Questions readers ask

Not for the scanning function alone. Current Windows includes Windows Security, which Microsoft documents as on by default and continuously updated. A paid product is worth considering for other reasons — managing several people's devices from one account, bundling a password manager and VPN, or having support to call — rather than because Windows is left unprotected without it.

For the malware-scanning function, macOS includes layered defences that Apple documents in its Platform Security guide, including checks on signed and notarised software and matching against known malicious content. The claim that Macs cannot get malware is not one Apple makes. The most common problems Mac users report are adware and unwanted software installed in response to a prompt, which sits at the edge of what any scanner intercepts.

Conventional scanning is not possible on iOS and iPadOS, because each app is isolated from the system and from other apps. Products sold as iOS security apps provide other functions under the same name — web filtering, a VPN, a password manager, breach monitoring. Those can be worth having. They are not a scanner, and keeping the operating system current does more for an iPhone's security than installing anything.

Established free products from known vendors perform the scanning function. The trade-offs are usually upgrade prompts inside the product, limited or absent support, and coverage of one device at a time. Worth checking before installing one: who publishes it, whether the vendor's privacy policy explains what is collected from the device, and how the free tier is funded. A free product advertised through a pop-up warning is a different proposition and is covered on fake alerts and support scams.

No. A page in a browser cannot read files, list installed programs or inspect a device for malware. Any page displaying a scan in progress or a list of problems found is showing an animation that is identical for every visitor. Details such as the browser name or an approximate city come from ordinary connection information and are inserted to make the text look specific.

No, and it usually causes problems. Two real-time engines inspecting the same files conflict, duplicate quarantine actions and slow the machine. Windows handles this by standing its own engine down when another product registers itself, so the practical decision is which single product is active rather than how many are installed. Occasional on-demand scanning with a second tool is a different matter and does not carry the same conflict.

No. A VPN encrypts traffic between the device and the VPN provider's server, which is useful on untrusted networks and keeps browsing away from the local network operator. It does not inspect files, does not block malware, and does not make a user anonymous — it moves trust from one party to another. It is a privacy tool that is commonly bundled with security software, which is why the two are often confused.

That varies by plan and vendor, and the counting rules matter as much as the number: whether a phone consumes the same slot as a laptop, whether a replaced device frees its slot, and whether household members get separate accounts or share one administered pool. A typical Australian household reaches seven or eight countable devices without trying. The arithmetic to do before purchase is set out on platforms, licences and device counts.

The application ordinarily remains installed but stops receiving updates, which makes it less useful than no product at all; on Windows, removing it hands real-time protection back to the operating system's own engine. Anything stored inside the product, particularly a password vault, may become read-only, so credentials should be exported before the term ends. Bundled services such as a VPN stop at the same time.

End the call. No software vendor, internet provider or platform company telephones consumers unprompted about malware on a specific device, and the request for remote access is the purpose of the call rather than a diagnostic step. If remote access was already granted or payment made, the ordered steps are on fake alerts and support scams: contact the bank, change email and banking passwords from another device, and report it to Scamwatch and ReportCyber.

For most households, yes, and using any password manager consistently matters far more than which one. Three things are worth checking before committing to a bundled one: that it runs on every platform the household uses, that credentials can be exported in a standard format if the subscription ends, and how the vault is recovered if the master password is lost. A bundled tool is often less capable than a dedicated one, and still better than reused passwords.

Real-time protection sits in the path of file activity, so there is a cost. On current hardware it is usually not noticeable in ordinary use; on older machines, and during full scans, it can be. Scheduling full scans for a time the machine is idle addresses most of the complaint. The cleanup and optimisation tools bundled alongside are a separate matter and rarely produce a change a user notices.

Results from laboratories that publish their methodology are useful evidence, and the date and sample set determine what a figure means. AV-TEST and AV-Comparatives both publish their testing approach alongside their results, and reading them at the source is more reliable than reading a number quoted on a comparison site. A percentage with no test, date or methodology attached cannot be checked and should not carry weight.

Partly. Web and phishing filtering blocks known fraudulent addresses, and a password manager refuses to fill credentials on a domain that does not match the one they were saved for, which defeats many convincing copies of sign-in pages. Nothing in this category intervenes in a telephone call or prevents a person from authorising a payment. Scamwatch is the better source for the non-technical half of the problem.