An Internet connection is needed for the antivirus to run scans properly.
It encrypts keystrokes to prevent keyloggers, it blocks malicious USB devices and notifies the user if the webcam is being accessed without permission.
The antivirus is completely cloud-based, and it uploads suspicous files to the cloud to detect if the files are actually malware or not. Recent versions of the antivirus use a variety of malware scanners once it detects a suspicious file. It monitors the actions of running programs and checks areas of the system where malware normally resides.