Windows Built-in vs Third-Party Antivirus: A Sober Comparison

Last updated: October 29, 2026 · Based on published vendor documentation and independent test methodology

The antivirus question has a strange property: the operating system already ships with a capable product, most third-party products are not obviously better at the core job, and yet many people install one anyway. Sometimes that is the right call. More often it is a default rather than a decision, and defaults in this category cost money and attention. This guide compares what each side actually does, where a third-party product genuinely adds something, and where it mostly adds a second opinion about a problem you already do not have.

Table of contents

• What the built-in product does
• What third-party products add
• The threat model that matters for most people
• The trade-offs that are rarely discussed
• How to choose, honestly
• A separate note on ransomware
• FAQ
• Bottom line

What the built-in product does

Modern Windows ships with a security suite that is no longer the token offering it was. At its core it does the things that matter: real-time scanning of files as they are opened, protection against known malicious downloads, behaviour-based detection that flags suspicious program activity, and integration with the browser to mark downloads as they happen rather than after they run.

It also has the property no third-party product can replicate: it is already there, it is already integrated with the operating system, and it does not install a kernel-level driver or a network filter to do its job. There is no separate installer, no additional background service to manage, and no separate subscription to renew.

The reason it underperforms in independent test rankings is a different one, and it is worth understanding: it is measured on raw detection rates against curated malware samples, where a specialist product with dedicated research and heuristics has more surface area to catch things. That gap is real. It is also concentrated in scenarios that are unusual for most people, and it is not the same gap as “your files are less protected.”

What third-party products add

A third-party suite is not a replacement so much as an addition, and the additions fall into a few categories.

• Behavioural and heuristic depth. Products in this category maintain their own research pipelines and detection heuristics, and in test rankings they frequently catch samples the built-in product misses. This is the core of the case for paying.
• Additional layers. Depending on the product: script blocking, download reputation, exploit protection, ransomware rollback, webcam and microphone monitoring, and in some cases a firewall with more granular control.
• Consolidated management. If you run several machines — a family set, or a small office — a single console for policy, updates and alerts is a genuine convenience.
• Support and clarity. When something is genuinely wrong — a machine that will not boot, a suspected infection — having a company to call is worth something that does not show up in a detection-rate table.
• Identity protection features. The newer category extends into credential monitoring, session protection and dark-web alerts for breached credentials. These are useful and they are also the features most likely to involve sending data somewhere.

The threat model that matters for most people

Detection rates are measured against a corpus of known samples. That measures one kind of competence, and it is not the kind that decides whether a particular person loses money.

For most people, the realistic losses are phishing, credential reuse across breached services, malicious downloads from search results and messaging apps, and — where money is involved — business email compromise. Note that only one of those four is primarily a malware problem.

Against that distribution, a second scanning engine has a smaller marginal effect than the marketing implies, while the things that address the other three are often free or nearly free: a password manager with breach monitoring, hardware-backed two-factor authentication on the accounts that matter, and verification of unexpected payment requests by a second channel. The framework in do you need antivirus works through how to sort your own requirement before shopping.

There are exceptions. If you download and run software from less controlled sources, or you share a machine with other people, or you are a target because of your work, the marginal value of the stronger engine is higher. This is why the right answer is not universal.

The trade-offs that are rarely discussed

• Performance cost. A second real-time engine consumes CPU, memory and disk I/O, and on a modest machine the effect is visible in ordinary use. This is the most common complaint and the most common reason people uninstall what they just paid for.
• Update cadence and reliability. Third-party engines update their definition files many times a day and can, occasionally, be the component that misbehaves after a large update. Occurrence is low; consequence is high.
• Additional privilege. Products in this category commonly request system-level access, sometimes a kernel driver, sometimes a network filter. That access is a legitimate requirement for the protection to work, and it is also a large surface area.
• Data leaving the machine. Products with cloud reputation lookups, automatic sample submission and identity-protection features send data out. For most individuals this is a routine trade. In some regulated environments it is not a trade that is available at all.
• The subscription treadmill. The price is not the only cost. Renewals, multi-device licensing, and the recurring decision to keep paying for a feature you stopped noticing are all part of the total.
• Duplicate functionality. Frequently, part of what you pay for already exists in the operating system or the browser. Paying for it twice is the most common form of waste in this category.

How to choose, honestly

Work through these in order, and let the answers determine the recommendation rather than starting from a product.

1. List what is actually at risk. Banking, a business, client data, or nothing more sensitive than personal email and photos. The answer sets everything else.
2. Check what you already run. Your browser already blocks some downloads, your operating system already has a real-time engine, and your phone and laptop may each already cover part of the ground. Write down what is covered before paying for more.
3. Identify your weakest link. For most people it is a reused password and a payment request that arrived by email. Fixing that is worth more than any product choice.
4. Decide whether you want a console or a capability. Managing several machines is a good reason to pay. A better detection rate on one laptop is a weaker one.
5. Test the performance cost on your own hardware. Install, leave it a week, and use the machine as you normally would. The spec sheet will not tell you.
6. Set a review date. Decide when you will check whether the subscription is still earning its place, and put it in a calendar rather than leaving it to renewal time.

A separate note on ransomware

Ransomware gets a disproportionate amount of attention, and the discussion tends to conflate prevention with recovery. These are different problems with different answers.

Prevention is mostly not an antivirus question. The dominant initial access route is a human clicking something — a fake invoice, a fake login page, an attachment — and the defences that address it are behavioural, not signature-based: not running as administrator, a password manager that does not autofill on the wrong domain, multifactor authentication on email, and a rule that blocks executable files arriving from messages or downloads.

Recovery is where a commercial product can add something specific, because some suites offer backup and rollback features that restore encrypted or modified files. That is a genuinely different capability from scanning, and it is worth separating in your evaluation: a product can be unremarkable at detection and still be valuable for recovery, or excellent at detection and offer nothing there.

If your exposure is a single personal machine, a straightforward backup you have actually tested restoring from is worth more than either.

FAQ

Is the built-in antivirus good enough?

For most people on ordinary hardware, yes. It handles the large volume of common threats competently and costs nothing and takes no resources to set up. Where it is measurably weaker is in detection rates against certain sample categories, which is a gap that matters more in some situations than others. The framework in do you need antivirus sets out how to decide which situation you are in.

Does running two products cause conflicts?

Historically, yes — two real-time engines scanning the same file can conflict, and both may be disabled by the operating system's tamper protection. Modern products handle coexistence better, but running two suites simultaneously is still generally discouraged: you pay twice, run twice the load, and gain less than the sum of the parts.

What about free versions of third-party suites?

Several are perfectly reasonable and some include a full engine rather than a reduced one. The common trade is that the free tier is the same product with the paid features removed — no identity protection, no some of the extra layers, and no support. If you want the engine, free third-party is a legitimate option; if you want the console or the recovery features, that is where the subscription goes.

Is a third-party suite needed on a Mac?

Generally not, and the built-in protections on current macOS and iOS are integrated at a level third-party products cannot improve on. The exception is the same exception as on any platform: a machine with unusual exposure, or a specific requirement such as centrally managed security for a business.

How do I know if I already have something running?

Your operating system's security settings will show what is registered as providing protection, and the list of installed applications will show any suite you have added. Checking this before buying is the fastest way to avoid paying for something you already have.

Bottom line

The built-in product is a competent answer for a single personal computer, and the difference in detection rates against curated samples is a smaller practical gap than the marketing around it suggests — because most of the ways people actually lose money are phishing, credential reuse and manipulated payment requests, and those are addressed by a password manager, multifactor authentication and a second channel for verifying unusual requests. A third-party suite earns its place when you run several machines and want one console, when your exposure is genuinely unusual, or when you want backup and rollback capability that nothing else in your setup provides. If none of those apply, the free thing already installed is the sensible answer, and the money is better spent on the account-level protections that a scanner cannot help with.

If you have worked out what you actually need and want to see current pricing, the link below goes to our own page for the category.

See current security tool plans →