Setup guide · Last reviewed 10 November 2026

Do you need a third-party antivirus on Windows 11?

The old advice was to install an antivirus immediately. Here is what changed, what independent labs actually test, and the few cases where a second opinion still helps.

For years the first instruction on a fresh Windows machine was to install a proper antivirus before doing anything else. That advice made sense when the built-in protection was a last resort. It is much harder to defend now, and repeating it unexamined has become its own kind of bad advice.

This page is not a verdict on any product's marketing. It separates three questions that usually get collapsed into one: whether the built-in protection is competent, what a lab test can and cannot tell you, and which habits still decide whether a machine gets infected. Independent test results are summarised here with their publishers named; we do not reproduce score tables.

What the built-in protection already covers

Windows Security is not one scanner. Real-time protection, cloud-delivered lookups, behaviour-based detection, SmartScreen reputation checks for downloads, the firewall, exploit protection and Controlled Folder Access for ransomware all ship with the operating system and are enabled by default on a clean install. Updates arrive through Windows Update, so there is no subscription that can quietly expire mid-year.

That integration is the practical advantage. A third-party engine has to hook into the same system from outside, and Windows steps aside when it does. Installing a second real-time product does not add a second layer; it replaces one with another and adds a background process, a tray icon and an update schedule you now have to maintain.

• Real-time and cloud-delivered protection are on by default after a clean install.
• SmartScreen reputation checks are most effective in Microsoft Edge; other browsers lean on their own safe-browsing lists.
• Controlled Folder Access is optional. Turn it on only after checking which folders your applications need to write to.

What independent labs measure, and what they cannot

AV-TEST runs recurring evaluations of home-user security products on Windows, scoring protection, performance and usability separately. In its November-December 2025 Windows 11 round, Microsoft Defender was among the products that reached the maximum in all three categories. AV-Comparatives runs a different kind of test, exposing products to live malicious URLs found in the field rather than to a stored sample set; its July-October 2025 report used 428 such cases.

Both labs are careful about what their numbers mean, and we should be too. A test describes one product version, on one Windows build, with one set of samples and default settings. It says nothing about a phishing mail that talks someone into approving a payment, a browser extension with too many permissions, or a backup that was never restored. AV-Comparatives restricts reuse of its published results, so we link to the report instead of quoting its figures; that constraint is part of citing a source honestly.

• Protection, performance and usability are separate scores. A product can lead on one and cost you on another.
• A high score is not a guarantee against a threat the test set did not contain.
• Where a lab limits reuse of its data, we describe the method and link out rather than copying the chart.

The tools this step calls for, with their real licence and platform details:

When a second opinion is still worth installing

There is a legitimate use for a second product, and it is narrower than most bundles suggest. An on-demand scanner is useful when you want a second engine to check a file you are unsure about, or to clean up a machine that has already been behaving oddly. Used that way it does not sit in the real-time path and does not conflict with the built-in protection.

The cases for a full replacement suite are mostly about what comes bundled rather than about detection: a VPN, identity monitoring, parental controls, or a support line you can call. If those are what you are buying, say so. Do not tell yourself you bought better malware protection to justify them.

• Never run two full real-time engines at once. Windows will disable one, or both will fight over the same file.
• An occasional on-demand scan is a reasonable second opinion; a permanent second resident process is not.
• If a company manages the machine, its policy wins. Use the tools it approves.

The parts no security product covers

The failure modes that actually hurt home users are rarely a missing signature. They are a downloaded installer from a search ad that looked official, an old router with a known flaw, a browser extension granted permission to read every page, and a backup that has never been tested. Our guide on checking a download before you run it covers the first of those in detail.

A short list of habits does more here than any product comparison: let Windows Update finish, keep the browser current, install fewer browser extensions, and keep a backup you have restored at least once. An antivirus cannot compensate for a machine whose software has not been patched in two years, and no lab score measures whether you have an offline copy of your photos.

The tools this step calls for, with their real licence and platform details:

A five-minute check on a fresh machine

Open Windows Security and confirm that real-time protection and cloud-delivered protection are both on. Look at which product Windows names as the active provider; if it names something you did not install, find out why before adding another. Then check that Windows Update is not paused and that the machine has rebooted since its last update.

Only after that should you decide whether you need anything else. Most people will not. If you do want an on-demand scanner, install it now while the machine is still clean, run one scan, and leave it out of startup. Then move on to the more consequential work: a password manager and a backup you can restore.

The tools this step calls for, with their real licence and platform details:

Mistakes to avoid

• Installing a second real-time antivirus 'to be safe' and ending up with neither working properly.
• Reading a lab score as a promise about your own behaviour instead of a result from a specific test set.
• Turning off SmartScreen because one download was blocked, instead of checking that download.
• Assuming free security bundles are free of cost: they usually come with an upsell and a startup process.
• Forgetting that a restored backup is the only reliable answer to ransomware, whatever the antivirus scored.

Questions people ask

Is Microsoft Defender enough on its own?

For a typical home machine that is kept updated, independent lab results support leaving it as the primary protection. It is not enough if you routinely run unknown installers or never patch the machine.

Should I run Malwarebytes alongside Defender?

As an occasional on-demand scan, yes, that is a reasonable second opinion. As a second always-on real-time engine, no.

Do I need a paid antivirus for online banking?

The paid extras are mostly VPNs, monitoring and support. Banking fraud is far more often a phishing problem, which a password manager and a careful browser do more to address.

Why don't you list the exact test scores?

Two reasons. They describe a specific version and sample set that will be out of date by the time you read this, and one of the labs restricts reuse of its published results. We name the lab, describe the method and link to the report.

Related guides

• New PC setup order
• Checking a download
• A backup you can restore
• Opening archives safely

Or see all guides and category explainers.

Sources and further reading

These are the published sources this guide leans on. We summarise the part that changes a decision rather than copying a review; see the full citation policy.

• The best Windows antivirus software for home users (Nov-Dec 2025) ↗ — AV-TEST Institute · 2025 · Independent lab test. We use this to answer the yes-or-no question of whether the built-in Windows protection is a reasonable default. A lab result describes a specific product version and test set; it does not describe your habits or your backups.
• Real-World Protection Test, July-October 2025 ↗ — AV-Comparatives · 2025 · Independent lab test. AV-Comparatives restricts reuse of its results to cases with prior written agreement, so we do not reproduce its scores or charts here. We link to the report and describe what kind of test it runs. That constraint is part of citing responsibly.