What Windows, macOS, Android and iOS already do
The short answer
Every current consumer platform ships with security built in, and on three of the four it is switched on by default without any subscription. The useful question is therefore not “am I protected?” but “what would an added product contribute on top of this particular platform?” The answer differs sharply between a Windows desktop and an iPhone, and any advice that treats them as the same case is not worth following.
Windows
Windows includes Microsoft Defender Antivirus as part of the operating system. It runs by default on a machine with no other security product installed, updates through Windows Update, and provides real-time scanning using the methods described in the entry on how detection works. Alongside it sit SmartScreen, which checks downloaded files and visited sites against a reputation service, a firewall that is on by default, and — on hardware that supports it — features such as controlled folder access, which restricts which applications may write to your documents.
Windows is also the platform where added products have the strongest case. It has the largest installed base of general-purpose machines, the most permissive software installation model of the four, and the longest history of malicious software written for it. If you install applications from outside the Microsoft Store, share files widely, or manage machines for other people, the argument for a second opinion is real.
One mechanical detail matters when comparing. Installing a third-party antivirus product on Windows generally causes Defender’s real-time protection to stand down, because two real-time scanners interfere with each other. You are substituting, not stacking. That makes the comparison a genuine like-for-like one, and it is a reason to be unimpressed by any product whose advantage over the built-in option is asserted rather than tested.
macOS
macOS layers several mechanisms that are not presented to the user as a product and have no interface to open. Gatekeeper checks that applications are signed by an identified developer and have been through Apple’s notarisation process before allowing them to run. XProtect is a signature-based scanner built into the system, updated quietly in the background. A separate removal tool can delete known malicious software. System Integrity Protection prevents modification of core system files even by an administrator.
Malicious software for macOS exists and has grown, and the most common route onto a Mac is not a technical flaw but an installer the user was persuaded to open and approve. Adware and fake system utilities are the dominant categories. An added product on macOS is mainly buying broader detection of that grey-zone software and a visible scanning interface, rather than filling a gap where nothing exists.
Android
Android verifies apps with Google Play Protect, which scans applications on the device and checks those installed from the Play Store before and after installation. Applications run in individual sandboxes with permissions the user grants, and can be denied access to contacts, location, messages or storage individually.
The real variable on Android is where applications come from. Installing from outside the Play Store — sideloading — bypasses the review that the store applies, and most Android malicious software reaches devices this way, often as a repackaged version of a popular application offered free. The second variable is update support: manufacturers stop issuing security patches for handsets after a period that varies widely between brands and models, and a device past that point cannot be fixed by any application installed on it.
iOS and iPadOS
iOS is the case where a conventional antivirus product cannot do what its name suggests. Applications are strongly sandboxed and cannot inspect other applications or the system, which is exactly the access a scanner needs. Products sold as antivirus for iPhone are therefore doing something else — web filtering, a VPN, breach notifications, a password manager — and the scanning claim, where it is made, does not describe file scanning on the device.
That is not the same as saying an iPhone is immune. Phishing, fraudulent web pages, malicious configuration profiles, Apple ID compromise and scam calls all work regardless of the sandbox, because none of them requires running code on the device. The defences that matter on iOS are keeping the system updated, securing the Apple ID with two-factor authentication, and recognising the social patterns described in the entry on fake alerts and support scams.
The browser, which is its own layer
On every platform above, a large share of the day’s exposure passes through the browser, and the browser has its own defences independent of the operating system. Chrome, Edge, Firefox and Safari all check pages against lists of known phishing and malware-distribution sites, block most pop-ups, isolate tabs from one another, and warn before a download that looks dangerous. They update themselves frequently, often without the user noticing.
Two habits matter more here than any product. Keep the browser current, since it is the piece of software most exposed to hostile input. And audit extensions occasionally: an extension has far-reaching access to what you read and type, extensions change ownership, and one installed for a reason you no longer remember is worth removing.
The devices nobody thinks of as computers
A household’s router, smart television, camera and printer are computers that happen to be shaped otherwise, and none of them can run antivirus software. They are secured differently: change the default administrator password, apply firmware updates when the manufacturer issues them, turn off remote administration unless it is needed, and put equipment you cannot update onto a guest network so it is separated from the machines that hold your files.
| Platform | Built in by default | Where an added product can add something |
|---|---|---|
| Windows | Microsoft Defender Antivirus, SmartScreen, firewall | Alternative detection engine, broader PUA handling, centralised management of several machines |
| macOS | Gatekeeper, notarisation, XProtect, System Integrity Protection | Adware and grey-zone detection, on-demand scanning with a visible interface |
| Android | Google Play Protect, per-app sandboxing and permissions | Scanning of sideloaded apps, link checking, permission auditing |
| iOS and iPadOS | App Store review, strong sandboxing, system integrity | Not file scanning — sandboxing prevents it. Web filtering or a password manager, sold under a security label |
What to watch out for
- Marketing that implies a device with no added product installed has no protection at all. On all four platforms, that is not the case.
- A single licence advertised as covering several devices, where the protection on some of those platforms is materially thinner than on others.
- Advice to disable built-in protections to make a product work. A product that requires this should be reconsidered.
- Any suggestion that software can compensate for a handset no longer receiving security updates. It cannot.
Working out what you actually need
- List the devices in the household and the platform each one runs. The answer is per-device, not per-person.
- Check whether each device is still receiving security updates from its manufacturer. If not, that is the problem to solve first.
- Ask where software is installed from on each device. A machine that only installs from an official store is in a different risk position from one that does not.
- Confirm that the built-in protection is actually enabled and current before concluding it is insufficient.
- Decide whether the extras in a suite — password manager, backup storage, VPN — are things you would otherwise pay for, since that is often where the value sits rather than in detection.
For configuration guidance that is not tied to a vendor’s product line, the Australian Cyber Security Centre publishes step-by-step advice for securing personal devices and small-business systems.