The four protection approaches, compared
Comparing named products against each other is the wrong first step. The decision that actually costs money is the one before it: whether a household needs a paid subscription at all, and if so, what the subscription is being asked to do that something free does not already do.
Quick answer
For a household running current, automatically updated versions of Windows, macOS, Android or iOS, the built-in protection covers the malware-scanning function. A paid suite is worth considering when the household wants one account covering several people and platforms, wants the bundled tools (password manager, VPN, web filtering) in one subscription rather than several, or wants a support line to call. It is not worth buying to replace updates, backups and multi-factor authentication, which do more for less.
What this comparison holds constant
A comparison is only meaningful if the things being compared are doing the same job. Six dimensions are used throughout this library, chosen because each one has changed a real purchasing decision for a household, and because each can be checked by a reader without specialist equipment.
- Where detection happens, and what it can see.
- How far coverage stretches across the devices one household owns.
- What the bundle contains beyond scanning.
- How much the software interrupts, and what it costs in system resources.
- The cost structure, including what happens at renewal.
- What recourse exists when something goes wrong.
Deliberately excluded: detection-rate percentages. This site runs no tests, and reproducing another organisation's figures without its methodology attached produces a number that looks authoritative and cannot be checked. Readers who want that evidence should take it from the laboratories that generate it, discussed on the method page.
Dimension one: where detection happens
Every current approach uses a mix of three techniques. Signature matching compares files against a catalogue of known malicious code, which is fast and precise but useless against something new. Heuristic and behavioural analysis watches what a program does — encrypting files in bulk, modifying startup entries, injecting into other processes — and acts on the pattern rather than the file. Reputation lookups check a file or web address against a vendor's cloud service, which is why security software is less capable when a device is offline.
Built-in operating system protection uses all three. So do free products and paid suites. The practical difference is not the presence of a technique but the size and freshness of the vendor's telemetry, the tuning of the thresholds, and how the product behaves when it is uncertain. A more aggressive tuning catches more and also flags more legitimate software, which is a genuine cost for anyone who compiles code, plays modded games, or runs niche business software.
What the scanning layer cannot do
No detection engine intervenes when a person is persuaded to act. Transferring money to a fraudulent invoice, entering credentials on a convincing copy of a bank's sign-in page after being telephoned, or approving a multi-factor prompt during a call are all events that a scanner never sees, because no malicious file is involved. Scamwatch documents these approaches, and they sit outside the scope of any product in this comparison.
Dimension two: coverage across a household
This is where the free and built-in options weaken, and it is the strongest argument for a paid subscription. Built-in protection is per-platform by construction: Microsoft's tools protect Windows machines, Apple's protect Apple devices, and neither offers a single place to confirm that a teenager's Android phone is up to date. A household with two Windows laptops, a MacBook, three Android phones and an iPad is managing five separate arrangements, each with its own settings and its own silence.
A paid suite consolidates that into one account with one licence count. Whether that consolidation is worth paying for depends on who is responsible for the devices. One adult managing their own two devices gains little. One person responsible for the devices of several family members, some of whom will not check anything themselves, gains a great deal — not from better detection, but from being able to see status in one place. The specifics of licence counting are covered on platforms, licences and device counts, and they are less intuitive than the marketing implies.
Dimension three: what the bundle adds beyond scanning
Modern subscriptions are bundles, and the bundle is usually where the price difference between tiers sits. Four components recur, and they are worth separating because their value varies enormously between households.
- A password manager
- Genuinely valuable, because reused passwords are the exposure that most reliably converts one organisation's breach into a problem across a person's other accounts. Capable standalone options exist, including ones built into current browsers and operating systems, so this is a convenience of consolidation rather than a capability only a suite provides.
- A VPN
- Encrypts traffic between the device and the VPN provider's server, which is useful on untrusted networks and for keeping browsing away from a network operator. It does not make a user anonymous, does not stop malware, and moves trust from the network operator to the VPN provider rather than removing the need to trust anyone.
- Web and phishing filtering
- Blocks known malicious and fraudulent addresses before the page loads. Browsers do a version of this already; a suite's list may differ. Useful, and quietly one of the more effective parts of a bundle, because it operates at the moment a person has been persuaded to click.
- Cleanup and optimisation tools
- Disk cleaners, startup managers and registry utilities. These are the weakest part of any bundle. Current operating systems manage storage and startup adequately, and claims about performance gains from such tools are difficult to verify. Treat them as filler when weighing one tier against another.
Dimension four: interruption and system load
Security software earns its keep silently, and the products that generate the most complaints are the ones that do not. Two costs are worth weighing: the resource cost of real-time scanning, which on current hardware is usually modest but is noticeable on older machines and during full scans, and the attention cost of notifications. Some vendors fund free tiers with in-product prompts to upgrade, which is a legitimate business model and also an interruption that never stops. A household that finds the prompts intolerable will disable the product, which is a worse outcome than either paying or using what the operating system already includes.
Dimension five: cost structure
Built-in protection has no separate cost. Free products cost nothing in money. Paid suites are sold as recurring subscriptions, and the structure of that recurrence matters more than the headline figure in a comparison table — which is one reason this site publishes no figures at all. Introductory terms and ongoing terms are set by the vendor and are frequently different; the ongoing term is the one a household will pay for years. Where to find those terms and what rights apply to them in Australia is covered in subscription terms and consumer rights.
Dimension six: recourse
If a free product misbehaves, the options are a community forum and uninstalling it. A paid subscription is a consumer contract with a business, and in Australia the consumer guarantees under the Australian Consumer Law apply to goods and services bought by consumers, including digital ones. That is a real, if rarely used, difference between paying and not paying.
| Dimension | Built-in | Free third-party | Paid suite | Habits and updates |
|---|---|---|---|---|
| Detection | Signature, behaviour and reputation, maintained by the platform vendor | The same three techniques, tuned by a security vendor | The same three techniques, usually with more configuration | Not applicable |
| Household coverage | One platform at a time, managed separately | Usually one device per installation | One account across several devices and platforms | Whatever the household applies consistently |
| Bundle | Firewall and browser filtering; password storage via the platform | Scanning, sometimes a web filter | Password manager, VPN, filtering, cleanup tools, varying by tier | Backups and multi-factor authentication, set up once |
| Interruption | Minimal; largely invisible | Upgrade prompts are common | Fewer prompts; more configuration screens | None |
| Cost | Included | Nothing in money | Recurring subscription on the vendor's terms | Time only |
| Recourse | Platform vendor support | Forums | Consumer contract with Australian Consumer Law guarantees | Not applicable |
Where the product covered here sits
TotalAV falls in the paid-suite column. The vendor lists desktop applications for Windows, macOS and Linux, mobile applications for Android and iOS, and tablet support for iOS, Android and Windows, and sells to customers in Australia. Everything else — which tools each plan includes, what the first term costs, what renewal costs, how many devices a licence covers — is set by the vendor, varies by plan, and belongs on the vendor's own page rather than in a table here that would age badly.
This is a paid link: the vendor's affiliate program pays Prospect Works a commission on subscriptions that begin with a click from this site, at no additional cost to the reader. The comparison above was written to the same standard it would have been without it.
Reading the result
The comparison does not produce a winner, because the dimensions are weighted differently by different households. It produces a set of conditions:
- One or two devices, one technically confident adult, current operating system, automatic updates on — built-in protection plus a password manager and backups covers the ground. A subscription adds convenience, not security.
- Several people, several platforms, one person responsible — the consolidation a paid suite provides is the thing being bought, and it is a reasonable thing to buy.
- A household already paying separately for a password manager and a VPN — compare the total of those against a bundle that includes both, keeping in mind that a bundled version of a tool is often less capable than a dedicated one.
- An older machine that struggles — the resource cost of a full suite is a real consideration, and built-in protection is the lighter option.
- Unpatched or unsupported operating systems — no product in any column fixes that, and addressing it first changes the answer to every other question.