year VIP plan will very much depend on your needs. While that is on the pricey side for an Android-only VPN, it isn't completely out of line with the rest of the market, and, of course, you do also benefit from the removal of ads from the rest of the app.
For those who would like to use a VPN for more than 200MB a day but don't need a lot of sophisticated features, something like the free CyberGhost VPN plan, which we covered in our Best VPN Services and Apps, might be worth considering.
AppLock and Vault
AppLock can lock any of your apps behind a pattern lock, a PIN or your fingerprint. Like most app-lock features, it makes recommendations for which apps you might want to lock at the outset.That's particularly helpful for someone like me who has a couple of hundred apps installed.
While AppLock made reasonable assumptions regarding which apps I would want to lock, it leans toward messaging, social media and photos. Adding more apps requires just a single tap, but it would be nice to see the app recognize banking or other financial apps, for example. Once you have locked an app, a lock screen will pop up whenever you open the app, displaying the icon for the app you're opening along with the time or weather.
You can set apps to lock whenever the screen is off, whenever you leave the app or after 3 minutes of the screen being off. As I was testing the feature, CM Security asked if I wanted to change the AppLock settings because I was unlocking the screen so frequently. That seemed like a clever touch. AppLock will also hide text or photos that show up in private chat messages on your device, which is a well-considered addition to the basic app-lock feature.
If someone enters the wrong pattern or fingerprint into the AppLock screen too many times, you can opt to have your device take an "intruder selfie" that will be automatically saved to the device and sent to your email address. The intruder will be unaware that his or her photo was taken.
Another addition this year is "Disguise Cover," which will put up a fake crash dialog box on selected locked apps. The user long-presses on the "Close dialog" box to progress to the standard AppLock screen.
Just as with the standard feature, if someone taps that box twice in less than 3 minutes, it will capture an intruder selfie. I'm not exactly certain what would make someone feel that this added level of subterfuge was necessary, but if you have an app you really want to keep locked down, this should do the trick.
After I tested both features, the intruder selfie was sent to my email address within about 5 seconds. The message included the image from the front-facing camera, the app the "intruder" was trying to open, a timestamp, an explanation of what triggered the intruder selfie and a link to the Find Phone site in case your device is missing.
The Vault is the final piece of AppLock. It's a safe space on your device that offers a private browser (which can also be downloaded separately) that conducts security checks while you use it and then wipes everything clean when you exit it. There's also a list of private bookmarks; click on one, and you are taken to the site using the private browser.
As mentioned previously, users can now add shortcuts to their home screen that will take them directly to a given site using the private browser. The Vault also stores your private photos, which are encrypted and hidden from other photo apps on your device.
Message Security
Locking apps, particularly those geared toward messaging, won't do you much good if the notifications still show up in your notification bar when the device is locked. Message Security both groups together all of the notifications from your locked apps and keeps them safe from prying eyes by putting them behind the same unlocking procedure as AppLock. Once you've taken a look at your accumulated notifications, just hit the Clean Messages button at the bottom.
Wi-Fi Security
Another feature that can also be downloaded as part of a stand-alone app (in this case, Speed Test), Wi-Fi Security performs a number of diagnostics on available Wi-Fi networks, looks for malicious activity and provides a speed test to determine if the network is worth joining. A running list of devices connected to the network can be helpful to figure out why the coffee shop Wi-Fi is grinding to a halt, or when you're just doing an accounting of everything you have running on your home network.
Networks that have been flagged as insecure can be cleared from your device to avoid joining them again in the future. Finally, if you are looking to save battery life, the app can shut down Wi-Fi when you aren't in range of any of your preferred networks.
Caller ID and Blocking
Although there haven't been any changes to this feature since our last review, CM Security's Caller ID remains best-in-class, with a colorful and familiar Material Design aesthetic that Google would be proud of.
CM Security's malware detection rates fluctuate a bit more than some other vendors' rates.
Caller ID simply displays all of your calls in a sortable list, but it adds data from the internet to identify known telemarketers or businesses, which is convenient if you find yourself a target of unsolicited calls.
While viewing the Block List tab, you have the option to block calls for a specified duration of time, or to block specific classes of numbers, such as private numbers, international numbers or numbers not found in your contacts. You can also import numbers to block from your call logs, SMS logs and contacts. The advanced settings even let you block all calls from a given area code, such as 877 or 800.
Still missing is the ability to schedule windows of time in which to block calls, rather than just setting a duration that starts immediately. Users on Android 6.0 Marshmallow or later can address this problem by just using Google's built-in Do Not Disturb feature.
Anti-Theft
CM Security Master continues to offer a fairly rudimentary set of anti-theft features, but ultimately, they function well and handle the needs of most users. Users can locate, lock, wipe or trigger a siren on their device using the web portal, http://findphone.cmcm.com. You must first enable and register your account in the Find Phone settings menu in the app using your Google, Facebook or email account.
I tested all of the features, other than the wipe command. All worked quickly and accurately, with commands coming through on the phone within a couple of seconds of being issued on the web portal. While you can't create a custom message when you lock the device, you can provide a phone number and email address so that the hopefully kind individual who finds your phone can get in touch with you.
Somewhat curiously, although you still cannot issue SMS commands to trigger anti-theft functions on the device, you can now send an unlock command via SMS to the phone if it has been locked by CM Security Master.
As you can see, this is still not a strong area for CM Security Master. Most of what's here is already provided by Google's built-in Android Device Manager. We continue to recommend the free Avast Anti-Theft stand-alone app for people who are looking for a robust anti-theft option.
Other Tools
CM Security Master has a suite of tools that it recommends that users install. Most of these apps are geared toward extracting more from your device by deleting junk, boosting the speed of your device by stopping memory-wasting apps, and boosting battery life by forcing unused apps into hibernation.
Whether you activate these additional features is entirely up to you. They won't affect the functionality of the core app, but the app will continue to present these extra options to you. CM also has a number of stand-alone apps, some of which duplicate functionality found in CM Security Master, such as AppLock, CM Browser, CM Security VPN and Speed Test.
System Impact
To evaluate the performance impact of running CM Security, I ran multiple tests using the Geekbench 4 Android benchmarking tool on my Samsung Galaxy S8 running Android 7.0 Nougat. Following installation of the app, the phone's performance scored 1.97 percent lower than its baseline average on the Geekbench 4 test. During a full scan, it scored 2.43 percent below its baseline performance.
These results put CM Security in second-to-last place for performance impact with the app installed, and in fourth place for performance during a malware scan.
Setup and Support
Although the initial installation of CM Security Master went quickly, the full setup time was among the longest of the apps we tested. It took us around 10 minutes from start to finish, making sure all of the pieces were installed and tweaking the default settings.
While this should obviously be a one-time occurrence, CM Security isn't exactly putting its best foot forward. Even though I had gone through this process with the app last year, I still found it confusing to try to figure out which suggestions were ensuring that the core app was running properly and which were trying to install additional apps.
A new addition this year is Disguise Cover, which puts up a fake crash dialog box on selected locked apps
For users who stick with the free version of the app, this kind of hassle might be acceptable. But for those who are considering spending $35.99 for a yearly subscription, this just feels like a poorly designed setup process.
Support is one area that has taken a step forward this year. There's now a feedback option that allows you to send an issue to CM Security Master support staff with an attached image. You can request that they get back to you via a number of different methods, such as mail, WhatsApp, Skype, Line or Google Hangouts. You can also access a number of helpful FAQs by going to http://cmsecurityapp.freshdesk.com/support/solutions.
Interface
CM Security Master remains a good-looking app, but its user interface and user experience will always be weak points, given the focus on doing virtually everything. It seems unlikely that this will change anytime soon. It is quite simply overwhelming to sort through everything the app does, or would like to do, for you.
Though a few of the most common tasks are handled by scrolling down the main screen, the majority are found by hitting the Menu button in the upper right. This menu was updated this year to go full-screen, which does help usability but doesn't change that 15 items in a menu is just massive. This doesn't even address the Settings menu; that is accessed from within this menu and includes not just the settings for features seen elsewhere in the app but also whole features that would otherwise be missed by users.
Having the VIP subscription does eliminate the ad clutter — and that's no small matter, as I really did not like the quantity or implementation of the ads in CM Security Master. But again, the app's efforts to get you to use its own features are omnipresent whether you pay or not.
Bottom Line
CM Security Master is one of the most full-featured security apps we've reviewed. After wishing that the app maker would offer a paid, ad-free version of the app, we got exactly that. But with a VPN bundled in, the $35.99-a-year cost was more than we had bargained for. I still wish there were a way to dismiss or eliminate some of the features that I simply will never use, but that just isn't the company's business model.
We hoped that CM Security Master would also live up to our second request for better malware protection, and thought we had it in the latest AV-TEST results while we were writing this. But then another round of results came in just before publication, and we could see that CM Security's protection remains as inconsistent as ever. Time will tell if the company can resolve that problem.
Ultimately, I would still recommend that most people pay $15 per year for the flawless performance and much-less-cluttered interface found in Bitdefender Mobile Security. If you are looking for a free antivirus app, the unpaid Norton Mobile Security will give you better overall malware protection than CM Security Master.
