Antivirus is one of those things people feel they ought to pay for, usually because a pop-up or a renewal email told them so. Here's the honest version: for most people in the UK, the protection that comes built into your computer or phone is enough — as long as you keep it switched on and keep your devices updated. Below is what you already have, when paying for more might make sense, and the scam that pretends to be antivirus.
Windows: Microsoft Defender is built in, and it's good
Every Windows 10 and Windows 11 computer comes with Microsoft Defender (you'll find it as “Windows Security” in the Start menu). The UK's National Cyber Security Centre says plainly that Windows' built-in malware protection “is suitable” for home users.
Independent testers agree. In AV-TEST's June 2026 test of home Windows products, Microsoft Defender scored full marks for protection and earned their “Top Product” award — alongside paid products that cost £30 to £60 a year.
To check it's on:
- Click Start and type Windows Security.
- Open it and look at Virus & threat protection.
- You want green ticks. If anything says “action needed”, click it and follow the steps.
One thing to know: if you install a paid antivirus, Defender steps aside and lets it take over. If that paid subscription then lapses, make sure Defender switches back on.
Mac: protection is built in too
Apple builds several layers of malware protection into every Mac. Apps downloaded from outside the App Store are scanned by Apple for known malware before they're allowed to run (“notarisation”), Gatekeeper stops untrusted software launching, and XProtect — Apple's own built-in antivirus — “automatically detects and blocks the execution of known malware”, updating itself in the background. For most Mac users, keeping macOS updated is the job.
iPhone: you don't need antivirus (and can't really have it)
On an iPhone, every app runs in its own sealed box. Apple's own security guide puts it like this: sandboxing “is designed to prevent apps from gathering or modifying information stored by other apps or from making changes to the device.” That's why a traditional virus scanner can't work on an iPhone — it isn't allowed to look inside other apps either.
So an app in the App Store calling itself “antivirus” for iPhone is, at best, a bundle of other features (a VPN, a password checker, a scam-call filter). Some of those may be useful; none of them are scanning your phone for viruses. Your real protection is keeping iOS updated and being careful with links and messages.
Android: Google Play Protect is built in
Android phones with the Play Store have Google Play Protect, which runs a safety check on apps before you download them and checks your phone for harmful apps from other sources. It's on by default. To check: open the Play Store, tap your profile picture, then Play Protect, then the settings cog, and make sure Scan apps with Play Protect is on.
The biggest risk on Android isn't a missing antivirus app — it's installing apps from outside the Play Store because a text message or website told you to. Don't. Genuine banks and delivery firms never need you to install an app from a link.
So when might paying for antivirus make sense?
Honestly, in a few cases:
- You're on an old, unsupported version of Windows (Windows 7 or 8, or Windows 10 after its support ended). The better fix is upgrading, but a third-party product is better than nothing meanwhile.
- You want the extras, not the antivirus — a family bundle with parental controls, a password manager or identity monitoring in one bill. That's a convenience choice, not a safety one.
- You run a small business and want central management across several computers.
If you do pay, pick a well-known name that scores well in independent tests (AV-TEST and AV-Comparatives publish their results free), and watch the renewal price — the first-year price is often a fraction of what it auto-renews at.
The scam that pretends to be antivirus
A lot of “you're infected!” warnings are the virus. Watch out for:
- Pop-ups in your web browser saying your computer is infected, often with a countdown, a siren noise or a phone number to call. Real antivirus doesn't live in a web page. Close the tab (or the whole browser) and don't call the number.
- Phone calls from “Microsoft” or your broadband company saying your computer has a virus. The NCSC calls this a common scam: hang up and report it to Report Fraud.
- Emails about antivirus renewals you don't recognise, asking you to call or click to cancel a charge. They want remote access to your computer or your card details.
More on spotting these in our guides to scam emails and scam websites.
What actually keeps you safe
If you only do four things, do these:
- Turn on automatic updates for your computer, phone and apps. The NCSC calls installing updates “one of the most important (and quickest) things you can do to keep yourself safe online.”
- Keep the built-in protection switched on (Defender, Play Protect).
- Use a password manager and different passwords everywhere — our tools page lists free ones.
- Be suspicious of urgency: anything that says “act now” is a reason to slow down.
That's it. No subscription needed — and we earn nothing from telling you so.