The honest starting point
Microsoft Defender, included with Windows, is a competent product. It scores well in independent lab testing, updates automatically, costs nothing, and does not nag you. For a careful user who keeps software patched and does not install much, it is a reasonable place to stop.
That is a real change from a decade ago, and any article that pretends otherwise is selling something.
The question is therefore not whether free protection works. It is whether the gap between free and paid matters for how you actually use your computer.
Where a paid suite still earns its money
Cross-platform households. Defender protects Windows. A single subscription covering Windows, macOS, Android and iOS across a family is the most common legitimate reason to pay.
Web and phishing protection. The strongest paid suites block malicious and fraudulent sites at the network layer, before the browser renders them. That catches things a browser's own list misses.
Ransomware behaviour monitoring. Dedicated protected-folder controls and rollback features are more developed in paid products, and ransomware is the failure mode that actually ruins a year.
People who click. If a household member downloads software from search ads, installs game mods, or opens attachments without pausing, the extra layers pay for themselves.
Our antivirus rankings put Bitdefender (9.7/10) at the top largely on detection with a light performance footprint, and Norton 360 (9.4/10) just behind it on the strength of the bundle.
The bundled extras, ranked by usefulness
Worth having: a password manager, if it replaces bad habits rather than a manager you already use well. Real-time web filtering. Automatic update scanning for outdated software.
Situational: the bundled VPN. Suite VPNs are often capped, slower and thinner on server choice than a standalone service. Fine for occasional public-wifi use; not a substitute if you actually rely on a VPN.
Mostly noise: registry cleaners, one-click optimisers, driver updaters and disk 'boosters'. These sell upgrades rather than solve problems, and a few of them cause the instability they claim to fix.
Read the terms: identity-theft monitoring varies enormously in what it actually does and where it is available. Check the coverage before treating it as a reason to buy.
What antivirus cannot protect you from
Handing over your own credentials. No scanner stops you typing a password into a convincing fake login page. That is what a password manager's domain matching and a passkey prevent.
Approving your own infection. Malware that arrives as a signed installer you deliberately ran, with a UAC prompt you approved, starts from a position of trust.
Unpatched software. An out-of-date browser or operating system is exploited directly, and the scanner is often the last thing to notice.
Account takeover on services you use. If someone gets into your email through a reused password, nothing on your laptop is involved.
A sensible policy by household
One careful adult on one Windows PC: Defender plus a password manager plus prompt updates is defensible. Spend the money on backup instead.
A family with mixed devices: buy a multi-device suite. The coverage and the single dashboard are the product, and they are worth the annual fee.
Anyone handling money or client data: pay. The downside case is not a wiped afternoon, it is a liability, and the layered web protection genuinely reduces the odds.
Everyone, without exception: keep a backup you have actually tested restoring. It is the only control that works after a ransomware event, and no antivirus product replaces it.
Before you buy, check the renewal price
The first year is discounted hard across this entire category, and the renewal is typically two to three times the introductory price. Note the real number and diarise the renewal date.
Do not run two real-time scanners at once. They fight, they slow the machine, and they sometimes quarantine each other. Installing a paid suite should turn Defender's real-time protection off automatically; check that it did.
And check what the licence counts as a device. Some vendors count a phone the same as a PC; others meter them differently, which changes which tier you actually need.