Is free antivirus enough? What Microsoft Defender covers and what paid suites add
Windows already ships with a capable antivirus. Paid suites add extras that matter to some households and not at all to others. This guide helps you tell which one you are.
By the editors of ProtectYour.com Last reviewed 7 min read
Affiliate disclosure: this guide links to Bitdefender. If you sign up through those links we may earn a commission, at no extra cost to you, and that does not change what we recommend. Free options come first, and we say where a competitor is the better fit. How we make money
Key takeaways
- For most people on Windows 10 or 11, Microsoft Defender (built in and free) is enough, provided it is switched on and Windows stays updated.
- Independent labs such as AV-TEST and AV-Comparatives have rated Defender well in recent years. Check their current results before you buy anything.
- Paid suites mostly add extras: stronger web and scam filtering, ransomware layers, one license across many devices, and bundled VPNs or password managers.
- No antivirus stops you from typing your password into a fake login page or reusing a leaked password. Two-factor authentication and a password manager do more for most people.
What you already have on Windows
Every copy of Windows 10 and Windows 11 includes Microsoft Defender Antivirus. It runs in the background, scans files as you open and download them, pulls new threat definitions through Windows Update, and checks suspicious files against Microsoft's cloud service. You did not have to install it and you do not pay for it.
Defender switches itself off when you install another antivirus product, and switches back on when you uninstall it. So if a laptop came with a trial of some other suite that has since expired, you may be running with weaker protection than you think. Check it:
- Open the Start menu and search for Windows Security.
- Select Virus & threat protection. You want a green check and the words "No action needed."
- If it names another product as your active antivirus, either renew that product or uninstall it so Defender takes over.
Windows also includes SmartScreen, a reputation filter that warns you before you run an unfamiliar download or visit a site Microsoft has flagged for phishing or malware. It works in Microsoft Edge and at the operating system level. Leave it on.
Free step: turn on ransomware protection
How good is Microsoft Defender, really?
A decade ago the honest answer was "better than nothing." That has changed. Defender has scored well in the protection tests run by independent labs like AV-TEST and AV-Comparatives, often close to the paid products. Results move from one test round to the next, so look at the labs' latest reports rather than trusting any score quoted on a shopping page, including ours.
Where Defender has historically trailed is in extras and in some performance measurements, where it can slow down file copying or app installs a little more than the lightest competitors. On a modern computer most people never notice.
Its real advantage is that it is part of Windows. It updates with the operating system, it does not nag you to upgrade, it does not show pop-up ads for a premium tier, and it has no business reason to collect your browsing history.
Other free antivirus options, and the catch
Several security companies give away a basic antivirus for Windows to bring people into their paid products. Bitdefender has offered a free edition with its core malware scanning. Avast and AVG (both owned by the same parent company, Gen Digital) have long offered free versions too.
A free third-party antivirus replaces Defender rather than adding to it, so the question is whether it does a better job. For most people the gain is small, and you pick up upgrade prompts, bundled browser extensions and extra software in return.
There is also the question of how a free product pays for itself. In 2024 the Federal Trade Commission took action against Avast, alleging that it collected users' browsing data through its software and browser extensions and sold it through a subsidiary, despite marketing itself as a privacy tool. The FTC's order bars Avast from selling browsing data for advertising. You can read the details in the FTC's press releases. The episode is a fair reminder that a security product sees everything you do online, so the company's incentives matter.
Do not run two antivirus programs at once
What paid security suites add
Paid suites from Bitdefender, Norton, ESET and others are mostly built around the same core: a malware engine. What you pay for is the layer around it.
Built-in Windows protection compared with a typical paid suite
| Feature | Windows built-ins (free) | Typical paid suite |
|---|---|---|
| Malware scanning | Yes, Microsoft Defender | Yes, the vendor's own engine |
| Web and phishing filtering | SmartScreen, strongest in Edge | Usually works across browsers, often with scam and fake-shop detection |
| Ransomware protection | Controlled folder access (off by default) | Usually on by default, sometimes with file backup or rollback |
| Firewall | Windows Firewall | Some suites replace or extend it |
| Mac, Android, iPhone coverage | No (each platform has its own built-ins) | One license covering several devices and platforms |
| Extras | None | VPN, password manager, parental controls, identity monitoring, depending on the tier |
Be careful with bundles. A VPN included in an antivirus package is often capped on data or limited in features unless you pay more, and a bundled password manager may be less capable than a dedicated one. If you want a VPN or a password manager, compare it on its own terms; see our guides to the best VPN and the best password manager.
What no antivirus can fix
Most of the ways ordinary people lose money or accounts today do not involve malware at all. They involve being persuaded to hand something over.
- Phishing. A convincing fake login page steals your password the moment you type it. Web filters catch many known phishing sites, but new ones appear every hour. Learn the signs in our guide to spotting phishing emails.
- Reused passwords. If you use the same password on a shopping site that gets breached and on your email, criminals will try it on your email. Antivirus on your laptop cannot see that happening. Check whether your password has leaked.
- Phone and text scams. A caller posing as your bank, a fake tech-support pop-up that gets you to phone a number, a request to pay by gift card. Software can warn you about some of these; it cannot stop you from agreeing.
- Account takeovers. Without two-factor authentication, a stolen password is all someone needs.
Free steps that beat a paid upgrade
So who should pay for antivirus?
You are probably fine with free if you use one or two Windows PCs, keep them updated, download software from known sources, and already use a password manager and two-factor authentication. Defender plus SmartScreen plus good habits covers you well.
A paid suite starts to make sense if you are buying protection for a family with a mix of Windows, Mac and Android devices and want one dashboard; someone in the house is prone to clicking on things and would benefit from more aggressive scam and website blocking; you want ransomware protection that is switched on and managed for you; or you want parental controls bundled in.
Older relatives are a common case. The appeal for them is the browser-level scam warnings. These go further than what Windows does in non-Microsoft browsers. Set it up for them, and also set up their two-factor authentication, because the suite will not do that.
Running a business? Consumer antivirus is the wrong tool. See endpoint protection for small business.
Other well-regarded options include Norton and ESET. Before buying any of them, compare the current lab results and read the renewal terms: first-year pricing on security suites is often lower than what you pay when the subscription renews automatically. If you choose Bitdefender or anything else, put a calendar reminder a few weeks before renewal.
What about Macs and phones?
Macs, iPhones and Android phones each come with their own built-in protection, and the case for paid antivirus on them is different. iPhones in particular do not let any app scan other apps. We cover both in do Macs and iPhones need antivirus, and if you suspect something is already wrong with your phone, start with how to tell if your phone is hacked.
Common questions
Is Windows Defender good enough on its own?
For most home users, yes. Microsoft Defender is built into Windows 10 and 11, updates automatically, and has scored well in recent independent lab tests. Keep Windows updated and pair it with two-factor authentication and a password manager.
Do I need antivirus if I am careful online?
On Windows you already have one, Microsoft Defender, so the question is whether to pay for more. Careful habits plus Defender are enough for many people. Antivirus mainly helps when a mistake slips through.
Is free antivirus from Avast or AVG safe to use?
They detect malware, but in 2024 the FTC took action against Avast over allegations that it sold users' browsing data, and its order bans selling browsing data for advertising. Since Windows already includes Defender, most people do not need a third-party free antivirus.
Can I run two antivirus programs at the same time?
Not two real-time scanners. They conflict and slow your computer. Windows turns Defender off automatically when another antivirus is installed and back on when it is removed.
Your next step
If you want a paid toolAffiliate link
Bitdefender
Best for: Windows, Mac and Android users who want web protection, ransomware layers and several devices covered by one subscription.
Not for: Windows users happy with Microsoft Defender, and iPhone users: iOS apps cannot scan other apps, so the benefit there is mostly web filtering.
Visit BitdefenderRelated guides
- Do Macs and iPhones need antivirus?Apple builds malware defenses into macOS and locks iPhone apps into sandboxes. Most people need good habits more than another app, but Mac threats are real and growing.
- Why software updates matter, and how to turn them on for every device you ownInstalling updates is the single cheapest security habit there is. Switch on automatic updates everywhere, know when a device stops getting them, and replace it before that happens.
- How to spot phishing emails and texts (and what to do if you clicked)Phishing works by making you act before you think. These are the lures that show up most, the checks that catch them, and the steps to take if one got through.
- Two-factor authentication: what it is, which kind to use, and how to set it upTwo-factor authentication means a stolen password is not enough to get into your account. Some methods are much stronger than others.