Every year someone asks me whether they should pay for antivirus, and every year the honest answer becomes slightly more complicated. Not because the software has changed dramatically, but because the threats have, and the thing most people picture when they say “virus” isn’t really what puts them at risk anymore.
Let’s look at what’s actually being sold.
Microsoft Defender is not a placeholder anymore
This deserves stating clearly, because outdated advice persists.
Windows Defender was genuinely poor a decade ago. It caught obvious threats and missed a great deal else, and recommending third-party antivirus was straightforwardly correct.
That’s no longer the case. Microsoft Defender now performs comparably to commercial products in independent testing, with detection rates that place it among credible options rather than as a fallback. It’s built into Windows, requires no configuration, updates automatically, and has no commercial incentive to nag you.
It also has advantages that don’t appear in detection tables: it’s deeply integrated with the operating system, it doesn’t slow the machine noticeably, and it doesn’t display upgrade prompts.
For a reasonably careful user on an up-to-date Windows installation, Defender is a legitimate answer rather than a compromise.
Where detection rates actually differ
Independent testing laboratories publish regular comparisons, and the results are worth understanding correctly.
Top-tier commercial products typically detect somewhere in the high 99 percent range. Defender sits in similar territory, occasionally slightly behind, occasionally not.
The differences are real but small, and the gap tends to be widest for zero-day threats, malware new enough that signature databases haven’t catalogued it. Commercial products often invest more heavily in behavioural analysis that catches unknown threats by how they act rather than what they are.
Whether that difference matters depends on your exposure. Someone who visits mainstream websites, installs software from official sources, and doesn’t open unexpected attachments encounters zero-day threats rarely. Someone downloading software from unofficial sources encounters them regularly.
Be cautious about detection statistics quoted by vendors themselves. Independent laboratory results are the ones worth reading.
What paid suites actually bundle
Modern commercial security products aren’t primarily selling better virus detection. They’re selling a bundle, and evaluating them means evaluating each component separately.
VPN service. Frequently included, often with data limits on lower tiers. Usually less capable than a dedicated VPN provider, fewer servers, slower speeds, less transparent logging policies. Adequate for casual use, insufficient if privacy is the actual goal.
Password manager. Often functional but rarely as good as dedicated alternatives, several of which are free and excellent.
Ransomware protection. This one has genuine merit. Controlled folder access, behavioural detection of mass encryption, and automatic backups of protected files. Windows includes a version of this, but it’s disabled by default and less comprehensive.
Firewall. Windows already includes a competent firewall. Third-party replacements offer more granular outbound control, which matters to some users and is invisible to most.
Parental controls. Genuinely useful if you need them. Windows Family Safety exists but is less featured.
Identity monitoring. Alerts when your details appear in breach databases. Free services provide similar functionality.
Multi-device coverage. A single subscription covering several computers and phones. This is frequently the strongest practical argument for paying, particularly for families.
The real threat model has shifted
Here’s the part that changes the calculation.
Traditional viruses, self-replicating programs spreading between machines, represent a shrinking share of actual harm. What causes most real damage today:
Phishing. A convincing email or message leads you to enter credentials on a fraudulent site. No antivirus intercepts this, because no malicious software is involved. You typed your password into a website voluntarily.
Credential stuffing. Your password from a breached service is tried on your other accounts. Antivirus is irrelevant.
Social engineering. You’re persuaded to grant remote access, install something, or transfer money. The software did what you told it to.
Malicious browser extensions. Installed deliberately, granted permissions, operating within the browser rather than the operating system.
Unpatched software. An outdated application with a known vulnerability, exploited through an ordinary web page.
Against most of these, the effective defences are behavioural and structural rather than software-based: unique passwords, two-factor authentication, keeping software updated, and healthy scepticism about unexpected messages.
Buying premium antivirus while reusing the same password across twelve sites is spending money on the wrong problem.
What genuinely improves your security
If your goal is being safer rather than owning security software, these matter more than the antivirus decision:
A password manager with unique passwords everywhere. This single change eliminates the most common route to account compromise. Several excellent options are free.
Two-factor authentication on important accounts. Email first, since email resets everything else. Authenticator apps are preferable to SMS.
Automatic updates enabled, operating system, browser, and applications. Most successful exploits target vulnerabilities that were patched months earlier.
A good ad blocker. Malicious advertising is a genuine infection vector, and blocking it removes an entire attack surface.
Regular backups. The definitive answer to ransomware. If your files exist elsewhere, encryption becomes an inconvenience rather than a catastrophe.
Scepticism about urgency. Almost every social engineering attack creates time pressure. Any message insisting you act immediately deserves more scrutiny, not less.
When paying makes sense
I don’t want to suggest commercial products are never worthwhile. There are situations where they are: covering multiple devices across a household, particularly with a mix of platforms and users of varying technical confidence; when someone in the household is high-risk, a user who clicks freely, downloads from unofficial sources, or is targeted by scams; when you want ransomware-specific protection and don’t want to configure Windows’ version manually; when you want a single interface managing several security functions and value that consolidation; and for small businesses, where centralised management, reporting, and support have real operational value.
Products to approach carefully
Some things genuinely warrant caution.
“Free” antivirus with aggressive monetisation. Several free products have historically monetised through data collection or bundled software. Read what a free product does with your browsing information.
System optimiser bundles. Products combining antivirus with registry cleaning, driver updating, and “PC speed-up” features. The optimisation components range from useless to harmful, and their presence suggests the vendor’s priorities.
Anything advertised via alarming pop-ups. Legitimate security software doesn’t market through browser warnings claiming your system is infected. Those warnings are themselves the threat.
Products requiring you to disable Defender. Some do this as part of installation, which is normal. Some do it while providing weaker protection.
Running multiple products
Don’t. Two real-time antivirus programs will conflict, flag each other, consume excessive resources, and can leave you less protected than either alone.
The exception is on-demand scanners designed to coexist, tools you run manually for a second opinion without real-time monitoring. These are fine alongside a primary product.
The recommendation
For most home users on Windows 11, keeping Microsoft Defender enabled, adding a good ad blocker, using a password manager, enabling two-factor authentication, and maintaining backups will provide better real-world security than a premium suite alongside poor habits.
Pay for a commercial product if you’re covering multiple devices, protecting less cautious users, or want specific features you’ve evaluated and decided you need.
But make the decision based on what you’re actually defending against, and recognise that the most common ways people lose money and data are ones no antivirus product intercepts.