Do I need antivirus on Windows 11?

A new laptop comes out of the box, and on the first evening a window pops up saying your protection expires in 30 days. Pay now, or else. Which raises the question this post is named after: do you actually need to pay for antivirus on Windows 11?

For most homes, no. Windows 11 already has an antivirus, it's switched on out of the box, and it's decent. What I spend my time on isn't which product to buy. It's checking that whichever one is supposed to be running really is.

What Windows 11 already has

Every copy of Windows 11 comes with Microsoft Defender Antivirus, inside an app called Windows Security. Microsoft's own page on the Windows Security app describes what it does: real-time scanning of files as you open and download them, the Windows Firewall, and Smart App Control on PCs where that's turned on. It updates itself through Windows Update. Nothing to install, nothing to renew.

The names don't help. "Microsoft Defender" is also the name of a separate app that comes with a Microsoft 365 Personal or Family subscription and covers phones and Macs as well. If you pay for Microsoft 365, you have that too. If you don't, you still have Defender Antivirus. They're different things with nearly the same name. Neither one needs a third product on top.

What the NCSC says

The National Cyber Security Centre's guidance on antivirus is written for organisations, which makes it more useful here, not less. It says the antivirus built into Windows, macOS and Android "will meet the needs of many organisations". If a business with a security team can rely on it, a family laptop can.

Two other lines from the same page matter more than people expect. If you rely on the built-in product, make sure it's actually enabled. And don't run more than one antivirus on the same device: the benefit is minimal and the two can fight each other, which is where the strange freezes and failed updates come from.

What happens when you install another one

This is the part that catches people. Microsoft's compatibility notes say that on a home Windows 10 or 11 PC, installing a non-Microsoft antivirus puts Defender into disabled mode, automatically. That's deliberate, and it's the right behaviour while the other product is working.

The trouble is the trial. A paid suite that came preinstalled, ran for a month and then started nagging is now the thing Windows thinks is protecting you. Whether it still scans anything after the trial ends depends on the product, and I don't trust any of them to be clear about it. So either pay for it and keep it current, or uninstall it properly and let Defender take over again. The bad option is the one most homes end up in: leaving it there, half-alive, because nobody was sure.

Check it yourself in two minutes

Open the Start menu, type Windows Security and open it. Click Virus & threat protection.

• The top of the page names the product protecting this PC. If it's not the one you think you're using, that's your answer.
• Under Virus & threat protection settings, click Manage settings. Real-time protection should be On, and so should Tamper Protection.
• Further down, Protection updates shows when the definitions last updated. It should be today or yesterday. Last month means something's stuck.

Tamper Protection is the one worth understanding. Microsoft's tamper protection overview is aimed at IT departments, but the point carries: with it on, real-time protection stays on, nothing can quietly add an exclusion, and changes to the antivirus through the registry are blocked. Malware tries to switch off the antivirus before it does anything else. This makes that a lot harder.

You can switch real-time protection off yourself for a few minutes, say to install something awkward, and Windows turns it back on by itself shortly afterwards. If you find it off and you didn't do that, don't just flick it back on. Run a full scan first.

When paying makes sense

I'd pay in two cases. One is a PC still on Windows 10 that isn't getting security updates any more. The NCSC notes that older versions of Windows benefit from third-party antivirus, and a supported product buys you a bit of time while you sort out what to do about Windows 10. It's a plaster, not a fix.

The other is when you genuinely want what the suite bundles: a VPN, a password manager, identity monitoring. Fine. Just know that's what you're paying for. The antivirus engine inside it isn't the reason your PC is safer.

What I wouldn't do is pay because a pop-up told you to. And if a pop-up in your browser says your PC is infected and gives you a number to ring, close the tab. Real antivirus doesn't phone you through a web page.

What antivirus won't stop

Most of what actually goes wrong on home PCs gets past antivirus because it isn't a virus. A convincing email that asks you to type your bank password into a fake page. A browser that saved every password you have and handed them over, which I wrote about in passwords saved in Chrome and Edge. Windows updates that stalled in August and nobody noticed. The whole family signed in as administrator, which is why I'd switch your everyday account to a standard one.

Antivirus is one layer. A good one, free, already there. It's not the plan.

If you'd rather I did it

This is part of the home device security plan, at £10 a month per device. On day one I set each PC up with Defender, or the antivirus you already pay for, plus the firewall, automatic updates, disk encryption where Windows supports it and an everyday account without admin rights. Then every month I check that none of it has been switched off, that updates really are installing, and that nothing has turned up that you didn't choose. You get a short green, amber or red report for each PC. No set-up fee and no minimum term.

If you only want the check done once, try the steps above first. Most people can, and if it all says On and today's date, you didn't need me.

Common questions

Is Microsoft Defender good enough for home use?

For most homes, yes, as long as it's switched on and updating. The NCSC says the built-in antivirus in Windows meets the needs of many organisations. Spend the effort on updates and a standard everyday account instead.

Can I run two antivirus programs at once?

Don't. The NCSC advises against it: the security gain is minimal and the two can conflict. Windows switches Defender off when you install another product anyway, so pick one and keep it current.

Do I need antivirus on my phone?

Usually not. The NCSC says antivirus is of very limited value on iPhones, and Android has Google Play Protect built in. Keep the phone updated and install apps from the official store.