Norton AntiVirus Plus

Norton AntiVirus Plus is a paid antivirus for one Windows PC, Mac, Android phone or iPhone from Norton, a brand that belonged to Symantec and now belongs to Gen Digital, a US company listed on NASDAQ. The plan includes a firewall, a password manager and 2 GB of cloud backup for Windows; the Norton 360 plans add a VPN and cover more devices.

Independent labs tested Norton in 2026 and gave it top or near-top results on Windows, Mac and Android. The weaker side is what the software sends to the company: suspicious files and the addresses of websites you visit go to Norton, some of it even after you switch data sharing off, and the group’s privacy notice allows sharing data with advertising partners.

What the built-in protection of Windows, macOS, Android and iPhone already covers, and what a paid antivirus adds, is covered in Do You Need an Antivirus?

Lab Results

AV-TEST tested Norton on Windows 11 in July and August 2026, under the name Norton 360, which Norton says includes all the features of Norton AntiVirus Plus, and gave it the maximum 6.0 points for protection, speed and usability. It stopped 100% of 0-day attacks in both months, against an industry average of 99.9%, and raised no false warnings or false detections. The Windows app has scored 6.0 for protection in every two-month round since February 2020. On macOS, AV-TEST’s June 2026 round gave the Norton 360 Mac app 6.0 in all three areas, and on Android its September 2026 round gave the Norton 360 phone app 6.0 in all three, with 99.9% in the real-time test and 100% of recent widespread malware.

AV-Comparatives has tested Norton since 2004, first under the Symantec name, and tests the Windows and Mac apps as Norton AntiVirus Plus and the Android app as Norton 360 Deluxe. In the September 2026 malware test it blocked 9,996 of 10,000 samples, a 99.96% protection rate in the top group, with 15 false positives, seventh of 13 result groups; it received the ADVANCED award, one step below the highest, in an award scheme that counts false alarms. In the real-world test from February to May 2026, which uses malicious websites and downloads, it blocked 397 of 400 attacks, a 99.3% protection rate, had 5 false positives against a test average of 8, and received the highest award, ADVANCED+.

The same lab’s 2026 Mac test found that the Mac version blocked 99.9% of Mac malware and 95% of potentially unwanted Mac apps, with no false alarms, and its May 2026 Android review measured a 99.6% protection rate for the Norton 360 app. Both reviews gave it the APPROVED award. The iPhone app’s store listing describes a check for outdated system versions and a missing passcode, plus scam and web protection, and mentions no malware scanner, and neither lab publishes results for it.

What the Software Sends to Norton

Norton’s product privacy notice lists, for the desktop app, files identified as potential or known malware, file paths, the names of installed applications and the addresses of websites you visit, each kept for 36 months, and says the files are used for sample analysis. This is cloud scanning with whole files uploaded. A feature called Norton Community Watch sends information about possible threats, and when it detects one it also sends the list of running processes, the websites you visited and general system information.

Community Watch can be switched off in Settings ▸ Privacy, but Norton’s support article says “critical data will still be sent even if this option is turned off.” Usage data for product improvement has its own switch. Because part of the collection cannot be stopped, this is telemetry that is always on.

The phone apps send more for their scam features. Safe SMS collects text messages that contain links or come from senders who are not in your contacts; Norton removes personal identifiers and keeps them for up to five years. Safe Call, run with the company Hiya, records incoming numbers that are not in your contacts and the time and length of each call. Safe Email stores whole suspicious emails unless you opt out, and Norton staff may read them to check detections. On Android, the app uses the accessibility service to see the websites you visit and the apps you view on Google Play.

Account and Data Use

Norton follows the privacy notice of its parent company, Gen Digital. It says “We do not sell your personal data to third parties,” but also that the group uses data “to serve you with relevant advertising and content, both on our properties and on third-party properties” and may share personal data with advertising partners where the law allows. The iPhone app’s App Store listing says identifiers and usage data “may be used to track you across apps and websites owned by other companies”; the Android app’s Google Play listing says no data is shared with third parties. Norton’s analytics notice lists Google Analytics, Adobe Analytics, AppsFlyer, Singular and Google Firebase among the tools used in its products and websites, and the desktop app shows promotional notifications for other Norton products until you switch them off. This data use goes beyond protection.

Gen Digital, the company behind Norton, has dual headquarters in Tempe, Arizona and Prague and its privacy team in Tempe, and its notice says it may give data to public authorities and in legal proceedings. For users in the European Economic Area, the company responsible for Norton data is NortonLifeLock Ireland Limited in Dublin, so EU data protection law applies. Norton was Symantec’s consumer brand until November 2019, when Symantec sold its business products to Broadcom and renamed itself NortonLifeLock; in November 2022 the company took the name Gen Digital.

Data Breach and Incident History

On 12 December 2022 Norton detected an unusually large number of failed logins to customer accounts. Its notice to customers says that from around 1 December attackers had tried usernames and passwords obtained elsewhere, such as from the dark web, and got into some accounts; Norton’s own systems were not compromised. The attackers may have seen names, phone numbers and mailing addresses, and Norton could not rule out that they also read passwords saved in Norton Password Manager, especially where the vault password matched the account password. Norton reset the affected passwords, urged customers to change passwords stored in the manager and to turn on two-factor authentication, and offered credit monitoring. Gen Digital told The Record that it locked 925,000 active and inactive accounts; TechCrunch reported that notices went to about 6,500 customers.

In January 2012 Symantec said that source code for 2006 versions of Norton Antivirus Corporate Edition, Norton Internet Security and Norton SystemWorks had been stolen in a 2006 attack, after hackers claimed to have it. It had first said that only code of its business products was involved. Symantec said the code was too old to put Norton customers at greater risk and that it had improved its security procedures since 2006. The 2022 account takeover exposed customer data, while the 2006 theft concerned product code, not customer data; both are listed under data breach history.

Audits and Vulnerabilities

There is no published independent security audit of Norton’s consumer antivirus. Security researchers can report vulnerabilities through a form run by Gen Digital for all its brands, and the page says some reports can earn a reward, a form of bug bounty with no published rules or amounts. Gen Digital publishes security advisories with the affected and fixed versions.

In June 2016 Google’s Project Zero published critical flaws in the scanning engine that Symantec used in all its products, including Norton 360: they needed no action from the user, worked in the default settings and ran with the highest system privileges. Symantec published advisories for its customers. A Canadian class action over alleged design defects in the component that scans file attachments in Norton software sold from 2010 to 2016 ended in a settlement approved by the Ontario Superior Court in May 2024, worth about $21.7 million in cash, free licences and discount codes.

Cryptocurrency Mining and Renewals

From July 2021 Norton 360 shipped Norton Crypto, a program that mined the Ethereum cryptocurrency on the computer’s graphics card while it was idle; Norton kept 15% of what was mined. Norton said the feature ran only after the user opted in, but users reported that the program was hard to remove. After Ethereum stopped supporting this kind of mining in 2022, Norton switched the feature off and removed the program through updates, and its support page says there are no definite plans to restart mining.

In June 2009 Symantec agreed with the New York Attorney General to pay $375,000 jointly with another antivirus vendor to settle charges that it had not clearly told customers their subscriptions would renew and be charged automatically; it agreed to clearer disclosures and to refund auto-renewal fees within 60 days of the charge. Today the cart states the renewal price next to the first-year price.

What Is Included

AntiVirus Plus covers real-time protection against viruses, ransomware and spyware, scam protection for websites and text messages, Smart Firewall on Windows and a firewall on Mac, a password manager and 2 GB of cloud backup on Windows. Norton 360 Standard covers three devices; Norton 360 Deluxe adds a VPN, dark web monitoring, parental controls, Privacy Monitor and 50 GB of backup for five devices. With a firewall and a password manager in the base plan, AntiVirus Plus is a small bundled security suite.

Prices

AntiVirus Plus costs $29.99 for the first year for one device, then $59.99 a year, which the cart states as the renewal price; for five devices it costs $39.99 for the first year and $84.99 a year after that. Norton 360 Deluxe, which adds the VPN and covers five devices, renews at $124.99 a year after a first year at $49.99. Subscriptions renew automatically, the charge can come up to 35 days before the renewal date, and Norton says renewal prices may change. Annual payments can be refunded within 60 days.

There is no free antivirus plan, so no free tier: Norton says AntiVirus Plus is an annual subscription. Norton offers 7-day free trials of its full products on computers, while the phone apps need an annual subscription even for the trial. Free tools exist, among them a password manager app, privacy and email leak scans and Norton Power Eraser, a separate on-demand removal tool.

Pros and Cons

Our Rating

Norton AntiVirus Plus suits people who want lab-tested malware protection with little slowdown on a Windows PC or Mac, and a firewall and password manager in the same subscription. It does not suit anyone who does not want files and website addresses sent to the vendor without a full off switch, who wants a free plan, or who needs malware scanning on an iPhone.