Home · Antivirus · Guide

Cornerstone guide

Do you still need antivirus?

The honest 2026 answer: you already have it. The question that remains is whether you need to pay for it — and for most people the evidence says no.

Last updated: 2026-08-01

Affiliate disclosure: No partner links on this page or anywhere in our antivirus coverage. See disclosure · methodology.

What you already have

Windows: Microsoft Defender

Ships on, updates itself, costs nothing, and — this is the part that changed over the last decade — now scores at the top of the independent labs. In AV-TEST’s January–February and March–April 2026 rounds it earned perfect 18/18 “Top Product” scores, including 100% against zero-day malware. In AV-Comparatives’ July–October 2025 Real-World test it blocked 99.1% with only 3 false positives, earning the highest Advanced+ award. Those are the same charts the paid suites brag about.

Known weak spots, honestly: offline detection lagged (88.4% in one September 2025 test — it leans on cloud lookups), and its phishing shield (SmartScreen) is strongest in Edge. If you live in Chrome or Firefox, a free reputable blocker extension covers that gap.

macOS: three invisible layers

Notarization (Apple scans apps before developers ship them, and can revoke malicious ones remotely), Gatekeeper + XProtect (blocks known malware at launch), and XProtect Remediator (periodically removes infections). All automatic, all free, updated daily and independently of OS updates. There’s no scan button because it isn’t a scan-button product.

So who should pay?

• You want the bundle, managed in one place VPN + password manager + identity monitoring + cloud backup across a family. That can be rational — but price it against buying the pieces on their own merits (we have a calculator and hub for exactly this).
• You want a human to call Built-ins have no consumer support line. If that matters for your household, it’s a legitimate line item.
• Genuinely risky computing Cracked software, sketchy download sites, a shared PC with fearless users. A second engine with different heuristics adds a layer — though changing the behavior adds more.
• Offline-heavy machines Defender’s one measured weakness. Malwarebytes scored better offline (94.7% vs 88.4%) in the same Sep 2025 test — a niche but real case.

If you do buy: the renewal rules

This category has the worst renewal record regulators have ever put on paper — an $80M McAfee settlement over auto-renewal pricing, UK CMA court action against Norton, an FTC ban on Avast selling its users’ browsing data, and a $35M settlement over retail “PC health checks” that diagnosed malware via four sales questions. The full list lives on the hub. Practical consequences:

• Find the renewal number before checkout. Norton 360 Deluxe: $49.99 first year, renews $119.99. Malwarebytes Ultimate: $139.99, renews $279.99. If a tier doesn’t publish its renewal rate (some don’t), treat that as your answer.
• Calendar the renewal date the day you buy, and know that refund windows almost always exclude renewal charges.
• Never buy from a popup or a cold call. Real infections don’t phone you. Fake “Norton invoice” emails are a top fraud category precisely because real renewal practices are confusing.

The free power moves

• Malwarebytes Free — on-demand second-opinion scanner for “I clicked something weird” moments, Windows and Mac. Remediation only; that’s the point.
• Browser Guard / uBlock Origin-class blockers — most modern attacks start in the browser; blocking scam pages beats cleaning up after them.
• Automatic updates, everywhere — the patch you didn’t install is the exploit that works.
• Backups — ransomware’s only true antidote. A $0 scanner plus real backups beats a $120/yr suite with neither.

The priority order that actually reduces risk

1. Unique passwords + 2FA (start with email — see the hub)
2. Automatic OS + browser updates
3. Backups of anything you’d cry about
4. Browser-level scam/ad blocking
5. Then — and only then — antivirus brand choice, where “keep the built-in” is a full answer

Every expert roundup we cite (Wirecutter’s security-expert consultations, PCWorld’s 2025 assessment) orders it roughly this way. Nobody selling a suite does.

FAQ