Here’s the truth most antivirus articles bury: in 2026, Microsoft Defender — already built into Windows 10 and 11 — protects you well enough that most people need nothing else. Independent labs have rated its protection at or near the top tier for years. The honest questions are narrower: does a third-party free antivirus add anything (sometimes, a little), which ones are trustworthy (fewer than you’d think), and what actually gets Indian users compromised (spoiler: not viruses — phishing links, fake loan apps and UPI scams, which no antivirus fully stops). This guide covers the free options genuinely worth installing on PC and Android, the ones to avoid, and the five-minute setup that matters more than any download.
Free antivirus at a glance
| Option | Platform | Cost | Best for |
|---|---|---|---|
| Microsoft Defender (built-in) | Windows | Free, included | Almost everyone on Windows |
| Bitdefender Free | Windows, Android | Free | Top lab scores, quiet operation |
| Avast One Essential / AVG Free | Windows, Mac, Android | Free | Extra features beyond Defender |
| Kaspersky Free | Windows, Android | Free | Strong engine (with caveats below) |
| Google Play Protect (built-in) | Android | Free, included | Baseline Android protection |
Microsoft Defender — the answer hiding in plain sight
Defender ships with Windows, updates itself through Windows Update, scores consistently high in independent testing at AV-TEST and AV-Comparatives, and — critically — has no upgrade nags, no data-selling business model, and no performance-hogging extras. It includes real-time protection, ransomware-protected folders, a firewall and SmartScreen’s phishing blocking in Edge. For a typical Indian home PC used for browsing, banking, Office and games, Defender plus sane browsing habits is a complete setup.
The honest weakness: its phishing protection is strongest inside Edge; Chrome users should add Google’s Enhanced Safe Browsing (free, in Chrome settings). And Defender assumes Windows is updated — it can’t compensate for a PC that hasn’t rebooted for patches since Diwali.
Bitdefender Free — if you want a second opinion
Among third-party free options, Bitdefender is our pick: its engine posts top-tier lab results year after year, and the free version is unusually quiet — minimal notifications, no daily upsell theatre, light on system resources. The Android app’s free tier includes malware scanning; its excellent web protection is paid. Install it if you genuinely prefer a third-party engine or need to clean an already-infected machine.
The honest weakness: the free tier is protection-only — no firewall controls, no ransomware remediation extras — and Bitdefender hopes you’ll upgrade, though it asks politely by industry standards.
Avast One Essential / AVG Free — features, with history
Avast (which also owns AVG — same engine, different shirts) offers the most generous free feature set: malware protection plus a basic VPN allowance, a software updater and scam-site blocking. Detection scores are solid. But history matters: in 2020 Avast was caught selling granular user browsing data through its Jumpshot subsidiary and paid a US FTC settlement over it. The company says the practice ended and the data business was shut down.
The honest weakness: that history, plus the loudest upsell notifications in the category. If a free product’s business model isn’t obvious, you should ask what pays for it — with Avast, stay only if you’re comfortable with the answer, and untick every data-sharing option during install.
Kaspersky Free — a strong engine with a geopolitical asterisk
Technically, Kaspersky’s engine remains among the best-scoring in lab tests, and its free tier is competent. The asterisk: the US banned Kaspersky sales in 2024 over Russian-government ties, and several other governments restrict it; Kaspersky denies wrongdoing and India has imposed no such ban. For a home PC in India this is a personal risk-tolerance call, not a technical one.
The honest weakness: the trust question is unresolvable from the outside — and since Defender and Bitdefender exist, most readers don’t need to resolve it.
Android: Play Protect, and what actually threatens Indian phones
Android’s built-in Play Protect scans installed apps and now blocks risky sideloaded installs — with one important India-specific development: the government’s sanctioned pilot programs have pushed Google to auto-scan sideloaded APKs more aggressively. Still, the real threats to Indian Android users in 2026 are not classic viruses. They are: fake loan and investment apps, malicious APKs sent on WhatsApp (“wedding invitation.apk”, “electricity bill.apk”), screen-sharing scams where a “support agent” watches you log into your bank, and phishing links impersonating banks, couriers and government portals. No antivirus reliably stops a user who’s been socially engineered into approving a UPI request. A free Bitdefender or Avast on Android adds a useful scanning layer for sideloaded files; it does not substitute for the rules below.
The five-minute setup that beats any antivirus
- Windows: confirm Defender is on (Settings → Privacy & Security → Windows Security), turn on ransomware Controlled Folder Access, and let Windows Update run automatically.
- Chrome: enable Enhanced Safe Browsing.
- Android: never install APKs from WhatsApp or Telegram; check Play Protect is on; review app permissions with our Android privacy checklist.
- Everywhere: unique passwords via a manager — our password manager guide covers free options — and two-factor on email and banking. Your email account is the master key to everything else.
- UPI rule: entering your PIN sends money, never receives it. Anyone who says otherwise is robbing you.
What to avoid
Skip: “RAM booster / cleaner antivirus” apps on the Play Store (adware in a lab coat); any antivirus that arrived preinstalled on a budget laptop as a trial (uninstall it — expired trials protect nothing and nag forever); cracked or “modded” paid antivirus APKs (malware, ironically); and paying for antivirus features you already have — most paid suites’ extras (VPNs, cleaners, dark-web alerts) are weaker versions of dedicated free tools.
How we picked
Recommendations follow published results from independent labs (AV-TEST and AV-Comparatives) across recent test rounds, each vendor’s data-practice record — which removed several popular names — and the actual threat patterns Indian users face per CERT-In advisories and reported fraud trends. We favoured options whose free tiers are quiet, sustainable and honest about their business model, and we treated built-in protection (Defender, Play Protect) as the baseline to beat, because for most users it already isn’t beaten by much.
FAQ
Is free antivirus really enough in 2026?
Yes — Defender on Windows plus Play Protect on Android, with updates on and sane habits, covers the realistic threat model of a home user. Paid suites mainly add convenience features, not fundamentally better detection.
Do I need antivirus on my Android phone?
Need, no — Play Protect plus never-sideloading covers most people. A free Bitdefender scan layer is worth adding if you do sideload APKs or someone else uses your phone. What you actually need is scam awareness: fake apps and phishing links compromise far more Indian phones than malware does.
Does antivirus slow down a computer?
Modern engines barely — Defender and Bitdefender cost low single-digit percentages in benchmarks. What slows budget laptops is running two antivirus products at once (never do this) and bloated “tune-up” utilities. One engine, always.
Will antivirus stop UPI and phishing scams?
Only partially. Browser-level phishing protection blocks known fake sites, but scams that trick you into approving a payment or sharing an OTP bypass every technical control. The defence is the rule, not the software: no PIN to receive money, no OTP shared, no screen-sharing with “support”.
Is Windows Defender good enough for online banking?
Yes, on an updated Windows with Enhanced Safe Browsing in your browser. Better still: do banking in a separate browser profile used for nothing else, and type your bank’s URL directly rather than following links from SMS or email — the attack you’re defending against is the fake site, not the virus.
Lab-score references and product tiers verified in August 2026. Antivirus vendors change free-tier contents often; download only from the vendor’s official site — search-ad results for antivirus downloads are themselves a common malware vector.