Why you should trust us

• Brian Krebs, journalist and operator of Krebs on Security
• Bill McKinley, executive director of information security for The New York Times (parent company of Wirecutter), and others on The Times's information security team: Neena Kapur, James Pettit, Runa Sandvik, and David Templeton
• Rich Mogull, CEO and analyst at independent security research firmSecurosis
• Joseph Cox, writer on computer security and crime for Motherboard
• Whitson Gordon, former editor of Lifehacker and How-To Geek
• Alan Henry, editor of the Smarter Living section of The New York Times, and former editor of Lifehacker.

Why we don't recommend a traditional antivirus suite

• Vulnerabilities: The nature of how antivirus apps provide protection is a problem. As detailed at TechRepublic, "Security software necessarily requires high access privileges to operate effectively, though when it is itself insecure or otherwise malfunctioning, it becomes a much higher liability due to the extent to which it has control over the system."Symantec and Norton, Kaspersky, and most other major antivirus vendors have all had critical vulnerabilities in the past.
• Performance: Antivirus software is notorious for slowing down computers, blocking the best security features of other apps (such as theFirefox and Chrome browsers), popping up with distracting reminders and upsells for subscriptions or updates, and installing potentiallyinsecure add-ons such as browser extensions without clearly asking for permission.
• Privacy: Free antivirus software has all of the above problems plus added privacy concerns. Good security is not free, and free-to-download apps are more likely to collect data about your computer and how you use it, as well as to install browser extensions that hijack your search and break your security and add an advertisement to your email signature.
• If you have a laptop provided by your work, school, or another organization, and it has antivirus or other security tools installed, do not uninstall them. Organizations have systemwide security needs and threat models that differ from those of personal computers, and they have to account for varying levels of technical aptitude and safe habits among their staff. Do not make your IT department's hard job even more difficult.
• People with sensitive data to protect (medical, financial, or otherwise), or with browsing habits that take them into riskier parts of the Internet, have unique threats to consider. Our security and habit recommendations are still a good starting point, but such situations may call for more intense measures than we cover here.

Windows Defender is mostly good enough

Why Macs don't need traditional antivirus

• People have far fewer Macs than Windows computers: Over the past year, 12 percent of Web-browsing desktop computers ran macOS, compared with about 82 percent for all Windows versions combined, so macOS is a less lucrative target for parties making malware.
• Macs include a wider variety of useful first-party apps by default, and both macOS and downloaded apps receive updates through Apple's own App Store. Windows PC owners are more accustomed to downloading both software and hardware drivers from the Internet, as well as providing permissions to third-party apps, which are more likely to be malicious.
• Newer versions of Windows must make concessions to allow apps made for older versions of Windows to run, creating a complicated set of legacy systems to secure. In contrast, macOS has seen less change since the introduction of OS X, and Apple has been less hesitant to render apps made for older versions obsolete.

Why we recommend Malwarebytes Premium for both Windows and macOS

But the best protection is layers and good habits