How to Choose an Antivirus: The 7 Features That Matter
Lab scores, slowdown, false alarms, phishing and ransomware protection, updates and renewal prices: seven things to check before you install an antivirus.
Choosing an antivirus is mostly a question of what to ignore. Every product claims to stop "100% of threats", and the feature lists run to dozens of lines. Seven things actually separate a good choice from an expensive one, and you can check all of them in about ten minutes.
Start with what you already have
Before comparing anything, look at what's on your devices already. Windows 11 comes with Microsoft Defender Antivirus, which includes real-time scanning, cloud-based protection, tamper protection and a ransomware feature called Controlled folder access. Macs have XProtect, which Apple describes as built-in antivirus technology that checks for new malware signatures daily by default. Android phones have Google Play Protect, which scans apps when you install them and periodically afterwards.
So the real question is rarely "which antivirus?" It's "is the free one good enough for me, and if not, what exactly am I paying for?" The seven features below answer that.
1. Independent lab results
Vendors test their own products, and every one of them wins. Ignore that. Two independent labs publish regular, detailed tests of consumer antivirus on Windows, and they're the closest thing this market has to a referee.
AV-TEST, in Germany, scores each product out of 6 for protection, performance and usability, for a total of 18. In its June 2026 test, eight products got a perfect 18, including Bitdefender, Norton, ESET, McAfee and, notably, the free versions of Avast and AVG. Microsoft Defender scored 17.5, losing half a point on performance.
AV-Comparatives, in Austria, throws real malicious websites and downloads at each product. In its February to May 2026 Real-World Protection Test, with 400 test cases, the top result was 99.8% and Microsoft Defender blocked 99.0%.
Two lessons. First, the gap between the free built-in option and the best paid product is now small. Second, a product that doesn't appear in either lab's tests hasn't earned your trust yet, however good its advertising is.
| Product | AV-TEST, June 2026 (out of 18) | AV-Comparatives protection rate, Feb to May 2026 | AV-Comparatives slowdown score (lower is better) |
|---|---|---|---|
| Microsoft Defender | 17.5 | 99.0% | 12.9 |
| Bitdefender | 18 | 99.5% | 9.6 |
| Norton | 18 | 99.3% | 5.3 |
| Avast | 18 | 99.3% | 5.5 |
| ESET | 18 | 98.5% | 4.2 |
| McAfee | 18 | 98.5% | 3.3 |
| Kaspersky | 18 | 99.8% | 3.5 |
Figures from AV-TEST's June 2026 Windows 11 home user test and AV-Comparatives' Real-World Protection Test (February to May 2026) and Performance Test (April 2026). The labs test slightly different editions of each brand. Kaspersky can't be bought or updated in the US.
2. How much it slows your computer
Protection happens in the background, but you feel it when you open files, install programs or copy folders. AV-Comparatives measures this on purpose on a modest PC (a Core i3 with 8 GB of memory), because that's where a heavy antivirus hurts.
In the April 2026 Performance Test, McAfee had the lowest impact score at 3.3, followed by Kaspersky at 3.5 and ESET at 4.2. Microsoft Defender scored 12.9, in the middle of the pack. On a fast, recent laptop you won't notice the difference. On an older machine you might, and this is the strongest practical reason to pay for an alternative.
3. Few false alarms
An antivirus that blocks a harmless program you need is worse than annoying: sooner or later you learn to click "allow" without reading. Both labs count false positives and mark products down for them. In AV-Comparatives' spring test, six products, including F-Secure and Trend Micro, were downgraded a tier for having above-average false positives, whatever their detection rate. When you read a lab report, look at this column as well as the headline score.
4. Web and phishing protection
Most infections start in a browser: a fake login page, a booby-trapped download, an ad that isn't what it looks like. Good security software checks the sites you visit and blocks known phishing pages.
Windows already does some of this through Microsoft Defender SmartScreen, which checks apps, files and websites in Edge and can warn you if you type your Windows password into a malicious site. Many paid suites go further. AV-Comparatives runs an anti-phishing certification that requires a product to block at least 85% of live phishing pages without wrongly blocking any real banking site. In 2026 it certified products from Avast, Bitdefender, ESET, F-Secure, Kaspersky and Norton, among others. Microsoft Defender wasn't included in that test, so there's no direct comparison.
If you or someone in your household clicks on links in emails without much thought, a strong phishing filter is the feature most worth paying for.
5. Ransomware protection
Ransomware encrypts your files and demands payment to unlock them. Most modern products try to spot the behavior, a program suddenly rewriting hundreds of documents, and stop it. Defender's version is Controlled folder access, which lets you choose which folders untrusted apps are allowed to change. It's worth switching on in Windows Security under "Ransomware protection".
Treat ransomware protection as a seatbelt, not a guarantee. The real defense is a backup that the ransomware can't reach, such as an external drive you disconnect after each backup or a cloud service that keeps previous versions of your files.
6. Automatic updates, and a vendor that can keep sending them
An antivirus is only as good as its latest update. The UK's National Cyber Security Centre tells home users to make sure their antivirus is set to update automatically, and that's the default for every reputable product.
The less obvious part is whether the company will be able to keep updating it where you live. Kaspersky scores near the top of every lab test, but in the US the Commerce Department banned new sales from July 2024 and cut off updates from September 29, 2024. Existing users aren't breaking any law, but software that can't learn about new threats gets worse every week. If you're in the US and still running it, replace it.
7. Honest pricing and renewal terms
This is where the most money is lost. Antivirus is sold on first-year discounts and renewed automatically at full price.
Norton AntiVirus Plus, for example, costs $19.99 for the first year and $59.99 a year after that for one device, and Norton may bill the renewal up to 35 days before it's due. Avast Premium Security is $49.08 for the first year, then $77.99 for one PC. Bitdefender's terms state that after the first year you'll be billed at a renewal price which may be higher than the initial price. None of this is hidden, but it's in the small print.
Before you pay, find the renewal price on the checkout page and put a reminder in your calendar a month before the renewal date. If the product still earns its place at full price, keep it. If not, cancel automatic renewal and look again.
What you can safely ignore
Bundled VPNs, password managers, "PC tune-up" tools and identity monitoring can be useful, but judge each one as if you were buying it separately. A VPN with a daily data cap is a sample, not a VPN, and a password manager tied to your antivirus subscription disappears if you switch. The antivirus itself should win you over on the seven points above.
Ignore scary pop-ups too. A browser window that says your PC is infected and gives you a number to call isn't security software. The FTC notes that real security warnings never ask you to call a phone number; it's a tech support scam.
Our advice, for most people on Windows: open Windows Security, check that real-time protection and tamper protection are on, switch on Controlled folder access, and save the money. Pay for a third-party product if your PC is old and feels sluggish, or if you want a stronger phishing filter for the whole family, and read the renewal price first.
Questions readers ask
Is Microsoft Defender good enough on its own?
For most home users, yes. In the latest independent tests it caught almost as much as the best paid products. Its main drawback is that it slows older computers a little more than some rivals.
Do I need antivirus on my phone?
Generally no, if you only install apps from the Apple App Store or Google Play. That's the view of the UK's National Cyber Security Centre. Android also scans apps with Google Play Protect.
Can I run two antivirus programs for extra protection?
Don't. They can interfere with each other and slow your computer down, and the NCSC advises against using more than one on the same device.
I still use Kaspersky in the US. Is that illegal?
No. The Commerce Department has said existing users won't face penalties. But the software stopped receiving updates in the US in September 2024, so it's slowly going blind. Switch to something else.
A pop-up says my computer is infected and gives a phone number. What do I do?
Close the browser and don't call. Real security warnings never ask you to phone anyone. It's a tech support scam, and the FTC collects reports of them at ReportFraud.ftc.gov.