Antivirus for Home Users: Whether You Need It, Device by Device

Most home computers and phones already ship with antivirus that is switched on, so the real question for a household is no longer "which antivirus should I buy" but "is what I already have enough for this device and these people". Windows includes Microsoft Defender Antivirus, macOS includes XProtect, Android includes Google Play Protect, and the UK National Cyber Security Centre (NCSC) says antivirus is of very limited value on an iPhone at all. Paid products still have a place, but usually for reasons other than catching malware files. This guide answers the question per device, explains what antivirus does and does not stop, how to read independent test results, when a paid suite is worth it and the mistakes that leave people less protected than they think. It is for home users, the family member who looks after everyone's devices, and the help desk and security teams who advise staff on personal devices. To compare suites once you have decided to buy, use the Home Antivirus and Security Suite Buyer's Guide; for setting up the rest of the computer, see Securing Home Computers.

Key takeaways

• Built-in protection is the baseline, not a stopgap: Windows, macOS and Android all include on-by-default malware protection that is updated automatically, and for many households it is enough once it is checked and left switched on.
• Phones need different thinking: NCSC guidance says antivirus is not needed on iOS in its default configuration and generally not on Android in default configuration; the bigger risks on phones are scams, malicious apps from outside the store and stolen accounts.
• Run one product, not two: NCSC does not recommend more than one antivirus product on any device, and on Windows installing another product switches Microsoft Defender Antivirus off automatically.
• Most home losses are not malware files: fake virus pop-ups, tech support calls, phishing and password reuse cause much of the harm, so updates, passkeys, a password manager and backups matter as much as the scanner.
• Pay for a reason you can name: a paid suite makes sense for cross-device management, family controls, an older or unsupported system, or features you will actually use, not because a pop-up says your computer is infected.

Do you still need antivirus? The answer by device

The NCSC device security guidance answers the question per platform, and it is the most useful starting point because it is written for organisations that have to justify every tool. The table summarises it alongside what each platform already includes.

The short version: on a supported, updated Windows PC or Mac with the built-in tools switched on, a separate antivirus product adds a small amount of protection. On phones and Chromebooks it adds almost none. The cases where extra antivirus makes a real difference are older systems that no longer receive updates, devices where people routinely install software from unofficial sources, and households that want one console to watch several people's devices.

What the built-in protection actually does

Windows

Microsoft Defender Antivirus provides real-time protection, cloud-delivered protection and scheduled scans, managed from the Windows Security app alongside SmartScreen and the firewall. Microsoft documents that on a home PC, when another antivirus product registers as the active product, Defender Antivirus moves to disabled mode automatically, meaning files are not scanned and threats are not remediated by Defender. It can switch itself back on automatically if the other product expires, is uninstalled or stops providing real-time protection. Microsoft also warns not to disable the Windows Security Center service, because Defender then cannot detect the other product and the two conflict. For setting it up properly, see the Microsoft Defender Antivirus for Home Users Guide.

macOS

Apple describes three layers: preventing malware from launching through the App Store or Gatekeeper with notarisation, blocking malware on the Mac through Gatekeeper, notarisation and XProtect, and remediating malware that has run. XProtect uses YARA signatures that Apple updates automatically and independently of macOS updates, checked daily by default, and it checks apps when first launched, when they change on disk and when signatures update. Apple can also revoke notarisation for a malicious app, and those revocation updates arrive more often than signature updates. See the Mac Security Settings for Home Users Guide.

Android

Google Play Protect checks apps before download from the Play Store, scans the device for potentially harmful apps from other sources, warns about risky apps and may deactivate or remove harmful ones. Google says it is on by default and recommends keeping it on; you can check under Play Store, profile icon, Play Protect, Settings, "Scan apps with Play Protect". See the Android Security and Privacy Settings Guide.

iPhone and iPad

Apps run in a sandbox and cannot inspect other apps, which is exactly why the NCSC says antivirus on iOS has very limited value. App Store "security" apps typically offer web filtering, breach alerts or a VPN rather than malware scanning. See the iPhone Security and Privacy Settings Guide.

What antivirus stops, and what it does not

Antivirus is good at one job: recognising and blocking known malicious files and some malicious behaviour on the device. Many of the ways home users lose money or accounts do not involve a malicious file on the device at all.

The US Federal Trade Commission's guidance on tech support scams sums up the most common home threat that antivirus does not solve: a pop-up that looks like a well-known company and urges you to call, or a call claiming your computer has a virus, followed by a demand for payment by gift card, wire transfer, cryptocurrency or a payment app. The FTC notes that legitimate tech companies do not contact you by phone, email or text about computer problems and that real security pop-ups never ask you to call a number. See the Impersonation Scams Guide.

Where identity fits

For many home users the most valuable thing on the computer is not files but signed-in accounts: email, banking, cloud storage and shopping. Infostealer malware targets exactly that, copying saved browser passwords and session cookies so an attacker can sign in without the password or the MFA prompt. Antivirus reduces the chance of an infostealer running, but the identity controls limit the damage if one does: passkeys cannot be replayed from a stolen file, a password manager keeps every password unique, and signing out of all sessions after an infection kills stolen cookies. Use a standard (non-administrator) account for everyday use so malware has less power, and keep the administrator password separate. See the Passkeys for Everyone Guide and the Infostealer Threat Guide.

How to read antivirus test results

Independent laboratories test consumer antivirus products repeatedly, and their results are more useful than marketing claims or affiliate "best antivirus" lists. AV-TEST tests Windows products for protection against real-world attacks and a reference set of common malware, performance during everyday tasks, and usability measured by false alarms; macOS products on protection, usability and performance; and Android products on protection, usability (including battery life and slowdown) and a feature check. Successful home products receive "AV-TEST Certified". AV-Comparatives runs real-world protection tests with products at default settings over several test periods a year.

• Look at the trend, not one test: a product that scores well across several consecutive test periods is more reliable than one with a single top result.
• Check that the built-in product was tested: Microsoft Defender Antivirus is commonly included in these tests, so you can compare it directly with paid products instead of assuming paid is better.
• Weigh false alarms: a product that blocks legitimate software trains people to click "allow" on everything.
• Ignore feature counts as protection: extra features such as VPNs or identity monitoring are not tested as malware protection.
• Read the date: results age quickly; use the most recent test period that covers your operating system version.

Free built-in or paid suite: decision guidance

When a paid suite is chosen, the deciding factors should be test results over time, compatibility with every device in the household, honest renewal pricing, and a clean uninstall. Avoid "free" products that are bundled with other software or that keep nagging for upgrades with alarming warnings; that style of messaging is close to the scams the product claims to stop.

Setting it up: a household rollout

1. Inventory the devices: list every computer, phone and tablet, its owner, operating system version and whether it still gets security updates. Unsupported devices go to the top of the list for replacement.
2. Confirm built-in protection is on: on Windows, open Windows Security and check Virus and threat protection shows no actions needed and real-time protection is on; on a Mac, confirm automatic installation of security responses and system files is enabled in software update settings; on Android, confirm "Scan apps with Play Protect".
3. Turn on automatic updates everywhere: the operating system, browsers and apps. NCSC also advises updating antivirus immediately when new versions are released.
4. Decide whether to add a paid product: use the decision table. If you install one, uninstall any other third-party antivirus first and check that only one product is active.
5. Make everyday accounts standard users: keep a separate administrator account on shared computers.
6. Add the identity layer: a password manager and passkeys for email, banking and the device account.
7. Set up and test a backup: restore one file to prove it works. See the Backing Up Personal Data Guide.
8. Agree the scam rules: nobody calls a number from a pop-up and nobody gives remote access to a caller. Write down who to call instead.

Rolling back: if a paid product causes slowdowns or conflicts, uninstall it using the vendor's own removal process and confirm Windows Security shows Defender Antivirus active again. Do not simply let a subscription lapse and assume protection continues; check.

Checking it is working

• Status: Windows Security shows a green status for Virus and threat protection; the Play Protect page shows a recent scan; the Mac software update settings show security responses enabled.
• Protection history: on Windows, review Protection history monthly for blocked items and anything marked as allowed.
• Updates: security intelligence or signature updates dated within the last few days.
• One product: only one antivirus product listed as active on each Windows PC.
• Household metrics: number of devices out of support, number of devices without automatic updates, accounts without passkeys or MFA, and date of the last successful backup restore.

Framework mapping

These references help organisations that set policy for staff using personal devices, or that write consumer guidance.

See the CIS Control 10 Malware Defenses Guide for the organisational version.

Common failure patterns

• Two antivirus products installed: a trial bundled with a new laptop plus another product, causing conflicts and slowdowns. NCSC advises one product per device.
• An expired trial left in place: the trial stops protecting, and the household assumes it still does. Check that Defender has switched back on, or remove the expired product.
• Calling the number on a virus warning: the most common route into a tech support scam, which no antivirus can stop once the person grants remote access or pays.
• Treating antivirus as a reason to skip updates: an unsupported operating system with a paid scanner is still an unsupported operating system.
• Buying an iPhone "antivirus" app: paying for scanning that the platform does not allow, while scams and account takeover remain unaddressed.
• Allowing every blocked item: clicking "allow" to make a warning go away, including for cracked software that was correctly flagged.

Practitioner checklist

• Every device listed with owner, operating system version and update support status.
• Built-in protection confirmed on: Windows Security, XProtect and security responses, Play Protect.
• Automatic updates on for the operating system, browsers and apps.
• No more than one antivirus product active on any device; expired trials removed.
• Paid suite bought only for a named reason, checked against recent independent test results.
• Everyday accounts are standard users; administrator credentials kept separate.
• Password manager and passkeys on email, banking and device accounts.
• Backup in place with a successful test restore in the last six months.
• Household scam rules agreed: no calling numbers from pop-ups, no remote access for callers.
• Unsupported devices scheduled for replacement.

Standards and references

• NCSC: Antivirus and other security software
• Microsoft Learn: Microsoft Defender Antivirus compatibility with other security products
• Apple Platform Security: Protecting against malware in macOS
• Google Play Help: Use Google Play Protect to help keep your apps safe
• FTC: How to Spot, Avoid, and Report Tech Support Scams
• AV-TEST: Test procedures
• AV-Comparatives: Real-World Protection Test methodology

Related NHI Mgmt Group resources: Securing Home Computers · Home Antivirus and Security Suite Buyer's Guide · Microsoft Defender Antivirus for Home Users Guide · Infostealer Threat Guide