# How to choose antivirus software for your PC in 2026: is Defender enough? > Windows 11 already includes Microsoft Defender. Buy a suite only for extras you need, choose it from recent lab tests, and run one real-time scanner. - URL: https://computese.com/choose-the-right-antivirus-software-for-your-pc/ - Author: Duong Quan Nguyen, CEO, Computese - Published: 2024-09-29 - Updated: 2026-09-25 - Topics: Security, IT support ## In short - On Windows 11, Microsoft Defender Antivirus in Windows Security is built in and runs from the first start. Keep real-time, cloud-delivered and tamper protection on, and turn on controlled folder access, which is off by default. - A paid suite mostly adds extras (VPN, password manager, identity monitoring, parental controls, licences for other devices) rather than better detection: many brands share the same few engines. - Judge detection by the latest AV-TEST, AV-Comparatives and SE Labs reports, reading protection, false positives and performance together, across more than one round and more than one lab. - Run one real-time antivirus, ignore pop-ups that tell you to call a number, check what a free product does with your data, and in the US replace Kaspersky, barred from updating its software there since September 29, 2024. - A business with several PCs needs endpoint detection and response (EDR) managed from one console, such as Microsoft Defender for Business, and a named person who acts on its alerts. For most people on Windows 11, the right antivirus is the one already running: Microsoft Defender Antivirus in Windows Security, with real-time, cloud-delivered and tamper protection switched on. Pay for a suite only for extras you will use, pick it from recent independent lab results, and run one real-time scanner, never two. This guide covers what Windows already does and how to check it, what a paid suite really adds, how to read the AV-TEST, AV-Comparatives and SE Labs reports without being misled by small differences, the red flags (scareware, free products that sold browsing data, the US ban on Kaspersky), what Macs and phones rely on instead, and when a small business should move from antivirus to endpoint detection and response (EDR). If you are setting up a new PC, start with our guide to [setting up Windows 11](https://computese.com/how-to-set-up-windows-for-a-new-computer/). ## Do you need antivirus on Windows 11? You need antivirus protection, and on Windows 11 you already have it. The [Windows Security app](https://support.microsoft.com/en-us/windows/security/windows-security/stay-protected-with-the-windows-security-app) is part of Windows and protects the PC from its first start. It brings together Microsoft Defender Antivirus, the Windows Firewall and Smart App Control. Defender Antivirus is included at no extra cost, and it watches for the everyday threats: viruses, ransomware, and spyware such as the keyloggers described in our guide to [snooping attacks](https://computese.com/understanding-snooping-attacks-how-they-work/). The protection is several features, not one scanner: | Feature | What it does | Where to find it in Windows Security | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Real-time protection | Scans files and programs as they are opened, downloaded or run | [Virus & threat protection](https://support.microsoft.com/en-us/windows/security/threat-malware-protection/virus-and-threat-protection-in-the-windows-security-app) > Manage settings | | Cloud-delivered protection | Asks Microsoft's cloud about files Defender has not seen before; on by default | Virus & threat protection > Manage settings | | Tamper protection | Stops other apps from switching Defender's settings off | Virus & threat protection > Manage settings | | Controlled folder access | Lets only trusted apps change files in protected folders; off by default | Virus & threat protection > Ransomware protection | | [Microsoft Defender SmartScreen](https://learn.microsoft.com/en-us/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/) | Warns about reported phishing and malware sites, and about downloads that are not well known | [App & browser control](https://support.microsoft.com/en-us/windows/security/windows-security/app-browser-control-in-the-windows-security-app) > Reputation-based protection | | Potentially unwanted app (PUA) blocking | Blocks apps that are not strictly malware but show ads, mine cryptocurrency or do other things you did not ask for | App & browser control > Reputation-based protection | | Smart App Control | Blocks malicious or untrusted apps; apps that Microsoft's cloud model trusts, or that carry a valid signature, run | App & browser control | [Cloud-delivered protection](https://learn.microsoft.com/en-us/defender-endpoint/cloud-protection-microsoft-defender-antivirus) is the part that matters most against new malware. When Defender meets a suspicious file it has not seen before, such as a program just downloaded from the internet, it sends a query about the file, including its hash, to Microsoft's cloud protection service. If the service cannot decide at once, Defender locks the file and uploads a copy for deeper analysis, then the file is either allowed to run or blocked in all future encounters. Microsoft calls this [block at first sight](https://learn.microsoft.com/en-us/defender-endpoint/configure-block-at-first-sight-microsoft-defender-antivirus), and says that in many cases it cuts the response to new malware from hours to seconds. It only works while cloud-delivered protection is on. ![A laptop holds a newly downloaded file under an orange lock while a cloud checks its fingerprint and sends back a shield with a check mark. Two other laptops get the same verdict.](https://computese.com/images/blog/choose-the-right-antivirus-software-for-your-pc/cloud-check.a32ec7aea5-1536.webp) *A new file is held until the cloud decides, and that decision is reused the next time the file turns up.* How good is the free, built-in product? Independent labs test it alongside paid suites. In [AV-TEST's June 2026 round](https://www.av-test.org/en/antivirus/home-windows/windows-11/june-2026/) of Windows 11 home products, tested in May and June, Microsoft Defender Antivirus scored 6 of 6 for protection, 5.5 for performance and 6 for usability: 17.5 of a possible 18. In [AV-Comparatives' Real-World Protection Test](https://av-comparatives.org/tests/real-world-protection-test-february-may-2026/) for February to May 2026, it blocked 396 of 400 test cases, placing it in the top results cluster, with no false alarms. SE Labs gave it a total accuracy rating of 98% in its April to June 2026 home report. This guide does not rank products, and those results do not make Defender the best choice for everyone. They do mean that good detection does not require a subscription. > [!IMPORTANT] > Antivirus does not replace security updates. [Windows 10 reached end of support](https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/windows-10-support-has-ended-on-october-14-2025) on October 14, 2025, and Microsoft warns that a PC without security updates is at greater risk from viruses and malware. Antivirus cannot close the flaws that patches fix. Upgrade to Windows 11, enrol in consumer Extended Security Updates (available until October 12, 2027) or replace the PC; our guide to [updating your computer or phone](https://computese.com/how-to-update-your-computer-or-phone/) covers each route. ## Check the protection Windows already gives you A few minutes in Windows Security tells you whether the built-in protection is actually on. Open it from the Start menu (type _Security_), then: 1. **See who is protecting the PC.** Select **Virus & threat protection**, then under **Who's protecting me?** choose **Manage providers**. If another antivirus is listed as the active one, Defender Antivirus is standing aside (see the red flags below). 2. **Check the core switches.** Under **Virus & threat protection settings**, select **Manage settings** and confirm that **Real-time protection**, **Cloud-delivered protection**, **Automatic sample submission** and **Tamper protection** are on. With tamper protection on, other apps cannot change these settings; as an administrator you still can, here. 3. **Update the definitions.** Select **Protection updates > Check for updates**. Windows also downloads this security intelligence through Windows Update. 4. **Turn on ransomware protection.** Select **Manage ransomware protection** and switch on **Controlled folder access**. 5. **Check reputation-based protection.** In **App & browser control > Reputation-based protection**, keep SmartScreen and potentially unwanted app blocking on, and look at the state of **Smart App Control**. To check the same things from PowerShell, for example on several PCs, run: ```powershell Get-MpComputerStatus | Select-Object AMRunningMode, IsTamperProtected, RealTimeProtectionEnabled ``` `AMRunningMode` reads `Normal` when Defender Antivirus is the active antivirus, and `True` in the other two columns means [tamper protection and real-time protection](https://learn.microsoft.com/en-us/defender-endpoint/tamper-protection-windows-configure) are on. [Controlled folder access](https://learn.microsoft.com/en-us/defender-endpoint/controlled-folder-access-overview) deserves the extra step because it is off by default. Once on, it lets only trusted apps change files in protected folders: Documents, Pictures, Videos, Music and Desktop by default, plus any folder you add. Defender decides which apps to trust from their prevalence and reputation. When an unknown app, such as ransomware, tries to encrypt or delete files there, the change is blocked and you get a notification. ![Three padlocked folders sit behind an orange shield. A trusted app's arrow reaches a folder, while an unknown app's arrow stops against the shield.](https://computese.com/images/blog/choose-the-right-antivirus-software-for-your-pc/folders.2cde5d86e6-1536.webp) *Ransomware has to rewrite your files; controlled folder access decides which programs are allowed to.* If it blocks a program you use, allow that one app rather than switching the feature off, and allow as few as you can: an allowed app that is later compromised can change those folders too. Two limits are worth knowing. Controlled folder access works only while Defender Antivirus is the active antivirus with real-time protection on, and it is not a backup. The ransomware page in Windows Security can connect OneDrive so that files can be restored after an attack; keep a backup either way. ## What a paid antivirus suite actually adds Mostly features around the antivirus, rather than a better antivirus. Detection engines are shared more widely than brand names suggest. AV-Comparatives notes that G Data, Total Defense and VIPRE use the Bitdefender engine, that F-Secure, Fortect and TotalAV use the Avira engine, and that AVG and Norton use the Avast engine. In its February to May 2026 Real-World Protection Test, Avast One Free Antivirus, AVG AntiVirus Free and the paid Norton Antivirus Plus each blocked 397 of 400 test cases: the same result, free or paid. What the money buys is the rest of the box. The product reviews in [AV-Comparatives' Summary Report 2025](https://av-comparatives.org/tests/summary-report-2025/) describe extras such as VPNs, password managers, dark web scanners, identity protection, cloud backup, parental controls and firewalls. A suite is worth it when you would otherwise pay for those separately: | Extra | Worth paying for when | | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Licence for several devices | You want one subscription across PCs, Macs and phones. Many vendors sell licences for five devices that can be mixed across Windows, macOS and Android. | | VPN | You often use public Wi-Fi and have no VPN already. Check the data allowance: when AV-Comparatives reviewed Avira Free Security for 2025, its VPN was limited to 1 GB a month. | | Password manager | Nobody in the household uses one yet. | | Identity or dark web monitoring | You want alerts when your email address or personal details appear in leaked data. | | Parental controls | You need content filters and time limits on children's devices. | | Cloud backup | You have no other backup. A backup is the real recovery plan for ransomware, whichever product you run. | If you already pay for Microsoft 365 Personal or Family, the subscription includes the Microsoft Defender app for Windows, Mac, iOS and Android, which may cover the multi-device need on its own. Check the price you will pay in year two. AV-Comparatives found that most vendors apply auto-renewal when you buy from their website, that the majority make it mandatory, and that the renewal price can be much higher than the first-year discount. Its advice is to judge protection, performance and ease of use first, and price last. One trade-off is easy to miss. On a home PC, installing a third-party antivirus puts Defender Antivirus into [disabled mode](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-compatibility) automatically (or passive mode, if Smart App Control is on or in evaluation). With it go Defender's real-time and cloud-delivered protection, controlled folder access and potentially unwanted app blocking. The suite then has to cover ransomware and unwanted apps by itself, so check that it does. ## How to read independent antivirus tests Three labs publish regular, detailed tests of Windows antivirus for home users. Each measures slightly different things, so read at least two. As of September 2026, the latest reports are: | Lab | Latest home-user reports | What it measures | How it scores | | --------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | AV-TEST | Windows 11, June 2026 round (tested May and June 2026, 16 products) | Protection against zero-day attacks and widespread malware; slowdown when opening websites, downloading, launching and installing apps and copying files; false warnings and blocks | Up to 6 points each for protection, performance and usability, 18 in all; 10 points earns the seal of approval, 17.5 the TOP PRODUCT award | | AV-Comparatives | [Real-World Protection Test](https://av-comparatives.org/tests/real-world-protection-test-february-may-2026/), February to May 2026 (released June 15, 2026, 400 test cases); [Malware Protection Test](https://av-comparatives.org/tests/malware-protection-test-march-2026/), March 2026 (released April 15, 2026, 10,000 test cases); [Performance Test](https://av-comparatives.org/tests/performance-test-april-2026/), April 2026 (released April 22, 2026) | Attacks arriving from the web; malware arriving by USB drive, network drive or already on disk; system impact on a low-end PC; false alarms in each protection test | Awards by statistical results cluster; products with above-average false positives are downgraded | | SE Labs | [Home Anti-Malware](https://selabs.uk/reports/endpoint-security-eps-home-2026-q2/), April to June 2026 (report written July 27, 2026) | Targeted attacks built from well-established techniques, plus public email and web threats; how legitimate software is handled | Protection accuracy and legitimate accuracy combined into a total accuracy rating | AV-Comparatives also published a [factsheet for July and August 2026](https://av-comparatives.org/tests/real-world-protection-test-july-august-2026-factsheet/) on September 11, 2026; the lab releases its full Real-World reports, with a false-alarm test and awards, in June and November. To read any of these without being misled: 1. **Read protection and false positives together.** A false positive is a clean file or website wrongly blocked. A product that blocked everything would top a protection chart and be unusable, which is why [AV-TEST](https://www.av-test.org/en/antivirus/home-windows/windows-11/june-2026/microsoft-defender-antivirus-consumer-4.18-261315/) scores usability (in the June 2026 round, its usability test included a system scan of 1,223,746 legitimate files), AV-Comparatives downgrades awards for above-average false alarms, and SE Labs folds legitimate software into its total rating. 2. **Treat small gaps as ties.** AV-Comparatives groups results statistically and considers every product in a cluster equally effective, provided its false positives are below average. With 400 test cases, one missed test case moves a product by 0.25 percentage points. 3. **Look at more than one round and more than one lab.** AV-Comparatives itself advises against buying on the strength of one test, or one type of test, and suggests trying the product before paying. 4. **Match the edition.** Labs test named editions and versions, free or paid, and AV-Comparatives says its performance results apply only to the exact versions it lists. A vendor's free product and its top suite can share an engine and still differ in features. 5. **Weigh performance against your hardware.** AV-Comparatives runs its performance test on a machine it calls low-end: an Intel Core i3 with 8 GB of RAM and an SSD. If your PC is older or modest, read that column first. 6. **Check the test follows a standard.** The Anti-Malware Testing Standards Organization (AMTSO) publishes a testing standard. [AV-TEST's 2026 Windows consumer series](https://www.amtso.org/tests/av-test-windows-consumer-test-series-2026/) is confirmed compliant with AMTSO Standard v1.3, and SE Labs' report went through AMTSO certification. Treat a comparison that publishes no method as marketing. Each report covers a window of one to four months, and products change between rounds. That is why the reports carry dates, and why this guide points to the rounds current in September 2026 instead of naming a winner. ## Red flags when choosing antivirus ### Pop-ups that say your PC is infected Scareware is fake security software, or a fake warning, designed to frighten you into paying, installing something or calling a number. The [FTC describes the pattern](https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams): a pop-up that looks like it comes from a well-known company says there is a problem with your computer and urges you to call; the person who answers asks for remote access, pretends to scan for viruses, then charges to remove a problem that does not exist. The FTC's rule of thumb is short. Real security warnings never ask you to call a phone number, and legitimate tech companies do not contact you by phone, email or text to say your computer has a problem. The same scammers send fake renewal invoices that use names such as McAfee and Norton. Check your card statement, and contact the company through a number you know is real, never the one in the message. Genuine detections appear in Windows Security, not on a web page, and SmartScreen in Microsoft Edge can warn you about known tech support scam sites. > [!WARNING] > Never give remote access to someone who contacted you first about a virus, and never install "security" software that a pop-up or a caller tells you to download. ### Two real-time scanners at once Two antivirus products that both scan in real time get in each other's way, and Windows is designed to prevent it. On Windows 10 and 11 home PCs, Defender Antivirus steps aside automatically when another antivirus registers as the primary one. Microsoft warns that if the Windows Security Center service has been disabled, Defender cannot detect the other product and stays active; the two then conflict, which hurts performance and is not supported. Uninstall the old product before installing a new one, then confirm under **Manage providers** that exactly one antivirus is on. ### Free antivirus paid for with your browsing data A free product has to make money somewhere. In February 2024 the US Federal Trade Commission [charged that Avast](https://www.ftc.gov/news-events/news/press-releases/2024/02/ftc-order-will-ban-avast-selling-browsing-data-advertising-purposes-require-it-pay-165-million-over) had collected browsing data through its antivirus software and browser extensions, kept it indefinitely and, from 2014 to 2020, sold it through its subsidiary Jumpshot to more than 100 third parties, while telling users its products would block tracking. The [final order, in June 2024](https://www.ftc.gov/news-events/news/press-releases/2024/06/ftc-finalizes-order-avast-banning-it-selling-or-licensing-web-browsing-data-advertising-requiring-it), required Avast to pay US$16.5 million and banned it from selling, disclosing or licensing web browsing data for advertising. The lesson applies to any free product. Read its privacy policy, and during installation decline the data-sharing programs and browser extensions you do not need; AV-Comparatives' reviews describe installers that offer both. ### Vendors your government restricts: Kaspersky in the US In June 2024 the US Department of Commerce issued a [Final Determination](https://www.govinfo.gov/content/pkg/FR-2024-06-24/html/2024-13532.htm), published in the Federal Register on June 24, 2024, finding that Kaspersky's cybersecurity and antivirus software poses undue and unacceptable risks to US national security; among the risks it cited, the company is subject to the jurisdiction of the Russian government. According to the [Bureau of Industry and Security](https://www.bis.gov/kaspersky): - from July 20, 2024, Kaspersky could no longer enter new agreements with US persons; - from September 29, 2024, it may not provide antivirus signature or codebase updates to US customers, or operate the Kaspersky Security Network in the US; - from the same date, reselling Kaspersky software, or building it into other products, is prohibited in the US. The ban is about who controls the software and its update channel, not about detection: Kaspersky Premium still appears in lab tests run outside the US, including AV-TEST's June 2026 round. For a US user, the practical point is that a copy still installed has been cut off from updates since September 29, 2024 and should be replaced; the BIS page links to CISA's removal guides. The determination covers the US and US persons, so elsewhere, check your own government's guidance. ## Antivirus on a Mac, iPhone or Android phone **Mac.** macOS has its own [built-in antivirus, XProtect](https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web). It uses signatures that Apple updates automatically and separately from system updates (a Mac checks for them daily by default), blocks known malware and moves it to the Trash, and adds an engine that removes infections and another that looks for unknown malware by its behaviour. Before that, Gatekeeper and notarization, Apple's malware scan of apps distributed outside the App Store, are designed to stop malware from launching even once. A third-party product earns its place on a Mac when you want one suite across all your devices, or when a business needs central management and reporting. **iPhone and iPad.** Every third-party app runs in a [sandbox](https://support.apple.com/guide/security/security-of-runtime-process-sec15bfe098e/web) designed to stop it gathering or changing information stored by other apps. It also means a security app cannot inspect or clean other apps the way a Windows antivirus does. On an iPhone, the protection you control is installing iOS updates promptly. **Android.** Phones with Google Play have [Google Play Protect](https://support.google.com/googleplay/answer/2812853?hl=en), which is on by default. It checks apps when you install them and scans the device periodically, including apps from outside Google Play, can send unknown apps to Google for a code-level check, and warns about, deactivates or removes harmful apps. Keep it on, be wary of apps from unknown sources, and install system updates as they arrive; our guide to [updating a phone](https://computese.com/how-to-update-your-computer-or-phone/) shows how, including from a computer. ## When a small business needs EDR, not antivirus Antivirus judges files on one PC, and its warnings appear to whoever is sitting at that PC. Once a business has several computers, that model breaks: nobody sees the pattern across machines, and a warning one employee dismisses is lost. [Endpoint detection and response](https://learn.microsoft.com/en-us/defender-endpoint/overview-endpoint-detection-response) fixes both problems. Each device continuously reports behaviour (processes, network activity, sign-ins, registry and file changes) to a central console, related alerts are grouped into incidents, and an administrator can respond remotely, for example by isolating the affected device. ![Five laptops send dotted streams of events to one monitor showing a timeline. One orange laptop is ringed and cut off from the others but still reports to the monitor.](https://computese.com/images/blog/choose-the-right-antivirus-software-for-your-pc/edr.24889f5de4-1536.webp) *With EDR, every PC reports to one console, so someone sees the attack and can cut off the one device that has it.* For small and medium businesses the usual Microsoft route is [Microsoft Defender for Business](https://learn.microsoft.com/en-us/defender-business/mdb-overview), designed for organizations of up to 300 users and included in Microsoft 365 Business Premium or sold on its own. It builds on the Defender Antivirus already in Windows and adds EDR, automated investigation and remediation, and centralized management, with apps for Mac, iOS and Android devices. Its manual response actions include running an antivirus scan, isolating a device, stopping and quarantining a file, and blocking or allowing a file by indicator. Other security vendors sell business EDR as well. The part people underestimate is the person. EDR produces alerts that someone has to read and act on, including outside office hours. Decide who that is before you buy: an internal IT lead, or a provider who watches the console for you. Our [IT support service](https://computese.com/services/it-support/) covers endpoint security for small teams: EDR such as Microsoft Defender for Business, patching for operating systems and apps, and removing local admin rights, alongside device management. Endpoint tools protect laptops and desktops; the websites and servers you expose to the internet need a different check, which our [security scanning](https://computese.com/services/security-testing/) service runs on a schedule. More guides on the subject are under [security](https://computese.com/category/security/). ## Which option fits your situation | Your situation | What to do | | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------ | | One Windows 11 PC | Keep Microsoft Defender Antivirus, check the settings above and turn on controlled folder access | | A household with Macs, phones and children | Consider a suite for its multi-device licence and parental controls, or the Defender app that comes with Microsoft 365 Personal and Family | | An older or low-powered PC | Read the performance results from AV-TEST and AV-Comparatives before switching from Defender | | Still on Windows 10 | Fix the missing updates first: Windows 11, consumer Extended Security Updates or a new PC | | In the US with Kaspersky installed | Replace it: Kaspersky has been barred from updating it there since September 29, 2024 | | A business with several PCs | Move to centrally managed EDR, such as Microsoft Defender for Business, with a named person responsible for the alerts | ## Key terms - **Real-time protection**: Antivirus scanning that runs continuously in the background, checking files and programs as they are opened, downloaded or run, rather than only during a scheduled scan. - **Cloud-delivered protection**: Microsoft Defender Antivirus asking Microsoft's cloud service about files it has not seen before, so new malware can be judged and blocked within seconds instead of waiting for the next definitions update. - **Tamper protection**: A Windows Security setting that stops other apps, including malware, from switching off Defender's real-time protection, cloud-delivered protection and related settings. - **Controlled folder access**: Defender's ransomware protection: only trusted apps may change files in protected folders such as Documents and Pictures. It is off by default and works only while Defender is the active antivirus. - **Microsoft Defender SmartScreen**: Reputation-based protection in Windows and Microsoft Edge that warns about reported phishing and malware sites and about downloads that are not well known. - **Potentially unwanted app (PUA)**: Software that is not strictly malware but shows ads, mines cryptocurrency or does other things you would rather it did not. Windows Security can block it. - **False positive**: A clean file, app or website that security software wrongly flags or blocks. Labs count them because a product that blocks everything is as unusable as one that blocks nothing. - **Scareware**: Fake security software or fake warnings, often browser pop-ups, that claim your computer is infected to frighten you into paying, installing something or calling a scammer. - **EDR (endpoint detection and response)**: Business security software that records behaviour on every device, sends it to a central console, groups alerts into incidents and lets an administrator respond remotely, for example by isolating a device. - **XProtect**: The antivirus built into macOS. It uses signatures that Apple updates automatically to block and remove known malware, plus a behaviour-based engine for unknown malware. ## Common questions ### Is Microsoft Defender good enough for Windows 11? For most home users, yes, as long as real-time, cloud-delivered and tamper protection stay on and Windows is updated. In the latest rounds it scored 17.5 of 18 in AV-TEST's June 2026 test and blocked 396 of 400 test cases with no false alarms in AV-Comparatives' February to May 2026 test. A paid suite makes sense for its extras, not because the built-in protection is weak. ### What is the best antivirus for a PC? There is no single best product, and results move with every test round. Shortlist products that did well on both protection and false positives in the latest reports from at least two of AV-TEST, AV-Comparatives and SE Labs, then choose on the extras you need, the devices covered and the renewal price. ### Is free antivirus safe to use? Microsoft Defender Antivirus is free and built into Windows, and free third-party products can protect well: in AV-Comparatives' February to May 2026 test, free and paid products sharing one engine scored the same. Check how the vendor makes money, though. The FTC's 2024 order against Avast concerned browsing data collected through its antivirus software and browser extensions and sold to third parties. ### Can I run two antivirus programs at the same time? Not two real-time scanners. Windows switches Defender Antivirus off automatically when another antivirus becomes the primary one, and Microsoft says two products both providing active protection conflict, hurt performance and are not supported. Uninstall the old product before installing a new one. ### Does antivirus slow down a computer? A little, and the labs measure how much. AV-TEST times the slowdown when opening websites, downloading files, launching and installing apps and copying files, and AV-Comparatives runs its performance test on a low-end PC. On an older machine, read those results before you switch products. ### Do I need antivirus on a Mac, iPhone or Android phone? Macs have XProtect built in, Android phones with Google Play have Play Protect switched on by default, and iPhones rely on app sandboxing and prompt updates. Keep those on and install updates quickly. A third-party product is optional, useful mainly for a suite's extras or for central management in a business. ## Sources 1. [Stay protected with the Windows Security app](https://support.microsoft.com/en-us/windows/security/windows-security/stay-protected-with-the-windows-security-app), Microsoft Support 2. [Virus and threat protection in the Windows Security app](https://support.microsoft.com/en-us/windows/security/threat-malware-protection/virus-and-threat-protection-in-the-windows-security-app), Microsoft Support 3. [App & browser control in the Windows Security app](https://support.microsoft.com/en-us/windows/security/windows-security/app-browser-control-in-the-windows-security-app), Microsoft Support 4. [Cloud protection and Microsoft Defender Antivirus](https://learn.microsoft.com/en-us/defender-endpoint/cloud-protection-microsoft-defender-antivirus), Microsoft Learn 5. [Configure block at first sight in Microsoft Defender Antivirus](https://learn.microsoft.com/en-us/defender-endpoint/configure-block-at-first-sight-microsoft-defender-antivirus), Microsoft Learn 6. [Microsoft Defender SmartScreen overview](https://learn.microsoft.com/en-us/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/), Microsoft Learn 7. [Configure tamper protection for Microsoft Defender Antivirus on Windows](https://learn.microsoft.com/en-us/defender-endpoint/tamper-protection-windows-configure), Microsoft Learn 8. [Protect folders from ransomware with controlled folder access](https://learn.microsoft.com/en-us/defender-endpoint/controlled-folder-access-overview), Microsoft Learn 9. [Microsoft Defender Antivirus compatibility with other security products](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-compatibility), Microsoft Learn 10. [Windows 10 support has ended on October 14, 2025](https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/windows-10-support-has-ended-on-october-14-2025), Microsoft Support 11. [Test antivirus software for Windows 11, June 2026](https://www.av-test.org/en/antivirus/home-windows/windows-11/june-2026/), AV-TEST 12. [Microsoft Defender Antivirus (Consumer) 4.18: test results, May to June 2026](https://www.av-test.org/en/antivirus/home-windows/windows-11/june-2026/microsoft-defender-antivirus-consumer-4.18-261315/), AV-TEST 13. [Real-World Protection Test February-May 2026](https://av-comparatives.org/tests/real-world-protection-test-february-may-2026/), AV-Comparatives 14. [Real-World Protection Test July-August 2026, Factsheet](https://av-comparatives.org/tests/real-world-protection-test-july-august-2026-factsheet/), AV-Comparatives 15. [Malware Protection Test March 2026](https://av-comparatives.org/tests/malware-protection-test-march-2026/), AV-Comparatives 16. [Performance Test April 2026](https://av-comparatives.org/tests/performance-test-april-2026/), AV-Comparatives 17. [Summary Report 2025](https://av-comparatives.org/tests/summary-report-2025/), AV-Comparatives 18. [Security Evaluation Test Report: Home Anti-Malware (Protection), April to June 2026](https://selabs.uk/reports/endpoint-security-eps-home-2026-q2/), SE Labs 19. [AV-Test Windows Consumer Test Series 2026](https://www.amtso.org/tests/av-test-windows-consumer-test-series-2026/), AMTSO 20. [How To Spot, Avoid, and Report Tech Support Scams](https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams), U.S. Federal Trade Commission 21. [FTC Order Will Ban Avast from Selling Browsing Data for Advertising Purposes, Require It to Pay $16.5 Million](https://www.ftc.gov/news-events/news/press-releases/2024/02/ftc-order-will-ban-avast-selling-browsing-data-advertising-purposes-require-it-pay-165-million-over), U.S. Federal Trade Commission 22. [FTC Finalizes Order with Avast Banning it from Selling or Licensing Web Browsing Data for Advertising](https://www.ftc.gov/news-events/news/press-releases/2024/06/ftc-finalizes-order-avast-banning-it-selling-or-licensing-web-browsing-data-advertising-requiring-it), U.S. Federal Trade Commission 23. [Final Determination: Case No. ICTS-2021-002, Kaspersky Lab, Inc. (89 FR 52434)](https://www.govinfo.gov/content/pkg/FR-2024-06-24/html/2024-13532.htm), U.S. Department of Commerce, Federal Register 24. [Kaspersky Lab, Inc. Prohibition](https://www.bis.gov/kaspersky), Bureau of Industry and Security 25. [Protecting against malware in macOS](https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web), Apple Platform Security 26. [Security of runtime process in iOS, iPadOS and visionOS](https://support.apple.com/guide/security/security-of-runtime-process-sec15bfe098e/web), Apple Platform Security 27. [Use Google Play Protect to help keep your apps safe and your data private](https://support.google.com/googleplay/answer/2812853?hl=en), Google Play Help 28. [Overview of endpoint detection and response capabilities](https://learn.microsoft.com/en-us/defender-endpoint/overview-endpoint-detection-response), Microsoft Learn 29. [What is Microsoft Defender for Business?](https://learn.microsoft.com/en-us/defender-business/mdb-overview), Microsoft Learn