Do I still need to pay for antivirus software?

The paid antivirus market is a legacy of an era when Windows shipped with nothing and malware spread through files. Both facts have changed. The question is worth asking properly rather than answered by habit in either direction, because the answer varies by platform and by who uses the machine.

Safety

Step by step

1. Check what you already have on Windows.Windows includes Microsoft Defender, on by default, updating automatically, and rated well in independent comparative testing. If you have never installed anything, you are already protected. Check it is switched on and not disabled by a previously installed product.
2. Understand the position on macOS.macOS has layered protections: signed application checking, notarisation, a built-in malware removal tool and system integrity protection. Mac malware exists and is mostly adware and fake installers, usually delivered by the user being persuaded to install something. A scanner adds a little; judgement adds more.
3. Understand phones.On iPhone, third-party antivirus cannot scan the system and mostly sells other features. On Android, Google Play Protect scans apps, and the risk concentrates on apps installed from outside the store. Neither platform needs a paid antivirus in the traditional sense.
4. Recognise what antivirus does not stop.Phishing, scam calls, account takeover, credential stuffing, marketplace fraud, invoice redirection. Those are the dominant causes of loss now, and no scanner addresses any of them.
5. Decide by who uses the machine.A single careful adult on an updated Windows machine gains little from a paid product. A shared family computer, a machine used by someone who has been caught before, or a machine that downloads a lot from mixed sources are the genuine cases for extra layers.
6. Avoid the bundled bloatware trap.Trial suites preinstalled on new laptops nag constantly, slow the machine and often disable Defender. Remove them properly with the vendor's own removal tool, then confirm Defender is running again.
7. Add the layers that do more than a scanner.A content blocker in the browser, automatic updates on, a standard rather than administrator account for daily use, and a backup that is disconnected or versioned.
8. Keep an on-demand scanner for second opinions.A free on-demand scanner that you run manually when something feels wrong is useful, and does not conflict with the resident protection.

Alternatives

• Built-in protection only: Microsoft Defender, macOS protections, Play Protect. Free, always on, no nagging, no performance cost worth mentioning. The right default for most households.
• A paid security suite: Adds web filtering, ransomware folder protection, parental controls and identity monitoring. Worth it mainly for shared or high-risk machines, and only from an established vendor.
• Free third-party antivirus: Detection is often fine, but the business model is upselling and, in some past cases, selling browsing data. Defender is free without that trade-off.
• An on-demand scanner: Run manually as a second opinion when a machine behaves oddly. A useful complement rather than a replacement.

Questions people ask