Windows Security vs. Paid Antivirus: What You Actually Need

Windows comes with security software already installed and already switched on. Paid antivirus is sold hard, and often to people who are not sure what they already have.

Here is what is on your computer now, what Microsoft and Apple actually publish about it, and what the security agencies say matters more than the choice of antivirus. The Windows steps on this page are written for Windows 11. Sources are listed at the bottom. This page carries no affiliate links and recommends no product.

Before you buy anything

Find out what you already have. On Windows, search the Start menu for Windows Security. Microsoft’s own wording about its built-in antivirus is that it is on by default, reducing the need for an alternative antivirus on Windows 11.

1. What is already on a Windows computer

The app is called Windows Security and the antivirus inside it is Microsoft Defender Antivirus. Microsoft says the app is built into Windows, ensuring that your device is protected from the moment you start it up, and that if you do not have another security product, or it has expired, Microsoft Defender Antivirus will automatically turn on.

There is no subscription to buy. Microsoft describes the firewall as included with the operating system, so no additional hardware or software is required.

A word about the names, because they are genuinely confusing. Windows Security is the app on your computer. Microsoft Defender Antivirus is the antivirus inside that app. Both are part of Windows and neither costs anything. Microsoft also sells separate products with Defender in the name, including a Microsoft Defender app that comes with a paid Microsoft 365 subscription. Those are different things. If you search for Microsoft Defender you may land on one of them. The protection described on this page is the one already on your computer.

Real-time protection continuously monitors the device for viruses, malware and spyware.
The firewall is included with the operating system and, in Microsoft’s words, enabled by default on all Windows editions.
Ransomware protection, which Microsoft calls Controlled folder access, is designed to protect your files from malicious apps and threats such as ransomware.
App and browser control, which includes reputation checks on apps and files, SmartScreen, and phishing protection.
Device security and protection history, both inside the same app.

How to check it is on, and how to run a scan

Open it: search for Windows Security in the Start menu.
Check protection is on: select Virus and threat protection, then Manage settings.
Run a scan: select Virus and threat protection, then Quick scan.
For a deeper scan: select Scan options instead, where Microsoft offers a Full scan of every file and program, a Custom scan of folders you choose, and an offline scan that runs after a restart without loading Windows.
To check one file: right-click it in File Explorer and choose Scan with Microsoft Defender.

Two protections worth checking are ransomware protection and potentially unwanted app blocking. Ransomware protection sits under Virus and threat protection, then Manage ransomware protection. Potentially unwanted app blocking sits under App and browser control.

2. What happens if you install a paid antivirus

This surprises people, and it is documented by Microsoft rather than a matter of opinion.

Microsoft advises against running two. Its wording: we recommend that you do not run other antivirus or antispyware products at the same time as Windows Defender. And: using more than one real-time security product can affect your PC’s performance.
Microsoft says you do not need a second one. Microsoft security software protects you against malware, spyware, adware and other unwanted software; you do not need to install any other real-time antivirus or antispyware software.
Installing one replaces the built-in protection rather than adding to it. On a home Windows 10 or 11 computer, installing a non-Microsoft antivirus puts Microsoft Defender Antivirus into a disabled state automatically. You are not stacking two layers. You are swapping one for the other.
If the paid subscription lapses, the built-in one comes back. Microsoft: if you do not have another security product, or it is expired, Microsoft Defender Antivirus will automatically turn on.

3. Macs

Apple publishes less about this, and what it does publish is worth knowing.

There is antivirus built in. Apple: macOS includes built-in antivirus technology called XProtect for the signature-based detection and removal of malware.
It works in three layers, in Apple’s own framing: stopping malware launching, blocking it from running, and removing it if it has already run.
It updates itself, separately from system updates. Apple issues the updates for XProtect automatically based on the latest threat intelligence available.
Worth checking: System Settings, Privacy and Security, Background Security Improvements, set to install automatically; and System Settings, General, Software Update, where automatic updates should include system data files and security updates.

Apple publishes nothing for or against additional antivirus software on a Mac. That is silence, and silence is not an endorsement in either direction. Anyone telling you Apple says you do not need antivirus is filling in a gap Apple has left empty.

4. What the security agencies actually emphasize

CISA publishes a list of the things it wants ordinary people to do. It is short, and antivirus is not on it.

Turn on multi-factor authentication. CISA: even if our passwords become compromised, unauthorized users will be unable to meet the second step requirement.
Update your software, and turn on automatic updates. CISA: with automatic updates, our devices will install updates without any input from us as soon as the update is available.
Think before you click. CISA lists the signs: urgent or emotionally appealing language, requests for personal and financial information, shortened links, and addresses that are subtly wrong.
Use strong passwords, ideally with a password manager.

CISA does not say antivirus is unnecessary. It simply is not among the four things it puts in front of people. On Windows, updates are handled under Settings, then Windows Update; Microsoft notes that Windows 11 downloads and installs updates automatically and that updates cannot be turned off permanently.

5. The scams that sell you security you do not need

This is one way people can lose money when shopping for computer security, and none of it involves choosing the wrong antivirus.

The pop-up with a phone number. The FTC: real security pop-up warnings and messages will never ask you to call a phone number. Microsoft: genuine Microsoft error messages never include a phone number to call.
The free security scan. The FTC has described operators impersonating well-known companies and scaring people into paying to fix computer problems that may not exist, charging between $27 and $58 to repair fake threats before recommending technician services costing $199 to $499 more.
The fake subscription renewal. The FTC has warned about messages impersonating Best Buy’s Geek Squad, claiming a large renewal charge and giving a number to call within 24 hours to dispute it. On the call they ask for remote access. The FBI lists virus software renewal among the categories criminals impersonate. The FTC’s advice: if you think the message is real, contact the company using a phone number you know is real, not the number in the message.
Free trials that quietly become subscriptions. The FTC: usually you have to give your credit card number for a free trial, so the company can charge you if you do not cancel before it ends. Before signing up, find out how to cancel. If charges continue after you cancel, dispute them with your card company.
Security software that is not. The FTC’s own caution: some software that claims to be security software to protect you from malware is malware.

Back up your files, because that is what a bad day costs you

The protection above is about keeping trouble out. A backup is what makes trouble survivable. Microsoft’s own reset instruction says it in four words: back up important files before you begin.

On Windows 11, Microsoft publishes the Windows Backup app. Select Start, type backup, and choose Windows Backup, or go to Settings, then Accounts, then Windows backup. Microsoft says it backs up your files, themes and settings, many installed apps, and Wi-Fi information. You sign in with a Microsoft account and turn on the folders you want, which are saved to OneDrive.
On a Mac, Apple publishes Time Machine, which automatically backs up your files, including apps, music, photos, email and documents. You need an external storage device, and Apple recommends one with at least twice the storage capacity of your Mac. Set it up from the Apple menu, System Settings, General, then Time Machine, then Add Backup Disk.
Either way, check it occasionally. A backup you have never confirmed is a plan, not a backup.

If you think something is already on your computer

The FTC’s first instruction is the one people skip: stop shopping, banking, and doing anything else online that involves usernames, passwords or other sensitive information until this is sorted out.

Check you have security software and that it is up to date, then scan the device and delete anything it flags.
On Windows, update the definitions first: Windows Security, Virus and threat protection, then Check for updates under Virus and threat protection updates.
If the same thing keeps coming back, Microsoft recommends the offline scan: Virus and threat protection, Scan options, then Microsoft Defender Offline scan.
Change your passwords and turn on two-factor authentication.
As a last resort, resetting the computer. On Windows: Settings, System, Recovery, then Reset PC, choosing either Keep my files or Remove everything. Microsoft’s own instruction comes first: back up important files before you begin.

Where to report it

Tech support scams and fraud: ReportFraud.ftc.gov
Identity theft: IdentityTheft.gov, or 877-438-4338
Crime committed online, or money lost: ic3.gov, and your local FBI field office
A scam impersonating Microsoft: Microsoft runs its own reporting form for technical support scams.
If you would rather talk to a person: National Elder Fraud Hotline, 833-372-8311

Remember this

Check what you have. Keep it updated. Then decide.

← Back to the Digital Safety Center

Sources

Checked against these official sources on September 22, 2026:

This page is general information, not legal or financial advice.