Every January my inbox fills with the same worried question, usually from a relative who just saw a scary pop-up: “Should I be paying for antivirus?” Right behind it comes a screenshot of a subscription renewal for $89 and a note asking whether it is a scam or a real bill.
The honest answer in 2026 is calmer than the marketing suggests. Your phone and computer already ship with strong protection built in, and for most people that is enough. Paid antivirus still has a place, but it is a smaller place than it was a decade ago.
Key takeaways
- Windows, macOS, iPhone, and Android all include real, always-on malware protection at no extra cost.
- For most home users, the built-in tools plus good habits beat any paid product you forget to configure.
- Paid antivirus makes sense for shared family PCs, small businesses, or people who click a lot of risky links.
- The biggest threats today are scams and stolen passwords, not classic viruses, so your attention matters more than software.
What “antivirus” even protects against now
The word is a leftover from the 1990s, when viruses spread on floppy disks and email attachments. Today’s threats are broader: ransomware that locks your files, spyware that watches your typing, and fake login pages that steal passwords.
Modern security software tries to catch all of these, but so do the tools already inside your operating system. The question is not whether you have protection: you do. The question is whether you need to add more.
Knowing the difference matters because scary symptoms sometimes have nothing to do with viruses. If your machine feels off, our rundown of the warning signs your device has malware helps you tell a real infection from a slow, aging laptop.
What your device already includes for free
This is the part the ads never mention. Every major platform now ships with capable, always-updating protection that costs nothing extra.
| Device | Built-in protection | What it does |
|---|---|---|
| Windows 10 and 11 | Microsoft Defender | Real-time malware scanning, ransomware folder protection, web filtering |
| Mac | XProtect and Gatekeeper | Blocks known malware and unsigned apps silently in the background |
| iPhone and iPad | App sandboxing | Apps are locked in isolated boxes, so classic viruses cannot spread |
| Android | Google Play Protect | Scans apps before and after install, warns on risky ones |
Microsoft Defender is not a stripped-down freebie. In independent lab tests it now scores near the top, matching or beating many paid competitors at catching malware.
iPhone and Android antivirus apps are mostly theater
Here is a mistake I see constantly: people install a paid “antivirus” app on their iPhone. Because of how iOS locks each app in its own sandbox, a true virus scanner cannot even see other apps, so these tools mostly sell you a false sense of safety plus some extras like a VPN.
On Android, Play Protect handles the basics. A reputable third-party app can add value if you sideload apps from outside the Play Store, but most people never do.
So do you actually need to pay?
For a typical person with a Windows or Mac laptop who keeps software updated and thinks before clicking, the built-in tools plus common sense are enough. Adding a paid suite mainly buys convenience features, not dramatically better protection.
That said, some situations genuinely tip the scales toward paying. Consider it if any of these sound like you.
| Consider paid antivirus if… | Stick with built-in if… |
|---|---|
| You share one PC with kids or several family members | You are the only careful user of your device |
| You run a small business handling client data | You use the device for personal browsing and email |
| You download software from many unfamiliar sites | You mostly install from official app stores |
| You want a bundled password manager and VPN in one bill | You already use separate tools you trust |
Never buy antivirus from a pop-up or a phone call warning you that your PC is “infected.” Real security software never cold-calls you. Those are tech-support scams, and the FTC explains the pattern at consumer.ftc.gov.
Where your money and attention go furthest
If you have $89 a year to spend on staying safe, antivirus is rarely the best use of it. The threats that empty bank accounts today are phishing texts, fake invoices, and reused passwords, not classic viruses.
A password manager, two-factor login, and a real backup will protect the average person far more than any scanner. Those pieces sit at the heart of the broader guide to securing your phone and computer, which is worth reading before you spend a cent.
Keep your system updated too, since most malware exploits holes that patches already closed. CISA’s Secure Our World program lists the same short list of habits that stops the vast majority of attacks.
Think of it as a budget in order of impact. A free password manager and free two-factor login cost nothing and block the attacks that actually drain accounts. A backup drive at around $80 saves you from ransomware. Only after those three are in place does spending on a security suite start to make sense, and even then it is optional for a careful solo user.
If you do get infected anyway
Software is not magic, and even careful people occasionally slip. When that happens, you can usually clean things yourself; our walkthrough on removing malware from your computer covers the exact steps without any support call.
Your afternoon checklist
- Confirm Microsoft Defender or your Mac’s built-in protection is turned on and updating.
- On phones, uninstall any paid antivirus app; the built-in protection already covers you.
- Turn on automatic updates for your operating system and main browser.
- Set up a password manager and turn on two-factor login for email and banking.
- Start one real backup, either cloud or a plugged-in drive, so ransomware cannot hold you hostage.
- Review any auto-renewing antivirus subscription and cancel it if the built-in tools suffice.
- Save the FTC tech-support scam page so you can recognize fake “your PC is infected” warnings.
Antivirus is not a con, but it is also not the shield the ads promise. Turn on what you already own, spend your energy on passwords and backups, and you will be safer than the person who paid for a suite and never opened it.
