You don't need to pay for antivirus software – here's why

In June, the United States Department of Commerce announced a ban on Kaspersky software. As ZDNET’s Lance Whitney reported, as of September 29, Kaspersky is no longer able to provide antivirus signature updates and code updates for the banned products to customers in the US. The company even migrated a million of its customers to a lesser-known replacement product.

Also: Microsoft cracks down on Windows 11 upgrades for ‘incompatible’ PCs, but there’s a fix – for now

When I read that news, I was as shocked as anyone. Did someone accidentally press a button that transported us back to 1999? People still pay for third-party antivirus software?

Apparently people do, but good luck finding reliable information on the market for antivirus software in 2024. Most of the data I was able to uncover came from the developers of said software, which is not the most reliable source.

Antivirus software by the numbers

A recent survey by Security.org revealed some believable numbers about the US market. It found that roughly 54% of Americans use the default virus protection that comes with their device, while 46% use third-party antivirus programs.

Also: 7 password rules to live by in 2024, according to security experts

However, of those who install extra protection, only a little more than half (33 million households) pay for the privilege. Norton and McAfee collectively account for 52% of those paying customers, with Kaspersky accounting for a mere 4% of the market. If those numbers are accurate, 1.3 million Americans should be able to demand a refund from Kaspersky later this year.

Here’s the part that jumped out at me from that report:

Older Americans are significantly more likely to use third-party antivirus programs and pay for the software. Those over 65 are twice as likely to subscribe to paid antivirus services than those under 45.

Full disclosure here: I’m in the over-65 demographic, with a full head of gray hair, and I haven’t used third-party antivirus software in decades. But my silver-haired peers are still paying. Why? For the same reason they still use checkbooks. It’s what they grew up with, and it makes them feel comfortable.

It’s also a colossal waste of money.

How to protect your tech in 2024

Regardless of which device category we’re talking about here, you’re likely to be just fine with the default protection that’s included as part of the platform. On a mobile device (iOS or Android), that means the app store that the OS developer manages. On a Mac, the XProtect antimalware technology has been around for over a decade and is effective against mainstream threats.

Also: Sick of ads on Android? Change these 5 settings for more privacy – fast

As for Windows? Well, Microsoft Defender Antivirus, which is included with every Windows PC, routinely aced the tests from third-party labs that measure the effectiveness of security software. The leveling-up process started about seven years ago, and the Microsoft solution has regularly scored between 99% and 100% since then, making it every bit as effective as third-party rivals, free or paid.

Even that result understates the case.

At the turn of the 21st century, when the Windows PC landscape was at its wildest and wooliest, most malware arrived on people’s PCs as email attachments or over networks. Today, those vectors are effectively closed off. 

Automatic updates protect against newly discovered vulnerabilities. Your modern email client blocks any kind of executable file attachment, including script-based files. Network firewalls have come a long way since (checks calendar) 2002. And recent test results show that Microsoft Defender is effective at blocking all of the most popular attack vectors for ransomware and info stealers.

Also: How to use public Wi-Fi safely: 5 things to know before you connect

On average, a modern antivirus app blocks 99.2% of the very few incoming threats that get past the other layers of protection. And even then, your own instincts (“Don’t click that link!”) are also effective. This is why the modern, fully patched consumer PC isn’t really a target of the criminal gangs responsible for modern malware.

The main targets  

Most attacks are launched by sophisticated criminal gangs and aimed at businesses, using vulnerabilities that are more likely to be in third-party software than they are in the OS itself. Russian hackers used SolarWinds management software to hack Microsoft and other high-value targets. A widely-used app called MOVEit, from Progress Software, was exploited in a breach that affected thousands of big companies and government agencies last year, and a new vulnerability was reported in June.

Shell, British Airways, the BBC, and the Canadian province of Nova Scotia were the victims of the MOVEit attack, not random PC users. These days, big-time cybercriminals are focusing on that kind of target. A signature-based antivirus app isn’t going to provide protection against those targeted attacks. Instead, IT departments in large organizations need sophisticated network-based software that allows administrators to monitor for signs of an intrusion in real time.

Also: The best VPN services of 2024: Expert tested and reviewed

Small-fry users are reasonably well protected via default security measures, mostly because determined attackers see no financial benefit in picking on such puny victims. If you’re still paying Norton, McAfee, or Kaspersky for antivirus protection on your home PC, it’s time to let that subscription expire. But if your IT department at work says they want you to install an endpoint monitoring app, take them at their word.

Just make sure it’s not from Kaspersky.

This article was originally published on July 1, 2024, and last updated on Oct. 3, 2024.