Poll Paid vs Free Antivirus in 2026: What are you using, and is it worth paying for?

[Digmor Crusher]

80% of the times

Or maybe because its 80% of users use MD.

 

[Parkinsond]

Or maybe because its 80% of users use MD.

You have good knowledge of statistics

 

[ForgottenSeer 123960]

This is an enthusiast community dedicated to software experimentation and overkill configurations. While the average user can generally stay safe just by practicing good habits to avoid today's rising tide of phishing and scams, we prefer to go the extra mile.

 

[Sampei.Nihira]

You have a unique experience; I think @TairikuOkami shares the same experience, as far as I can recall.

I don't think it's a unique experience.
If you manage to prevent malware from triggering your antivirus for many years, what value does the antivirus you use/or is installed by default have for you?
0
But considering that it's there, and you harden it, you will always have a last line of defense available.

 

[Sorrento]

In my case I have no idea, I am careful but more so now than in the past, so who knows, I do think before I act & generally over the years take into account what an AV tells me, I think it because I am good looking

 

[Sorrento]

The risks today I feel should you get infected are higher than years ago, online banking, social media, all our info online to me this is pretty recent, this was not the case 20 years ago, there is better protection for everyone but there is much more to lose than in the past & less evildoers back then I think, you may 20+ years ago get a virus but not your identity.
(fate will now decide today is the day my systems will be totally taken over by the dark side for what I said)

 

[Parkinsond]

The risks today I feel should you get infected are higher than years ago, online banking, social media, all our info online to me this is pretty recent, this was not the case 20 years ago, there is better protection for everyone but there is much more to lose than in the past & less evildoers back then I think, you may 20+ years ago get a virus but not your identity.

Agree; the attack surface area increased, and during the same period, the protection tools improved.
Still the main player in the process of malware infection is the user behavior.

 

[Sorrento]

Thinking on I had no firewall until the first free Zone Alarm, no hardware or software even when I first used broadband no hardware firewall as I remember. There did not appear to have to need one unless you were a company? Now I have an Asus router with AI protection

 

[ForgottenSeer 116559]

I could get by without any antivirus most likely. In any case, just like the paid suites that try to sell people more than they really need, Microsoft Defender has its share of downsides that I'm reminded of.

MD usually allows passable system performance, but is it the lightest? No.

MD can be hardened, but is it the absolute best security? Probably not.

I've always kept a paid antivirus around.

 

[RansomwareRemediation]

I bought the PC I currently use on 07/23/2021 and have never seen AV intervention unless I initiated it myself.

My previous OS was Windows XP.

Contrary to all the doomsday predictions, I used the PC with Pos Ready2009 updates until 2019, and after support ended, I continued to use the PC until 2021 (when it finally died of old age).

In all these years (2014-2021), I never had an infection without real-time AV.

I use WD mainly for the AE module, which is derived from EMET.
For me, AV is therefore not as essential a component as it is for other users.

Not using antivirus is the worst thing you can do as a user, whether you are an expert or not. It's like getting into a car and not wearing a seat belt, because you think you will never have an accident. It doesn't happen until it happens. Getting infected is the same. It doesn't happen to you until it happens. And it doesn't matter exactly what your level is.

 

[monkeylove]

You can buy various AVs in online stores for around 3-5 dollars per year per device. Just choose sellers with the highest ratings.

 

[TairikuOkami]

The risks today I feel should you get infected are higher than years ago, online banking, social media, all our info online to me this is pretty recent

When Vistax64 came around, 80% malware literally was not compatible. Windows itself has become so secure, that the attack surface has shifted to browsers and phishing.

Not using antivirus is the worst thing you can do as a user, whether you are an expert or not. It's like getting into a car and not wearing a seat belt,

Seat belts can actually kill at high speeds, they are designed for cities. Nothing is just black or white as portraited by media.

because you think you will never have an accident. It doesn't happen until it happens.

And that is another issue, majority think that AV will protect them 100% and they act surprised, if they get infected.
I do not expect it, I do not trust anything, I have multiple banks, backups and I can redo everything within hours.

 

[Sampei.Nihira]

Not using antivirus is the worst thing you can do as a user, whether you are an expert or not. It's like getting into a car and not wearing a seat belt, because you think you will never have an accident. It doesn't happen until it happens. Getting infected is the same. It doesn't happen to you until it happens. And it doesn't matter exactly what your level is.

I didn't use real-time AV on my old PC running Windows XP.
That PC was too slow to handle the additional slowdown caused by real-time AV, and I took it to university as a security model, let's say an alternative to the usual one, for my students.
Now I'm retired and that old PC is dead.

My current and only PC has MD installed.
So the conclusion is that you read what I wrote carelessly and superficially.

 

[RansomwareRemediation]

When Vistax64 came around, 80% malware literally was not compatible. Windows itself has become so secure, that the attack surface has shifted to browsers and phishing.

Seat belts can actually kill at high speeds, they are designed for cities. Nothing is just black or white as portraited by media.

And that is another issue, majority think that AV will protect them 100% and they act surprised, if they get infected.
I do not expect it, I do not trust anything, I have multiple banks, backups and I can redo everything within hours.

in fact it is totally the opposite. It has been proven that the seat belt would save your life in the event of a fatal blow, something that exists in all cars.
Saying that is like seeing that your antivirus is going to infect you. Nothing is infallible, but it is better to have it than not.
Life is yours and so is the data, you decide.

 

[Parkinsond]

in fact it is totally the opposite. It has been proven that the seat belt would save your life in the event of a fatal blow, something that exists in all cars.
Saying that is like seeing that your antivirus is going to infect you. Nothing is infallible, but it is better to have it than not.
Life is yours and so is the data, you decide.

Moderation is key.
No AV at all is an extreme.
Insisting on the highest tier of paid AV is also an extreme.

 

[ForgottenSeer 123960]

The trouble with analogies is that they are often open to interpretation. To put it simply, your security suite or antivirus should be considered your last line of defense, not your first. While it is imperative to have one, your primary defense must be good digital habits and staying informed. This includes maintaining external backups for any 'what if' scenarios. Build a defense-in-depth strategy, and you can enjoy your system without the paranoia.

 

[TairikuOkami]

Saying that is like seeing that your antivirus is going to infect you.

There was malware that literally used AVs to infect, because AVs use SYSTEM by default, all popular brands were affected. AV is like VPN, people trust it 100%.

Moderation is key.
No AV at all is an extreme.

That is media talking, you will not get magically infected, we do not live in Harry Potter world. It is all ABC. Break the chain, break the infection. It is a simple as that. Media say that if you connect to the internet without AV, you will get infected within seconds, well not anymore. I was infected by Sasser worm, during a clean install, several times in a row.

 

[RoboMan]

There was malware that literally used AVs to infect, because AVs use SYSTEM by default, all popular brands were affected. AV is like VPN, people trust it 100%.

That is media talking, you will not get magically infected, we do not live in Harry Potter world. It is all ABC. Break the chain, break the infection. It is a simple as that. Media say that if you connect to the internet without AV, you will get infected within seconds, well not anymore. I was infected by Sasser worm, during a clean install, several times in a row.

You're right: infection is not magic.
It’s a chain of events.
But the mistake is assuming you can always see every link in that chain.

Modern attacks don’t look like this anymore: connect to internet - random exploit - instant infection

They look like this: legitimate interaction - trusted process - memory injection - token theft - persistence

No drama. No obvious mistake.

“Good surfing habits” don’t stop everything.

Even if you:

1. Don’t download shady files
2. Use an adblocker
3. Avoid pirated software
4. Keep Windows updated

There are still realistic infection paths:

• Supply-chain compromises (remember CCleaner case back in 2017)
• Malicious browser extensions
• Zero-day browser exploits

And as for phishing, this technique doesn't require being "dumb" anymore. It has evolved dramatically. It is:

• OAuth consent abuse
• Fake SSO login portals
• Reverse proxy phishing kits
• MFA token replay
• Session cookie theft

Even advanced users can click a legitimate-looking GitHub or Microsoft login, approve an OAuth application or run a signed but trojanized installer.

AV with web protection can block known phishing domains, detect malicious redirect chains, flag unusual authentication activity.

Also, drive-by isn't dead, it's just different (to say it that way).

• LOLbins
• PowerShell abuse
• mshta abuse
• Rundll32 injection
• Signed vulnerable driver abuse

You might download a legit tool that later loads a vulnerable signed driver, disables kernel callbacks, or injects into LSASS.

An AV with kernel telemetry can detect:

• Driver loading anomalies
• Credential dumping patterns
• Suspicious memory reads of LSASS

Even power users cannot manually monitor all that in real time.

The rational defense of AV is not: “You’ll get infected instantly!!!".
It’s: risk management means layering controls.

​

 

[Parkinsond]

There are still realistic infection paths:

• Supply-chain compromises (remember CCleaner case back in 2017)
• Malicious browser extensions
• Zero-day browser exploits

Exist, but represent a minor percentage; if so frequent, we will find a large percentage of MT members asking for help dealing with infections everyday.

And zero-day browser exploit will introduce a also a zero-day malware, meaning it is zero-day also for AV; relying on behavioral protection to detect is like gambling.

Also, drive-by isn't dead, it's just different (to say it that way).

• LOLbins
• PowerShell abuse
• mshta abuse
• Rundll32 injection
• Signed vulnerable driver abuse

Blocking LOLbins at the firewall level may provide mitigation; the rest relis on AMSI (available for MD as for most 3rd party AVs) and behavioral protection (which can miss with both MD and 3rd party AVs, or can detect but late enough letting damage to occur).

For signed vulnerable driver abuse, MD provide detection and blocklists, similar to 3rd party AV.

An AV with kernel telemetry can detect:

• Driver loading anomalies
• Credential dumping patterns
• Suspicious memory reads of LSASS

Available for both MD (both in security center and by ASR rules) and 3rd party AVs.

Even power users cannot manually monitor all that in real time.

Power user need not to live in fear monitoring everything and lose the joy of using his/her machine; just to be cautious to avoid exposure to infection.

 

[ForgottenSeer 123960]

Power user need not to live in fear monitoring everything and lose the joy of using his/her machine; just to be cautious to avoid exposure to infection.

There's a fine line between avoiding paranoia and falling into complacency. For many, overconfidence is the fatal flaw that eventually invites the very issues they thought they were too smart to catch, and frankly, calling oneself a 'power user' like a title is usually just the beginning of that descent.