Will Windows antivirus software still be needed in 2022?

For years, I’ve assumed that most people don’t need third-party antivirus programs, and I’ve gleefully passed this suggestion on to others.

After all, Microsoft’s Windows security suite (also known as Windows Defender or Microsoft Defender) offers built-in virus protection for your PC, and it doesn’t cost a dime. I’ve been using it for years and the last time I can remember having virus problems on my PC was over ten years ago.

And yet, if you look around for confirmation of this long-held belief, an alternate universe soon emerges, filled with experts who insist that everyone should pay for antivirus software. This advice comes not only from the companies that sell antivirus suites, but also from reputable sites that conduct reviews of antivirus software (including PCWorld).

Plus, almost every laptop I’ve reviewed for PCWorld comes with some form of antivirus trialware from companies like McAfee and Norton. Those companies pay PC makers for placement, which wouldn’t make sense if no one bought the products, right?

At this point, I’ve heard enough questions from readers — and relatives — that I decided to dig a little deeper. What I’ve learned is that my initial assumptions were largely correct: most people can indeed skate past without additional antivirus software. But that doesn’t mean everyone should, or that you shouldn’t take extra precautions to stay safe.

As a first sanity check on my antivirus assumptions, I did the most obvious thing possible and ask the question on Twitter: Does Microsoft’s built-in Windows security software provide adequate protection for typical PC users?

The consensus answer was: yes, with reservation†

Justin Duino from How-To Geek orphan to his site’s helpful article on the subject, which recommended Windows Security in conjunction with Malwarebytes’ free malware scanner. My fellow freelance journalist Rob Pegoraro too called out a Wirecutter article that came to the same conclusion. Another writer agreed with a similar recommendation†

The reasoning is simple: Windows Security competes with other programs in detecting viruses. While this wasn’t always the case, Microsoft’s detection has improved significantly in recent years, to the point where the independent AV-TEST Institute regularly awards it a perfect 6 out of 6 for protection, usability and performance, surpassing industry averages.

Perhaps more importantly, security is now decentralized, so a single virus scanner is no longer your only line of protection. A few examples:

• Major web browsers can detect and block malicious websites themselves, thanks to tools such as Google Safe Browsing.
• Those browsers can also warn you if you are about to download an unrecognized program.
• Major email providers, such as Gmail and Yahoo, scan attachments for viruses before you can even download them.
• Those same email providers’ spam filters do a great job of keeping malicious emails out of your inbox and alerting you to potential phishing schemes.
• The SmartScreen filter built into Windows warns you if you try to install unrecognized software.

Antivirus is ultimately just another line of defense. For most people, Microsoft’s built-in defenses should be strong enough.

Get a second opinion

So why do some people recommend Malwarebytes as an extra layer of protection? Especially because it’s nice to have a pair of eyes on your computer.

For example, last year I ran a scan in Malwarebytes and picked up a range of potentially unwanted programs associated with my installation of Chrome. While my Chrome installation seemed to work just fine — with no sketchy toolbars or search redirects to be seen — this convinced me to delete my sync data from Chrome, reset settings, and do a fresh Chrome installation. (I suspect it was a misbehaving browser extension.)

But Malwarebytes also has its drawbacks. If you’re not careful during the installation, it will automatically install its own extension in all your browsers, and the free version nags you regularly with upgrade prompts. In addition, unless you disable the real-time protections (which are only available as a 14-day trial for free users), they will override Microsoft’s own virus scanner.

I can still occasionally install Malwarebytes to get a second opinion on my computer’s health, but for now I’ll leave it off my PC as well.

Ian Paul / Foundry

To be clear, third-party antivirus software isn’t a creep without a real utility behind it. While most people don’t have to pay for antivirus software, there are a few more reasons to consider this:

• You need more help with security: Some antivirus programs offer additional security features beyond traditional virus scanning. For example, Avast can monitor webcam usage and allow you to block untrusted apps from capturing video, and it can also warn you if one of your online passwords is involved in a security breach.
• You want to bundle: In addition to additional security features, some antivirus programs offer tools that you would otherwise purchase separately. For example, Norton 360 Deluxe includes its own password manager and cloud storage service. Avast One has a built-in VPN and temporary file cleaning.
• You want more types of protection: Some third-party tools provide additional security methods that are not built into Windows. For example, AVG’s “Behavior Shield” can look for patterns of malicious behavior even when it has not detected a virus, while Avast One has ransomware protection that prevents apps from encrypting your files without permission. (Windows also provides this, but not by default.) Antivirus suites typically provide protection for mobile devices and PCs as well.

However, all of these extra features can bloat your computer, affect its performance, and get in your way, and they may not even be the best tools for the job. I’d much rather use a dedicated password manager than one bundled with antivirus software, and if I needed a VPN I’d choose the provider myself.

While additional antivirus software was essential in the early days of personal computing, today it is just a potential tool in the wider security arsenal, which should also include strong passwords, two-factor authentication, robust data backups, and a healthy dose of common sense. In any case, the experts seem to agree on this.

Want more of this kind of technical advice? Sign up for my Advisorator newsletter, where a version of this column originally appeared.