Do You Need an Antivirus?

Searching for an antivirus usually starts with a plain question: is this computer or phone fine as it is? Windows, macOS, Android, iPhone and Chromebook each ship with their own protection, so the answer depends on what that protection does on each system and what independent labs have measured.

This article goes through the five systems one by one, then looks at what a paid antivirus adds on top and lists the eight antivirus products we have reviewed.

System	Built-in protection	Independent lab results
Windows	Microsoft Defender Antivirus	AV-TEST and AV-Comparatives test it
macOS	Gatekeeper, notarization and XProtect	AV-Comparatives’ 2026 Mac test covers only other companies’ products
Android	Google Play Protect	AV-TEST tests it every two months
iPhone and iPad	App sandbox	Not applicable: an app cannot scan other apps
Chromebook	Built-in protection and Titan C2 security chip, per Google	Google’s own statement only

Windows

Microsoft Defender Antivirus is part of the Windows Security app. If you install a compatible antivirus from another company, Defender turns itself off [1].

Independent labs test it like any paid product. In AV-TEST’s July–August 2026 round on Windows 11, Defender scored 6.0 out of 6 for protection and blocked all 297 zero-day attacks in both months [2]. In AV-Comparatives’ September 2026 malware test it blocked 99.89% of 10,000 samples and landed in the top cluster, but it raised 28 false alarms, meaning harmless files flagged as threats, which AV-Comparatives counts in its “very many” band [3]. AV-TEST counted no false detections of legitimate software in July or August [2]. Both labs ran the product with default settings on one system in one period.

Defender is free, but it sends data to Microsoft. When it cannot decide about a file, it sends details of the file to Microsoft’s cloud, and Microsoft can ask for the file itself [4]. On top of that, Windows sends required diagnostic data, which the Home and Pro editions cannot switch off [5]. Our Microsoft Defender review covers both.

In these two tests Defender sits with the strongest products. Whether that holds on your own setup the labs do not say, and they do not measure what a paid product adds around the scanner, which is the subject of a later section.

macOS

Apple’s security guide describes three layers. When an app is opened, Gatekeeper checks the developer’s signature and Apple’s notarization, a scan for known malware that Apple runs on software distributed outside the App Store. XProtect, the built-in antivirus, compares apps with a list of malware signatures that Apple updates on its own and removes what it finds [6]. Apple says XProtect scans only apps that are opened for the first time or have been changed, and that it also has tools that look for unknown malware by its behaviour [6].

AV-Comparatives says a surge of infostealers dominated new Mac threats in 2023 and 2024. It lists Atomic Stealer and its forks, and MacSync Stealer, which it says was distributed in signed and notarized files to get past Gatekeeper [7]. Microsoft’s May 2026 report describes a campaign in which pages that look like help for Mac problems tell the reader to paste a command into Terminal, an attack style called ClickFix. Scripts started from Terminal do not go through the Gatekeeper checks that an app opened from Finder may get [8].

No lab number exists to put next to the Windows ones. AV-Comparatives’ 2026 Mac test covers nine products from other companies, and XProtect is not among them [7]. The same report says Apple’s approach handles well-established malware but may not respond quickly enough to new threats, and recommends third-party protection [7]. That is the view of the lab that tests those products, not a measurement of XProtect.

These sources neither show that a Mac needs a second antivirus nor that it does not. What the sources do show is how the stealers they describe arrive: as signed files that passed Apple’s checks [7], or as commands a reader pastes into Terminal themselves [8].

iPhone and iPad

Apple’s security guide says every third-party app on iPhone and iPad runs in a sandbox that stops it from collecting or changing information stored by other apps, and that an app reaches data outside its own only through services iOS provides [9]. An antivirus is a third-party app, so on an iPhone it cannot inspect the other apps the way a Windows antivirus inspects programs. Whatever the iPhone version of a security product offers, it is not a scanner of your apps.

In Brazil, Japan and the European Union, Apple also allows alternative app marketplaces and apps installed from a developer’s website. Those apps go through Apple’s notarization, which checks them against basic platform integrity standards, and each marketplace decides how it reviews apps itself [10].

Android

Google Play Protect scans all apps on the phone once a day, wherever they came from, and checks apps in real time when you install them from outside Google Play [11].

AV-TEST has tested it every two months since 2017. Its protection score was 0 out of 6 in every round through November 2021, and 5.5 or 6 in every round since November 2023, including 5.5 in September 2026 [12]. For Android, the answer to the question has changed: an antivirus app made more sense when Play Protect scored zero than it does now.

The risk Google itself points to is sideloading, installing apps from outside Google Play. Google’s March 2026 post says its analysis found over 90 times more malware from sideloaded sources than on Google Play [13]. Google said that from 30 September 2026 developer verification would start rolling out through participating stores in selected regions, with a global expansion in 2027. Apps from unverified developers can still be installed through ADB, Android’s developer tool, or an advanced setup flow [13].

If you install apps only from Google Play, the Play Protect results are the evidence that you are covered. If you install apps from websites or other stores, you are in the group Google’s figure describes. Whether a paid Android app catches more than Play Protect is something the lab results in each review can answer, for the products a lab has tested.

Chromebook and Linux

Google’s Chromebook page says no antivirus software is needed because of built-in protection, and adds that as of May 2025 there was no evidence of a documented, successful virus attack on ChromeOS [14]. That is Google describing its own product.

The GNOME desktop’s help page says antivirus software exists for Linux but most people probably do not need it, because viruses that affect Linux are very rare. It suggests one for checking files you pass to people on Windows and Mac [15].

What a paid antivirus adds

The lab results above show what an antivirus detects. They do not show what else the plan includes. In the plans we reviewed, the additions are:

• More systems in one purchase. Several plans cover Windows, macOS, Android and iPhone under one licence, and the reviews list what each plan counts as a device.
• Bundled tools. A VPN, a password manager, a firewall, parental controls or identity monitoring come in the same purchase, which is what a bundled security suite means. Each of those is a separate product with its own privacy questions, and the antivirus review covers only the antivirus.
• Lab results where the built-in tool has none. On a Mac, the labs publish results for products from other companies and not for XProtect [7].

An antivirus also sees every file it scans, so its own data practices matter. Seven of the eight products we have reviewed send usage statistics from the start, and four of them, Microsoft Defender, McAfee, Norton and Surfshark Antivirus, have no setting to stop it. ESET waits for you to switch it on. This is telemetry, and the reviews give each product’s data use, past data sharing and breaches. Avast’s review covers the sale of users’ browsing data through its Jumpshot subsidiary. Most paid plans cost more at renewal than in the first year, and the reviews list both prices.

People who may want a paid product are those who want one licence for the family’s phones and computers, those who want the bundled tools anyway, and those who install software from the web on a Mac or from outside Google Play on Android.

The antivirus products we have reviewed

Microsoft Defender comes first because it is the one built into Windows. The paid and free products follow in alphabetical order, and Surfshark Antivirus is last because it is sold only inside a bundle. Ratings on the cards come from our reviews; the full comparison is on the antivirus comparison page, and the list of reviews is on /antivirus/.

Free and Windows only. The separate Defender app for Mac, Android and iPhone belongs to a Microsoft 365 subscription.

The free version covers Windows, macOS, Android and iPhone. The review covers the sale of users’ browsing data through Jumpshot and the penalties that followed.

Covers Windows, macOS, Android and iPhone, and adds a VPN, a password manager and identity monitoring. Parental controls come only with the Family plan.

Covers Windows, macOS and Android and adds a firewall and parental controls. The renewal price is not published.

Covers four systems and has a limited free version. Its lab results are for Windows.

Covers four systems and adds a VPN, a password manager and identity monitoring. The renewal price is well above the first-year price.

Covers four systems with a firewall and a password manager. It sends usage statistics with no setting to stop it.

Surfshark One adds a VPN and identity monitoring to the antivirus. Labs have tested the antivirus only occasionally and only on Windows. This site earns a commission if you buy through the link on this card; the order of this list does not depend on it.

Summary

On Windows, the built-in Defender had the maximum protection score in AV-TEST’s July–August 2026 round and sits in the top cluster in AV-Comparatives’ September test, so in these tests a purchase is about the extras and not about detection. On Android, Play Protect has scored 5.5 or 6 out of 6 at AV-TEST since late 2023, which leaves sideloaded apps as the main reason to look at a second check. On iPhone, Apple’s sandbox means an antivirus cannot scan other apps; what a security app adds there is other features. On a Mac, no lab has measured XProtect, so the evidence cuts neither way. On a Chromebook, Google says no antivirus is needed, and the GNOME help page says most Linux users probably do not need one.

If you want one licence for several devices or the bundled tools, the reviews above compare the eight products on lab results, privacy and price.