Do You Still Need Antivirus Software?

The antivirus most people are urged to buy is, for the most part, something they already own. In AV-Comparatives’ February-to-May 2026 real-world test, Microsoft Defender Antivirus, which comes free with Windows, sat in the same top protection group as the leading paid suites.¹

The honest reply to “do I need antivirus?” is yes, and your computer or phone almost certainly has it already: Windows, macOS and Android include a scanner, and iPhones rely on app review and strict app isolation instead. Your job is to check that it is switched on, a five-minute check you will find just before the bottom line. A paid suite is worth buying for the extras you will use, rarely for better malware detection.

That makes antivirus one layer among the everyday habits that protect you most, and not the first one to fix.

Do I need antivirus on Windows, Mac, Android or iPhone?

Whether you need extra antivirus depends on the platform, because each maker builds in different protection. Australia’s Cyber Security Centre (ACSC) tells households they likely have antivirus already: most modern Windows and Apple computers include it free, and Android and Apple phones come with protection too.² What that protection does varies.

Windows

Windows Security, the app built into Windows, includes Microsoft Defender Antivirus, which scans in real time, along with a firewall and Smart App Control.³ For a typical home PC on Windows 11 with updates switched on, the job is to check that this protection is running.

The exception is an old PC. Britain’s cyber security agency, the National Cyber Security Centre (NCSC), in guidance written for organizations rather than households, says older versions of Windows benefit from third-party antivirus, and that a product still supported on an outdated system may help manage some of the risk.⁴ If your computer no longer receives Windows updates, that is one case where paid protection can earn its place, although it cannot supply the security fixes the computer is missing.

Mac

macOS checks apps before they open and watches for known malware in the background. Apple scans apps from developers outside the App Store before they are distributed, a process it calls notarization, so Gatekeeper can verify an app before it opens. XProtect, the built-in antivirus, blocks known malware and removes infections using signatures Apple updates automatically, separately from system updates.⁵

The UK’s cyber agency and one of the big test labs disagree on whether that is enough. The NCSC calls XProtect reasonably effective but notes that its signature set is limited and aimed at widespread malware.⁴ AV-Comparatives, whose business is testing security products, argues in its 2026 Mac review that the built-in approach handles well-established malware but may be slow against new threats, and that non-expert users, children and people who often try new software gain most from a third-party scanner.⁶

So the answer on a Mac depends on how you use it. If you install apps from the App Store or developers’ own websites and keep macOS updated, the built-in layers cover the widespread threats. If you often try niche tools, or share the Mac with children, a lab-tested scanner is a reasonable extra.

Android

Android phones with Google Play include Google Play Protect, which is on by default, checks apps as you install them, scans the phone periodically and can remove harmful apps.⁷ In AV-TEST’s July 2026 Android test, Play Protect earned the maximum protection score alongside paid security apps.⁸

The weak point is apps from outside the Play Store, which Android calls installs from unknown sources: an app file downloaded from a website or sent in a message instead of fetched from the store. Keep Play Protect switched on, think twice before allowing installs from unknown sources, and check that your phone still receives security updates from its maker.

iPhone and iPad

iPhones don’t run antivirus in the usual sense. Every third-party app runs in its own sandbox, designed to stop it gathering or changing other apps’ data or making changes to the device.⁹ That same wall stops an antivirus app from scanning other apps, which is why the NCSC judges such products of very limited value on iOS and the malware risk there minimal.⁴

In the European Union, Brazil and Japan, iPhones can also install apps from alternative marketplaces and developers’ websites. Apple notarizes those apps for baseline integrity but leaves app review to each distributor.¹⁰ Wherever you live, the protective habit is the same: install from the App Store or a marketplace you trust, and keep iOS updated. If a web page claims your iPhone is infected and pushes you to install a cleaner app, you are looking at the fake-warning pattern described below.

Does paid antivirus catch more malware than built-in protection?

Paid antivirus catches little or no more malware than the protection built into Windows, according to the latest results from two independent test labs. The labs test the way you would meet it: AV-Comparatives sends each product to live malicious websites and downloads found in the wild, then counts an attack as blocked if any layer stops it, whether a warning about the web address, a check on the download or a scan when the file runs.¹

The study

Moderate evidence

AV-Comparatives Real-World Protection Test, February to May 2026

The lab ran 20 Windows security products against 400 live malicious websites and downloads on fully updated Windows 11 computers. Microsoft Defender Antivirus, which comes with Windows, blocked 396 of them. The best-scoring product blocked 399, and paid products such as Norton’s and Bitdefender’s scored in between. Microsoft also wrongly blocked none of the legitimate sites and files in the lab’s false-alarm test.¹

Defender missed 4 attacks in 400 and the best product missed 1, a gap of under 1 percent of the attacks tested, and the lab itself counts every product in that top group as equally effective. The result comes from one lab over four months on computers with every update installed.¹ That is a narrow margin, not a different class of protection. One more caveat: the lab is funded partly by public bodies, including the European Union, and although taking part in its public tests is free, vendors can pay it for consultancy and for the right to use its logos.¹¹

A second lab, Germany’s AV-TEST, points the same way in its May and June 2026 rounds: Defender stopped every zero-day attack and every sample of widespread malware the lab used, earning the top protection score.¹²

Don’t pay for a suite because an advert promises it catches more viruses. Confirm the built-in protection is on, then judge any paid product by the extras you would use.

When a paid security suite is worth it, and when it’s an upsell

A paid suite earns its price when you will use what it adds on top of detection. With blocking rates this close, the extras are what you are buying. The ACSC lists extras such as monitoring several devices from one place, ransomware and anti-theft protection, support for mixed operating systems and live support, and suggests researching the quality of bundled VPNs and password managers separately.²

Picture two households. One person with an iPhone and a Mac that both update themselves gains little from a suite. A family with two Windows laptops, an old Android tablet and young children might value one dashboard, web filtering and someone to phone when something looks wrong.

Bundles also differ by country. Microsoft 365 Personal and Family subscriptions include the Microsoft Defender app, but its identity theft monitoring is available only to customers in the United States.¹³ Some telecom providers include security software at no extra cost: in the UK, BT says its Cyber Threat Protect comes free with all its broadband packages, with 15 licences, alongside parental controls and warnings about harmful websites.¹⁴ In Australia, Telstra offers Device Security Essentials, powered by McAfee, free to its consumer and small business mobile customers.¹⁵ Check your own provider’s security page before buying, because you may already have a licence, and compare what a suite includes and costs in your own country rather than in a review written for another market.

Two of those upsells deserve a word. The NCSC’s guidance for organizations advises against running more than one antivirus product on a device: the added security is minimal and the products can conflict and destabilize the machine.⁴ And the ACSC warns that a trial preinstalled on a new computer may carry hidden costs, and that some free products may be funded by advertising or by collecting and selling your data. When a trial ends, it suggests either paying to continue or using the built-in antivirus. It also warns that malware may pose as antivirus, so buy and download security software only from the provider’s official website.²

Before paying, name the two or three extras you would switch on this month. If nothing comes to mind, the built-in protection is your answer.

Where antivirus stops and your habits take over

Antivirus catches known malicious files and sites, but many attacks go around it, which is why the ACSC says antivirus does not protect against all threats and works best alongside good security habits.²

Three habits carry most of the load. The first is updates: AV-Comparatives notes that on a fully patched Windows computer, working attacks that exploit software flaws are very hard to find, and urges users to keep systems and apps up to date.¹ A later guide covers why updates matter in detail.

The second is careful downloads. You might need a free PDF editor for one afternoon, and the top search result may be a paid ad for a lookalike site. The FTC, the US consumer protection agency, warns that scammers place fake software ads on social media and search engines, and advises typing a program’s web address yourself instead.¹⁶ On Macs, AV-Comparatives describes cloned download sites, fake utilities and messages that talk people into pasting commands into Terminal, which bypasses Gatekeeper entirely.⁶

The third is good logins. A password leaked from a company you once shopped with never touches your laptop, so no scanner on it can catch the leak; unique passwords and two-step verification guard that door. Letting a password manager generate and remember them makes that practical.

Pop-ups that say you’re infected are selling something

Some of the most harmful “antivirus” is fake: pop-ups and scans that invent infections to sell software or services, often called scareware. It works on alarm. A browser tab fills the screen, flashes a warning that your computer is infected and urges you to scan or call now, before you stop to think.

1. A tab that fills the screen. It is a web page, however official it looks. Closing the tab, or the whole browser, makes it go away.
2. The "infected" warning. Scareware invents infections to sell software or services. A real problem would show up in your own security app.
3. Scan or call now. The rush is the trick: it is there so you act before you stop to think.
4. A phone number to call. The FTC advises never calling a number that appears in a pop-up window.
5. A Scan now button. In a 2024 US case, the FTC charged that the firms' scans typically found serious problems whatever the computer's real condition. Scan with your own app instead.

In a 2024 US case, the FTC charged that two Cyprus-based firms, Restoro and Reimage, used fake Windows pop-ups claiming computers were infected, and that their scans typically found serious problems whatever the computer’s real condition. People were then sold software and, over the phone, repairs costing hundreds of dollars more. The firms agreed to pay US$26 million to settle the charges.¹⁷

Myth

A pop-up that says your device is infected has found a real problem.

Fact

In a 2024 US case, the FTC charged that two firms' scans reported serious problems whatever the computer's real condition.

The safe response is the same everywhere, and it never uses anything the warning gives you.

1. 1Close the tabor the browser, if the page will not let go
2. 2Open your own security appfrom your menu, not from the pop-up
3. 3Run a scan there
4. 4Report it if you paidto your country's fraud reporting service

The FTC’s advice is never to call a phone number that appears in a pop-up window; what those calls lead to is a topic for a separate guide. If you paid or let someone connect to your computer, report it to your country’s fraud reporting service; in the US, that is the FTC’s reporting site, ReportFraud.ftc.gov.¹⁶

Check what you already have

Five minutes is enough to confirm the protection you own is working, and it tells you whether a paid suite has anything left to add. Go through the list on each device, then decide on extras.

Your five-minute protection check

• Windows: open Windows Security and confirm real-time protection is on
• Mac: keep automatic updates on so XProtect gets new signatures
• Android: confirm Google Play Protect is switched on
• iPhone and iPad: install apps only from the App Store or a marketplace you trust
• Check whether your broadband or mobile plan already includes security software
• Keep one antivirus product per device, bought only from its official website
• Close any pop-up that claims to find viruses, and scan with your own app instead

Download PDF ↓

Get this checklist as a one-page PDF. We'll email you the download link.

Your emailAlso send me the weekly newsletter (launching soon)Email me the PDF

We use your address to send this link and, only if you tick the box, the newsletter. Privacy policy.

The bottom line

Most people already have the antivirus they need: Defender on Windows, XProtect on a Mac, Play Protect on Android, and app review plus sandboxing on iPhone. Turn it on, keep your devices updated, download software only from sources you trust, and protect your logins. Pay for a suite only when you can name the extras you will use, and treat any pop-up that claims your device is infected as the scam it usually is.