Security Software: What You Actually Need on a Computer and a Phone

Security software is sold on fear, and the honest answer for most home users is that the built-in protection covers the majority of the risk. What genuinely adds something is a shorter list than the marketing suggests.

What is already there

Windows includes antivirus, a firewall, ransomware protection for specified folders, and drive encryption on many editions. It is independently tested against the paid products and performs comparably.

macOS includes malware scanning, application verification, a firewall and full-disk encryption.

Android and iOS verify applications, sandbox them from each other, and run permission systems.

All of them update automatically, which is the part that matters most.

The practical consequence: for a home user with sensible habits, the built-in protection plus updates plus a password manager covers most of the realistic risk.

What genuinely adds something

A password manager

The single most valuable security tool available, and the one people adopt last.

It removes the two behaviours behind most account compromises: reusing passwords, and choosing ones simple enough to remember.

Browser-built managers are adequate for most people and better than nothing by an enormous margin. Dedicated ones work across browsers and devices and offer more.

Enable two-factor authentication on the manager itself, since it becomes the key to everything. See two-factor authentication and strong passwords.

Two-factor authentication

Not software you buy — a setting you enable.

An authenticator app beats text messages, which can be intercepted by number-porting attacks. A hardware key beats both.

A content blocker in the browser

Security as well as privacy. Malicious advertising is a genuine infection route, and blocking it removes an entire category of exposure.

Encrypted backups

The only real protection against ransomware, and against every other kind of loss. See cloud storage and backup.

With one copy not permanently connected, so it cannot be encrypted along with everything else.

Updates, enabled

Not a product. The most effective security measure available, and the one people postpone. See software updates.

What is worth it in specific circumstances

A VPN on public networks, or where your provider's visibility genuinely matters. Not a general security product, and it is marketed as one. See using VPNs.

A paid antivirus suite where you need centralised management across a family's devices, or where you genuinely handle high-risk material.

Parental controls, which are a different problem from security. See parental controls.

Device-finding and remote wipe, already built into both mobile platforms and worth enabling before you need it. See securing your device from theft.

What is oversold

Antivirus on a phone. Both mobile platforms sandbox applications, and on iOS a security app cannot scan other applications at all — the platform does not permit it. Most mobile "security" apps are a VPN, a password manager and a scanner that cannot see anything, bundled together.

The genuine mobile risks are different: phishing links, malicious apps from outside the official stores, and losing the device. None of those is addressed by a scanner.

Registry cleaners and system optimisers marketed as security. No benefit and a real risk.

"Identity protection" services that mostly monitor for your data appearing in breaches — something you can check yourself for free.

PC cleaner suites bundling twelve tools of which one is useful.

And any product advertised through a pop-up telling you that you are infected. That is itself the attack.

The habits that matter more than any software

Keep everything updated.

Use a password manager and unique passwords.

Enable two-factor authentication on email first, because email resets everything else.

Do not install software from unfamiliar sources. See installing software safely.

Be sceptical of urgency. Nearly every successful attack on a home user involves pressure to act quickly — an account will be closed, a payment failed, a parcel is held. See recognising cyber threats.

Nobody legitimate will telephone about a virus on your computer.

Back up, and keep one copy disconnected.

A realistic setup

On a computer: built-in protection enabled and updating, a password manager, two-factor on important accounts, a content blocker, and automated backups with one copy offline.

On a phone: official app store only, permissions reviewed occasionally, automatic updates, device finding enabled, a screen lock, and the same password manager.

Cost: nothing, or the price of a password manager subscription.

Add a paid suite if you want family management, or if your circumstances are genuinely higher risk than ordinary home use.

Reviewing what you have

Only one antivirus. Two running simultaneously conflict and can leave gaps.

Remove trial software that came with the machine, which frequently nags and expires without protecting.

Check what your browser extensions can do. An extension with permission to read everything on every site is a substantial trust decision. See browser extensions.

Check which applications have access to your accounts and remove ones you no longer use.

The short version

The built-in protection is genuinely adequate for most home users, and it tests comparably to paid products.

A password manager is the highest-value addition by a wide margin.

Two-factor on your email first, because email resets everything else.

Mobile antivirus is largely theatre — the real mobile risks are phishing, unofficial apps and losing the device.

And a pop-up telling you that you are infected is the attack, not a warning about one.

For practical baseline security guidance for home users, see CISA Secure Our World.