Antivirus Software: What It Does and Whether You Need It

Yes, you need antivirus, and the good news is that you probably already have it. Antivirus is often included for free with Windows and Apple computers, and the National Cyber Security Centre (NCSC), the UK government's cyber security body, says that if you switch on this built-in antivirus, "you'll instantly be safer"¹. On a PC or laptop, the same body's advice when something looks wrong is simple: open your antivirus product and run a scan, then take the actions it recommends².

What antivirus does not do is make you immune. It is one layer among several. The NCSC's position is that you should always use antivirus software and keep it up to date to protect your data and devices, alongside installing software updates promptly, backing up your important files, and being careful what you click¹. This page explains what antivirus actually catches, what it misses, how to keep it effective, and when to run a scan, so you can decide whether the free protection you already have is enough or whether you want a separate product.

What malicious software means

Before choosing software, it helps to know what it is defending against. Malicious software, known as malware, is code that can harm your computers and laptops, and the data on them¹. A local resilience definition used by Essex Prepared puts it more broadly: malware is "malicious software that includes viruses, Trojans, worms or any code or content that could have an adverse impact on organisations or individuals"⁶. Computer viruses, also called malware or spyware, infect your device with a malicious program⁷.

Malware does not usually announce itself. Virgin Media's security help notes that "malicious software can be hidden in other seemingly harmless software and downloads, such as torrents, apps or screensavers"⁸. That is the practical risk for an ordinary household: a free game, a screensaver, a file shared over a torrent, or an app from outside an official store can carry something harmful inside it.

One type deserves special attention. West Yorkshire Prepared defines ransomware as "a type of malicious software (malware) that threatens to publish or blocks access to data or a computer system, usually by encrypting it, until the victim pays a ransom fee to the attacker"⁹. The NCSC describes it more plainly as malicious software that prevents you from accessing your computer or the data stored on it³. Ransomware is covered in more detail on our ransomware page, and the signs of an infection generally are on our malware page.

Do you need antivirus? Yes, and most computers already have it

The short answer from the UK's official guidance is yes. The NCSC's advice is that "it's really important that you always use antivirus software, and keep it up to date, to protect your data and devices"¹. Dorset Prepared's community risk guidance says the same in fewer words: ensure antivirus and malware solutions are installed¹⁰. ProtectUK, the police counter-terrorism security advice service, adds that you should use a firewall and anti-virus software, keep them up to date, and run system scans regularly¹¹.

But "use antivirus" does not mean "buy antivirus". Antivirus is often included for free with Windows and Apple computers¹. Windows has a built-in malware protection tool, Microsoft Defender, which the NCSC links to directly in its guidance¹², and the NCSC's ransomware advice states that "Windows and macOS have built in malware protection tools which are suitable for this purpose"³. That word, suitable, is the key one: the free protection that came with your machine meets the official standard for a home user.

If you want a separate product, you can buy one. The NCSC names McAfee, Norton and Avast as examples of separate antivirus products¹. A paid product is a choice, not a requirement, and the official advice applies whichever you use: make sure your antivirus product is turned on and up to date¹². What matters more than which product you have is that it is switched on, current, and actually scanning.

Phones and tablets are a different case

The advice above is for PCs and laptops. On a phone or tablet, the NCSC says antivirus products don't work in the same way, and "the safest solution is to do a factory reset", usually found in settings⁵. If an app you don't recognise is causing trouble on a phone, the route to a clean device is a reset, not a scan. Age UK notes that free anti-virus apps exist that work on phones and tablets using Windows, Android and Apple products, and that it is a good idea to keep them updated¹³, but for a badly infected phone the official answer remains the reset. Our page on antivirus on phones and tablets covers this in full, and whether to factory reset an infected phone explains the reset itself.

What antivirus software does

An antivirus product is a program designed to detect and remove viruses and other kinds of malicious software from your computer or laptop¹. That is the whole of the job: it watches for code that should not be there, warns you when it finds it, and removes or quarantines what it finds. When the NCSC talks you through recovering from a phishing click, its instruction is to open your antivirus software if you have it, run a full scan, and "allow your antivirus software to clean up any problems it finds"¹⁴.

What antivirus does not do is stop you being tricked. It works on the device, after something has arrived or been installed. It will not reliably stop you entering your bank details into a convincing fake website, and it is not a substitute for spotting phishing emails and texts or for strong passwords and 2-step verification. The NCSC's own recovery guidance treats antivirus as one step in a sequence that also includes changing passwords and applying updates¹⁵. Think of it as the lock on your door: essential, but you still should not hand a key to a stranger.

There is also a limit to what antivirus can fix. The NCSC's guidance on recovering an infected device is blunt about it: "If your antivirus can't clean up your device, you'll have to wipe it entirely and reinstall everything, starting with your operating system", and you may need expert help to do this¹⁶. If you cannot even download and install an antivirus product because your web browser is infected, the NCSC says you will probably need to get expert help¹⁶. Antivirus catches much of what reaches a device, but a deep infection can get past it, which is why the other layers, updates and backups, matter so much.

Keep antivirus up to date

An out-of-date antivirus product is a weak one. New malware appears constantly, and antivirus makers respond by issuing updated definitions, the files that tell the product what to look for. Virgin Media's guidance is that if you already have anti-virus software installed, "you need to make sure that it is up to date with the latest version to maximise your protection"¹⁸. BT's malware help puts it as an instruction: make sure antivirus software updates automatically¹⁹.

The NCSC's advice goes further and covers the whole device, not just the antivirus. Set all software and devices to update automatically, including your AV software¹. Its ransomware guidance repeats the point: make sure your antivirus product is turned on and up to date, and keep your operating system and apps up to date, applying software updates promptly³. The reason is that updates include protection from viruses and other kinds of malware, and will often include improvements and new features as well¹⁷. The NCSC's Cyber Aware campaign summarises it: software and app updates contain vital security updates to help protect your devices from cyber criminals²⁰.

This is the one piece of the puzzle where doing nothing is almost as good as doing something, provided the automatic setting is on. Once you have checked that automatic updates are enabled, both for your antivirus and for your operating system, the system maintains itself. The NCSC's guidance on recovering hacked accounts makes the same point from the other direction: apply updates to your apps and your device's software as soon as they are available, because updates include protection from viruses¹⁵. Our page on software updates and the narrower question of whether to turn on automatic updates cover the settings in detail.

Regular scans: checking for code that should not be there

Antivirus products normally watch your device continuously, but a full scan is a deliberate, deeper check. Virgin Media describes the routine habit well: protect your computer from malicious viruses and regularly scan your computer for any software or code that isn't supposed to be there¹⁸. ProtectUK's advice is the same: run system scans regularly¹¹.

Run a full scan immediately in two situations. The first is when you think you have clicked something dodgy. Virgin Media's phishing guidance says to "run a full antivirus scan straight away to catch and remove any threats"²¹. The NCSC's phishing recovery advice is to open your antivirus software if you have it, run a full scan, and follow any instructions given¹⁴. Our page on what to do after clicking a phishing link walks through the whole sequence.

The second is when your device is behaving oddly. The NCSC lists the signs of an infection, including pop-up boxes from programs or apps that you don't recognise, asking you to do unexpected things². You may also know for sure because your antivirus product is telling you it has found an infection⁵. Either way, the response is the same: open the product, run the scan, and take the actions it recommends².

After an infection has been cleaned, keep checking. BT's malware help advises you to monitor network traffic and run scans to check no infection remains¹⁹. The NCSC's ransomware recovery guidance adds a step for anyone who has dealt with ransomware: install, update, and run antivirus software²². Our after-infection checklist collects everything worth checking once the immediate problem is fixed.

1. Open your antivirus product, whether built in or separate²
2. Run a full scan, not just the quick check¹⁴
3. Allow the software to clean up any problems it finds¹⁴
4. Follow any instructions the product gives you³
5. Scan again afterwards to check no infection remains¹⁹
6. If the antivirus cannot clean the device, be prepared to wipe it entirely and reinstall everything, starting with the operating system, and seek expert help if needed¹⁶

Protecting your data, not just the device

Antivirus protects the machine. Your files, photos and accounts need their own defences, and official advice treats these as a package. The NCSC's top tips for staying secure online pair updates with backing up your most important data²⁰. The reason is simple: some malware, particularly ransomware, does not just infect the device, it locks away the data on it⁹. Antivirus may remove the infection, but it cannot un-encrypt files that were encrypted while the malware ran.

Backups need protecting too. The NCSC warns that when removable media isn't in use, "it's important that you disconnect it. Viruses (and other types of malware, such as ransomware) can move to attached media automatically and infect the backup"²³. In practice that means plugging in an external drive to copy your files, then unplugging it once the copy is finished, rather than leaving it permanently attached. Our pages on backing up files and photos at home, how often to back up and protecting backups from ransomware cover the choices.

Two further habits complete the picture. First, avoid downloading dodgy apps, and only use official app stores such as Google Play or the Apple App Store, which the NCSC says provide protection from viruses³. The NCSC's advice on scam missed-parcel text messages makes the same point about keeping your device patched: ensure your device is kept up to date by installing the latest software and patches²⁴. Second, turn on 2-step verification for your important accounts, so that a stolen password alone is not enough to get in. The NCSC notes that depending on how it is set up, you will only be asked for the second step when suspicious activity is detected, such as a login attempt from a different device²⁵. Our home online security checklist brings all of this together.

Where official guidance comes from

The body behind most of the advice on this page is the National Cyber Security Centre, whose guidance for individuals and families we have drawn on throughout²⁰. Its antivirus guidance for home users is set out in its advice on detecting and preventing malicious software⁵. The same organisations cited elsewhere on this page also publish guidance of their own: local resilience forums including Dorset Prepared, Essex Prepared and West Yorkshire Prepared¹⁰, ProtectUK¹¹, charities including Age UK¹³ and the RNIB⁷, and broadband providers such as BT and Virgin Media¹⁹. If you want the source rather than a summary, start with the NCSC's pages for individuals, which our guide to the NCSC points to.