VPN vs antivirus: what each one protects, and do you need both?

Antivirus and VPNs are often sold in the same subscription, so it's easy to assume they do the same job. They don't. Antivirus deals with harmful software on your device, while a VPN deals with the route your traffic takes and who can see it. Which risk you face decides whether you need one, the other or both.

The short answer

A VPN is not an antivirus. Norton, which sells both, says its standalone VPN plans don't include antivirus. EFF says VPNs are best suited for one thing: routing your connection through a different network. Antivirus scans files and programs for malware, and Windows 10 and 11 already have one built in, Microsoft Defender Antivirus. EFF says a VPN is most useful for specific jobs: on a network you don't trust, to get around network blocks, or to reach your office or home network.

What antivirus protects against

Antivirus is built to stop malware, which the FTC describes as harmful software installed on your device without your knowledge. Viruses, spyware and ransomware are common types. The FTC says criminals use malware to steal your usernames, passwords and bank account numbers. Microsoft says Defender Antivirus continuously scans your device for potential threats and takes immediate action against them.

• Real-time scanning of files and programs as they're opened or run.
• Quick, full and custom scans, plus an offline scan that runs without loading Windows, where persistent malware has a harder time hiding.
• Quarantine, which moves a detected file to a safe location and blocks it from running.
• Ransomware defenses such as Windows' Controlled folder access, which stops unknown apps from changing files in protected folders.

Antivirus isn't a guarantee. The FTC warns that even if you use security software, malware might go undetected, at least temporarily, so keep it set to update automatically. Antivirus also works on the device, not the network, so it won't hide your browsing from the Wi-Fi you're on. That's a VPN's job.

What a VPN protects against

EFF explains that a VPN routes your web traffic through an encrypted tunnel between your device and the VPN server, masking your IP address. That hides your traffic from your internet provider and from the local network owner, such as a coffee shop or hotel. Websites see the VPN server's location instead of yours. In 2018 advice on VPN apps, the FTC said that on an unsecured Wi-Fi network, a VPN app that encrypts your data leaves anyone monitoring the connection seeing only gibberish.

What a VPN doesn't do

• Make you anonymous: EFF says companies can still track you through cookies, tracking pixels or fingerprinting.
• Hide your traffic from the provider: EFF says that while a VPN hides your browsing from your internet provider, it's all visible to the VPN provider.
• Make a scam site safe: the FTC notes that scammers encrypt fake sites too, so your data may be encrypted on its way there but won't be safe from the scammers running the site.
• Always encrypt: the FTC warned in 2018 that some VPN apps used protocols that didn't encrypt traffic, or encrypted only some of it, and EFF says a VPN using broken encryption such as PPTP leaves your data easy to decrypt.

So the provider matters. In tips published in 2018, the FTC advised researching a VPN app before you get it, reviewing the permissions it asks for, making sure it encrypts your information and checking whether it shares your information with third parties. EFF warns that a VPN provider may collect and share user data or even distribute malware, even when its app is in an official store. Our guide to what a VPN protects covers how to judge one.

Where antivirus and VPNs overlap

Security suites now block some dangerous websites, and some VPNs add filtering of their own, which is where the confusion starts. Windows' Microsoft Defender SmartScreen checks websites and downloads against a list of known malicious sites and files. Norton says Safe Web helps detect and block potentially malicious or fake websites before you visit them, and McAfee says its web protection warns you about risky websites, links and files. Avast says Premium Security scans websites to make sure they're legitimate.

Some VPNs come at it from the other side. EFF notes that some VPNs have built-in ad and tracker blocking, done at the DNS level, which is less precise than a browser extension. Norton's VPN page pairs an encrypted VPN tunnel with AI-powered protection against scams, phishing and malware, though its plan cards list that protection only in Norton VPN Plus and Ultimate, not Standard. How much any VPN's filter blocks is not stated on the pages we read. Blocking known bad sites isn't the same as scanning the files on your device, so it doesn't replace antivirus.

What neither one stops

Many online losses need no malware and no open Wi-Fi, only a message you believe. The FTC says scammers pretend to be from an organization you know, say there's a problem or a prize, pressure you to act immediately and tell you to pay in a specific way. Neither tool stops you from handing over a password or money yourself. Each of these threats has its own fix.

• Phishing: don't click links in unexpected emails or texts. Contact the company through a phone number or website you know is real, the FTC says.
• Fake security warnings: never call a phone number in a pop-up. The FTC says these scammers ask for remote access, then charge you to fix a problem that doesn't exist.
• Payment pressure: the FTC says never to pay someone who insists on cryptocurrency, a wire transfer service, a payment app or a gift card.
• Weak passwords: the FTC suggests at least 15 characters, a passphrase of random words or a password manager.
• Reused passwords: Microsoft says reuse makes it easy for attackers who compromise one password to get into your other accounts. Give each account its own.
• Stolen passwords: turn on two-factor authentication. The FTC says a hacker who steals your password can't log in without the second factor.

Do you need both? It depends where you connect

On a home computer

Antivirus comes first. Microsoft Defender Antivirus is built into Windows 10 and 11, and it turns itself off automatically if you install a compatible antivirus from another company. Microsoft recommends against running two real-time antivirus products at once. A VPN at home is a privacy choice: EFF says it could potentially hide your browsing habits from your internet provider, though the VPN provider then sees them.

On your phone

The FTC counts phones among the devices malware threatens, and advises setting your phone's software to update automatically. Phishing arrives by text as well as email. A VPN app on a phone routes your traffic through servers the provider controls, and the FTC pointed out in 2018 that installing one gives the app permission to intercept all of your internet traffic. Before you install one, ask whether each permission it wants, such as reading your text messages, makes sense for the app.

On public Wi-Fi

This is the classic case for a VPN, though it's weaker than it was. The FTC says that because most websites now use encryption, connecting through public Wi-Fi is usually safe; look for the lock symbol or https in the address bar. EFF says a VPN isn't as necessary for everyone on public Wi-Fi anymore, but may be useful on a network you don't trust, with a VPN you do. Keep antivirus on as well, since an encrypted connection doesn't check what you download.

When you travel

Travel stacks the risks: unfamiliar networks and less time to think. EFF notes that a VPN can connect you to your office or home network while you're away, and can get around some geographic restrictions, though EFF says it isn't a guaranteed way around them. Norton says VPN availability is restricted in certain countries, so check local laws first. And the FTC advises scanning USB drives and other external devices before you use them.

Getting both in one subscription

Several security suites include a VPN in some plans, so one app and one account can cover both jobs. Whether that's worth it depends on how often you'd use the VPN, and our guide to antivirus with a VPN bundles weighs that up. Here's which plans include a VPN, as each vendor's own pages described them on October 29, 2026. Line-ups change, so check the exact plan before you buy.

• Norton: every Norton 360 plan includes a VPN (3 devices on Standard and 360 for Gamers, 5 on Deluxe, 10 on Premium, 10 or more with LifeLock); Norton AntiVirus Plus doesn't.
• McAfee: Secure VPN is listed in every Total Protection and McAfee+ plan, through Ultimate.
• TotalAV: Total VPN comes with Internet Security and Total Security; with Total AV Plus it's sold separately.
• Avast: Avast Ultimate bundles Premium Security with Avast Premium VPN, AntiTrack and Cleanup Premium; Avast's Premium Security page doesn't list a VPN.
• Avira: Avira Free Security includes a VPN capped at 500 MB of data a month on desktop (Avira's free Android app gets 100 MB a day), and Avira Prime's VPN has unlimited data.

Antivirus and VPN checklist

1. Check that real-time antivirus is on: on Windows, under Windows Security > Virus & threat protection > Manage settings.
2. Run one real-time antivirus, not two.
3. Turn on automatic updates for your operating system, browser, apps and security software.
4. On public Wi-Fi, look for the lock symbol or https before you sign in.
5. Use a VPN on networks you don't trust, from a provider you've researched.
6. Check a VPN app's permissions and privacy policy before you install it.
7. Use long passwords or a password manager, and turn on two-factor authentication.
8. Contact companies only through a phone number or website you know is real, and report scams at ReportFraud.ftc.gov.

Antivirus looks after what runs on your device. A VPN looks after the road your traffic travels. Neither can be relied on to tell a real request from a convincing fake. That part is still up to you.