I sat with a client recently who was paying over $300 a year for an antivirus subscription. She uses Chrome, checks email, does her banking, and prints things. That's the whole job.
She didn't need any of it. What made the visit memorable wasn't the software — it was how hard it was to stop paying for it.
I'm not going to name the company, because this isn't really about one of them. The whole category works this way now.
Windows Defender scores the same as the paid ones
This is the part most people don't know, because the last time they checked it was probably true that the built-in option was weak. That hasn't been the case for years.
AV-TEST is an independent German lab that tests security products on Windows every couple of months and scores them out of 6 in three categories. Their June 2026 results:
| Product | Protection | Performance |
|---|---|---|
| Defender | 6 | 5.5 |
| Paid suites | 6 | 6 |
"Defender" there is the free one already sitting on your computer; "paid suites" is every major subscription product in the same test. Usability — how often a product wrongly flags something safe — came out 6 out of 6 across the board, so I've left that column off.
Look at the column that matters. The free one already on your computer catches 6 out of 6 — the same protection score as every paid product in the test. Defender's half-point gap is in Performance, meaning how much it slows the machine down. Not in what it stops.
So the honest version of the pitch is: a few hundred dollars a year for half a point of system responsiveness, on a laptop that spends its day showing you a browser. That's the actual trade being offered.
What about a Mac
Same answer, different plumbing. macOS has XProtect scanning for known malware, Gatekeeper refusing to run unsigned software, and notarisation checks on anything you download. It's less visible than Defender because there's no dashboard to look at, which is largely the point.
The third-party Mac antivirus market is even harder to justify than the Windows one.
So what are you actually paying for?
Once the free option caught up, these companies had to sell something else. What you get now is a bundle — a VPN, a password manager, "dark web monitoring," identity insurance, a PC cleanup tool — wrapped around an antivirus that isn't doing more than the free one.
Some of those are useful. Almost none are best-in-class, and buying them separately usually costs less and works better.
The bigger problem is the business model. Renewal revenue depends on people not noticing. The intro price is low, the renewal price isn't, the renewal is automatic, and the cancellation path is longer than the signup path. My client's first-year price bore no resemblance to what she'd quietly been paying since.
The protection built into your operating system has no renewal to defend. Microsoft and Apple already sold you the computer, and Defender exists so that Windows isn't a liability to them — not to produce a subscription that has to be re-sold to you every year.
The cancellation tells you what it was worth
Here's the part that convinced me this was worth writing about.
Try to cancel one of these and the price collapses. Three hundred dollars becomes thirty, offered immediately, to keep you from clicking the button.
Nothing about the product changed in those five seconds. The only thing that changed is that they found out you were paying attention.
If thirty dollars is a price they can profitably offer you on the spot, then three hundred was never what the thing cost. It was what could be collected from someone who wasn't looking. A company confident in its value doesn't need a trapdoor price under the real one.
You'll also find that turning off auto-renewal and cancelling are two different settings in two different places, that the phone menu is longer than it needs to be, and that each screen asks whether you're sure. None of that is an accident, and none of it is a decision you owe anyone an explanation for.
What actually keeps you safe now
Here's the uncomfortable bit: the threat changed, and antivirus mostly didn't follow it. Hardly anyone gets taken down by a classic virus arriving on its own anymore. They get talked into it.
Keep the operating system updated. Boring, unglamorous, and the single highest-value thing on this list. Most successful attacks use a hole that was patched months ago.
Get software from the vendor's own site or the built-in store. Never from a sponsored search result. Fake ads impersonating real software downloads are one of the most common ways people infect themselves right now, and the ad sits above the real link.
Assume any link in an email is lying about where it goes. If a message says there's a problem with your bank, your bank's website is a thing you can type in yourself. Never enter a password on a page you reached by clicking.
Nobody legitimate ever calls you about a virus. Not Microsoft, not Apple, not your ISP. A pop-up with a phone number is the scam itself — the number is the payload, not the warning.
Turn on two-factor authentication and use a password manager. For a normal person in 2026, the realistic disaster isn't a virus, it's someone getting into your email and using it to reset everything else. Antivirus does nothing about that. This does.
Back up your files. Ransomware is the one genuinely scary thing left, and the answer to it has never been detection — it's having a copy it couldn't reach. If you're going to spend money on any of this, spend it here.
When paying still makes sense
I'm not saying never — I'm saying that in nearly every case I actually walk into, it isn't. There's a real case for it when:
- You're a business with compliance obligations — regulated industries often require centrally managed and reported endpoint protection, and Defender alone won't produce the paperwork.
- You manage a lot of machines and need one console showing which ones are patched and which are misbehaving.
- Someone shares the machine who will click anything. A shared family computer is a genuinely different risk profile from your own laptop.
Notice that all three are about management and reporting, not about catching more malware. That's the honest dividing line.
If you're cancelling
Do it from a browser rather than by phone wherever the account page allows it — it's faster and there's nobody talking.
Turn off auto-renewal first. It's usually a separate setting from cancelling, and it's the one that actually stops the charge. People do the second and not the first and get billed anyway.
Then check your card statement next month, and again a year out. Worth doing for every other subscription while you're in there — the money already going out for things nobody uses is almost always larger than people expect.
The point
Money spent on antivirus in 2026 is mostly money spent on the feeling of having done something. The protection is already on your machine and it's genuinely good. The gap between you and a bad day is habits, updates, and a backup.
If you're paying for something like this and you're not sure why, or you'd like someone to look at what you're actually running and tell you what's worth keeping, get in touch. I'll tell you honestly what you can cancel — including when the answer is that you should keep it.