For years, the standard advice was to install third-party antivirus on any new computer immediately. That advice is genuinely outdated for most typical users today, and it's worth understanding why before spending money on something you may not need.
Built-in protection has caught up
Both Windows (Microsoft Defender) and macOS now include real-time malware protection built directly into the operating system, at no additional cost. Independent testing labs — the same ones that evaluate paid antivirus suites — have scored Microsoft Defender's malware detection on par with leading paid products in recent testing, a genuine shift from years ago when built-in protection lagged noticeably behind third-party tools. Microsoft itself has publicly stated that for many users, the built-in protection is sufficient on its own.
What a paid suite actually adds today
The real differentiator between free built-in protection and a paid antivirus suite isn't primarily core malware-blocking ability anymore — independent lab scores between the two are now close. What a paid suite typically adds is bundled extras: a VPN, a password manager, identity theft monitoring, parental controls, and centralized protection across multiple devices and operating systems from one dashboard. Whether that's worth paying for depends entirely on whether you'd actually use those specific extras, not on needing "real" protection that built-in tools supposedly lack.
Where a paid suite (or extra caution) still makes sense
Cross-platform households managing several different device types from one place, people who specifically want an included VPN or password manager rather than buying them separately, and anyone with an unusually high risk profile (handling sensitive business data, frequent exposure to high-risk sites or files) may still get genuine value from a paid suite's centralized management and extra features.
No antivirus, free or paid, protects against every risk
The most common ways people actually get compromised — clicking a convincing phishing link, entering credentials into a fake login page, reusing a password that's already been leaked elsewhere — aren't something any antivirus, free or paid, reliably prevents on its own. Good habits (recognizing phishing attempts, using a password manager, enabling two-factor authentication) do more for practical day-to-day security than the specific antivirus product installed.
The one thing people forget
If you do install a third-party antivirus, don't run it alongside a second one, and be aware that installing one usually automatically disables the operating system's own built-in real-time protection to avoid conflicts. Running multiple antivirus programs simultaneously is more likely to cause performance problems and conflicts than provide additional protection.