"Do I still need antivirus?" is a question I'm asked often. The short answer is yes, but probably not in the way we meant it ten years ago. The landscape has changed: operating systems include solid protections, threats are different and a device's security depends on many factors besides the program that scans it.
How modern antivirus works
Early antivirus programs relied almost entirely on signatures: a list of "fingerprints" of known malicious programs, compared against the files on the disk. The method works for threats already known, but it's weak against new or modified ones.
Today's solutions combine several techniques:
- constantly updated signatures, for known threats;
- behavioural analysis: they watch what a program does. If it starts encrypting hundreds of files in a few seconds, or tries to disable protections, it's blocked even if it has never been seen before;
- file reputation, based on how widespread an executable is and who signed it;
- web protection, which blocks phishing pages and dangerous downloads;
- folder protection, which stops unauthorised programs from changing documents and photos.
Is built-in antivirus enough?
For most home users on Windows, Microsoft Defender, included with the system, provides a good level of protection, updates automatically and needs no installation. On macOS the system includes app-checking mechanisms and protection against known malware. On smartphones, the protections of the official store and the operating system do most of the work.
A paid solution can make sense if:
- you want extra features such as central management of several family devices, parental controls or identity protection;
- you prefer a single interface across Windows, macOS and Android;
- you have particular needs, for example a computer used by several less experienced people.
Don't install two full antivirus products at the same time: they get in each other's way and slow the system down without adding protection.
In business: from antivirus to EDR
In a business setting, even a small one, things change. EDR (Endpoint Detection and Response) solutions don't just block: they record what happens on the computers, flag suspicious behaviour to a central console and let you isolate a machine from the network with one click. They're designed to be managed by someone, in-house or external, who reads the alerts.
For a small business, reasonable minimum requirements are:
- centrally managed protection, so you know whether a computer has its defences turned off or out of date;
- alerts that reach a responsible person, not just the user's screen;
- the ability to isolate a device quickly.
What antivirus can't do
Even the best product has clear limits:
- it doesn't stop phishing that involves no malware: if you type your password into a fake site, no malicious file is involved;
- it doesn't fix vulnerabilities: an unpatched system remains attackable;
- it doesn't replace backups: if something goes wrong, it's the backup that saves you;
- it doesn't protect against deliberate choices: if you turn off protection to install a "cracked" program, you've opened the door yourself.
That's why antivirus is one layer of a broader defence, alongside updates, unique passwords, a second factor and backups.
Beware of fake antivirus
One of the most widespread scams is precisely the fake security alert. While you're browsing a page appears, often full-screen and with a sound, saying "Your computer is infected with 5 viruses! Call this number now" or "Download the cleaner now". A browser can't scan your computer: these pages are traps leading to unwanted programs or to fake technicians asking for money and remote access. Close the tab or, if it's frozen, close the browser from the task manager.
In the same way, be wary of "optimiser" and "cleaner" programs that promise to speed up your PC and always find dozens of problems to fix for a fee.
Good everyday practice
- Keep real-time protection and automatic definition updates turned on.
- Turn on folder protection against ransomware, if available.
- Run a full scan if you notice odd behaviour: sudden slowdowns, pop-ups, unknown programs at start-up.
- Don't ignore warnings: if a file is blocked, ask yourself where it came from before forcing it open.
In short
- Antivirus is still needed, but today it combines signatures, behavioural analysis and web protection.
- For home use, the protection built into the system is often enough.
- In business, a centrally managed solution or an EDR with someone reading the alerts is advisable.
- Antivirus doesn't replace updates, backups and vigilance against phishing.
- Virus alerts that pop up in the browser are almost always scams.