Built-in protection and what a paid suite adds
Every current consumer operating system ships with malware defences of its own. Knowing what each one already covers is the only way to judge what a subscription would be adding, and the answer differs sharply between Windows, macOS, Android and iOS.
Quick answer
Windows and macOS both include malware protection that runs by default. Android screens apps through Google Play Protect. iOS and iPadOS take a different approach entirely and do not run conventional antivirus scanning at all. A paid suite adds cross-platform management, bundled tools and support — not a missing scanner.
Windows
Current versions of Windows include Windows Security, the interface to Microsoft Defender Antivirus along with the firewall, account protection and browser controls. Microsoft's own documentation describes it as on by default and continuously updated, and Microsoft publishes technical documentation for Defender Antivirus covering how it operates in a managed environment.
One behaviour is worth knowing because it surprises people: when a third-party antivirus product is installed and registers itself with Windows, Defender's real-time protection steps aside so that two engines are not fighting for the same files. Uninstalling that third-party product hands protection back. The practical consequence is that a household is running one active scanner at a time, and the decision is which one — not whether to add a second layer on top of the first.
The other consequence concerns lapsed subscriptions. A paid product whose subscription has expired may stop updating while remaining installed. Checking that Windows Security shows an active provider after a subscription ends is a two-minute task that is easy to skip.
macOS
Apple's approach is layered and largely invisible. Apple's Platform Security guide documents the mechanisms: Gatekeeper checks that software has been signed and notarised before it runs, XProtect matches known malicious content, and the system includes a removal tool for malware families Apple has addressed. None of these presents itself as an antivirus product with a dashboard, which is why Mac users often assume nothing is running.
The frequently repeated claim that Macs cannot get malware is not one Apple makes, and it is not true. The accurate statement is narrower: macOS has default defences comparable in intent to Windows, the volume of malware targeting it has historically been lower, and the most common macOS problems reported by consumers are adware and unwanted software installed by the user in response to a prompt — a category that sits at the edge of what any scanner catches.
Android
Android's main defence is applied before an app reaches the device. Google Play Protect is described by Google as scanning apps from Google Play and checking the device for potentially harmful applications. Apps installed from outside the Play Store — sideloaded from a website or another store — are the case Play Protect is least able to cover, and they are the case where a third-party mobile security product has the clearest role.
Android security also depends heavily on updates, which vary by manufacturer and device age. A handset no longer receiving security patches is running with known gaps that no security app closes. Where an older device cannot be replaced, it is worth restricting what it is used for — keeping banking and email on a supported device — rather than expecting an app to compensate.
iOS and iPadOS
This is the platform where the category's vocabulary breaks down. Apple's security model isolates each app in a sandbox and restricts what any app can see of the system, which means an app on iOS cannot scan the device in the way a Windows antivirus scans a PC. A product sold as iOS antivirus is therefore doing something else: web filtering, a VPN, breach monitoring, or a check of whether the operating system is current. Those can be useful. They are not scanning, and a comparison table that puts a tick in an iOS antivirus column is describing a different function under a familiar name.
Linux
Desktop Linux sits outside the consumer security market almost entirely. Software installed from a distribution's own repositories is signed and reviewed by the distribution, the user account model keeps ordinary work away from administrative privileges, and the population of consumer-targeted Linux malware is small. Scanners exist for Linux and are commonly used on file servers and mail servers to protect the Windows machines downstream rather than the Linux host itself.
What a paid suite is actually adding
Set against the above, the honest list of what a subscription adds is shorter than the marketing suggests, and still worth something to the right household.
| What the suite adds | Already covered by the platform? | Worth paying for when |
|---|---|---|
| One account across several platforms | No — each platform is managed separately | One person is responsible for other people's devices |
| A password manager | Partly — browsers and operating systems include one | The household wants one tool that works everywhere, including outside one vendor's ecosystem |
| A VPN | No | There is a real need — untrusted networks, travel — and the alternative is a second subscription |
| Web and phishing filtering | Partly — browsers filter known malicious sites | Coverage is wanted outside the browser, or across a family's devices |
| Human support | Platform support exists but is general | Nobody in the household wants to be the one who fixes it |
| Cleanup and tune-up tools | Yes, adequately | Rarely; treat as filler when comparing tiers |
Three assumptions that cost households money
“Two products means twice the protection.” Running two real-time scanners together produces conflicts, duplicated quarantine and a slower machine, which is why Windows deactivates its own engine when another registers. The second product is not additive.
“The device came with protection, so it is covered.” New laptops are often sold with a trial of a security suite pre-installed. When the trial lapses, the product may remain visible while no longer updating. Whichever product is relied on, it is worth confirming once that it is the active one.
“A phone does not need any of this.” Partly right and for the wrong reason. Phones are harder to infect than laptops, but they hold the authentication codes that protect everything else, which makes the update status of a phone more consequential than whether a security app is installed on it.
Checking what is already running
Before buying anything, it is worth confirming what the device already has switched on. None of these steps requires a download, and each takes a minute.
- On Windows, open Windows Security from the Start menu and confirm that virus and threat protection shows an active provider, and that Windows Update is current.
- On macOS, confirm that automatic updates are enabled in System Settings and that the version of macOS installed is one Apple still supports.
- On Android, open the Play Store, then Play Protect, and confirm scanning is on; check the security update level under the device's software information.
- On iPhone or iPad, confirm automatic updates are on. There is nothing to scan.
- On every platform, confirm that a backup exists and is recent. The ACSC's personal security guidance treats backups as a first-order measure, and no software in this category substitutes for one.
Where the paid option covered here fits
TotalAV is the paid product in this library, covered under the affiliate arrangement described throughout. The vendor lists applications for Windows, macOS and Linux desktops, for Android and iOS phones, and for iOS, Android and Windows tablets, and sells to Australian customers — which places it in the cross-platform column of the table above. What each plan includes, and how many devices a licence covers, is stated on the vendor's own site and should be read there before purchase.
Advertising link. A commission is paid to Prospect Works by the vendor if a subscription follows from this click; the reader pays the vendor's ordinary price. The assessment above of what a suite does and does not add was not adjusted for it.