By 
Which antivirus is worth installing on Android? The quick summary
- Play Protect ties one lab at 18 of 18, and comes last of seven rows on the other.
- Bitdefender tops both tables, at 100% protection with 2 false positives.
- Sophos is free, holds 18 of 18, and shows which apps read your address book.
- Malwarebytes sits in neither current table, and fifty million people installed it.
- Kaspersky holds the best false-positive count of the lot, and Play will not sell it.
You typed "antivirus" into the Play Store last week. Eleven pages of armour-shaped icons stared back at you, each one swearing it will save your phone. None of them beeped when it mattered.
Two labs grade this crowd, and they disagree. One lab ties eleven of twelve products at the top score. The other splits the same crop on false positives. The product holding the best false-positive count in that second table cannot be bought from the Play Store. The scanner fifty million people installed appears in neither table.
Bitdefender tops both tables. Sophos does the job for free. I test on my phone on Android 15. When the labs disagree, this page says which one is talking.
The scanner already on your phone
Your phone ships with one already. Google Play Protect took the full 18 of 18 on the lab's July 2026 Android table, with six points in each of three categories. The lab writes that "18 points are the best possible test result". Eleven of the twelve products it tested reached that total.
The same product comes last of the seven rows on the 2026 mobile security review. That lab records 98.9% protection with 8 false positives. The second number matters more, because a false positive disables a clean app on your phone.
So the free baseline is neither weak nor sufficient. It ties the top of one lab and sits at the bottom of the other. The gap between those two labs is the whole buying question on this page.
One honest line before the picks: no link on this site pays us today. Every link here is a plain link, and the full affiliate disclosure is one tap away.
The paid pick, and what it buys beyond the baseline
Three picks follow. Each one says who it is for, what it does and what it costs.
1. The paid pick
Who it is for: the reader who wants the lab's favourite and will pay for it. The score is already tied. You are buying the extras.
What it does: you get your apps and files scanned for malware, scams flagged and exposed accounts checked.
The vendor's own page sells it as "Best protection for your Android smartphone and tablet". It lists the deal as "1 account / billed annually". It also states the app "includes up to 200 MB per day of encrypted traffic for your Android device".
It also lists anti-theft, scam protection and an account privacy check. Those extras are what you pay for, because the score is already tied.
That cap is a data question, not a browsing allowance. My free VPN roundup prices every cap against a carrier's own published page.
What it costs: fourteen days of trial. Its FAQ says "You can always try before you buy", and the same answer promises the trial needs no credit card. Fourteen days is a trial, not a free tier.
The vendor's page carries a first-year figure, USD 17.99 for one account billed annually. Its terms say the renewal price can be higher. The buy box on that page renders a literal placeholder in fetched HTML, so check the figure on your own device before you pay.
Get it on the Play Store: Bitdefender for Android.
The scanner pick, and the table it is not in
2. The scanner pick
Who it is for: the reader whose phone already went wrong. This one scans for damage that is already done.
What it does: you get your phone scanned for damage already done, hunting the apps that did it.
What it has instead is install count. The Play listing shows 50M+ downloads and 683K reviews, updated on 6 October 2026. That is a distribution fact rather than a lab score.
The listing states the app "requires Android 10 or later and uses the AccessibilityService API". The paid tiers sit on the pricing page, where Standard starts "from $59.99/yr" and "Protects 3 devices".
Three devices means a phone, a laptop and a tablet, not three phones. That pricing page runs a dated promotion, "up to 50% off protection plans through October 11", which I read on 9 October 2026. The footnotes call it first-year pricing.
What it costs: the free build is a scanner with a chore attached. One Play review puts it plainly: "if you install this free version just remember to update its database. It won't do that on its own for free." The paid build automates that update.
A second review is the caution. Its author "thought was 30 days but turned out to only be 1 week" and then "charged me for the year".
Get it on the Play Store: Malwarebytes for Android.
The free pick, and the permission it reads
3. The free pick
Who it is for: the reader who wants a lab score and a zero price.
What it does: the free Sophos scan shows which apps read your contacts, which ones are unwanted, and which ones cost you money.
The reason it earns the slot is one line on the vendor's page. Sophos "Detects apps accessing personal data such as your address book". It also says it "Shows you potentially unwanted apps (PUAs)".
That first line is the loan-app line. A lender app that reads your contacts is the exact behaviour the loan-app problem runs on. Sophos also "Allows you to easily identify apps which can involve costs or fees".
What it costs: nothing. The vendor never asks for money. The scanner runs on install and on demand.
Get it on the Play Store: Sophos for Android.
The two labs, side by side
AV-Test ties almost everything it tested. AV-Comparatives splits the crop on false positives, and that column decides whether a clean app keeps working.
| The product | July 2026 total | Version tested | 2026 protection | False positives |
|---|---|---|---|---|
| Bitdefender Mobile Security | 18 of 18 | 3.3 | 100% | 2 |
| Kaspersky Premium for Android | 18 of 18 | 11.132 | 99.9% | 1 |
| Norton 360 | 18 of 18 | 26.11 | 99.6% | 2 |
| Google Play Protect | 18 of 18 | 46.8 | 98.9% | 8 |
| Sophos Intercept X for Mobile | 18 of 18 | 9.8 | Not in that table | Not in that table |
| Malwarebytes Mobile Security | Not in that table | No version | No figure | No figure |
Two readings fall out of that table. Bitdefender is the only product sitting at the top of both columns. Play Protect ties it on one lab and trails it by six false positives on the other.
Sophos holds 18 of 18 on the first lab and is absent from the second. Kaspersky holds the smallest false-positive count of the lot and cannot be bought from Play. Neither row is a reason to panic, and both point at the next two sections.
Free against paid, pick by pick
The free or paid question is per pick, not per category. Here is what each tier does, straight from each vendor's own page or the lab's own table.
| The pick | The free build | The paid build | The catch |
|---|---|---|---|
| Play Protect | Everything, on the device, at no cost | Nothing to buy | 8 false positives in 2026 |
| Sophos | Scans on install and on demand, shows PUAs | No paid tier appears on the vendor page | Absent from the 2026 table |
| Malwarebytes | Scans, but updates are manual | Real-time protection, automated updates | No row in either table |
| Bitdefender | Fourteen days of trial, then a paywall | 100% protection, 2 false positives, VPN capped at 200 MB a day | First year USD 17.99, renewal higher |
The honest split is small. Only one pick on this page buys a better lab number, and that number is two false positives instead of eight. Read the table as a budget, not a ranking. Everything else you pay for is convenience, or a VPN, or an authenticator.
The best false-positive count, in a product you cannot buy
Kaspersky holds the smallest false-positive count in the 2026 crop: one. Bitdefender took two. The same product cannot be bought from the Play Store, and its own advice makes that worse.
The vendor's own post states that "our developer account has been terminated and all Kaspersky apps have been removed from the store". The post is dated October 2024, and it says Google acted ahead of the September 29 restrictions.
If you already installed it, it keeps working. The post says installed apps "continue to work normally and receive database updates through our cloud infrastructure". You cannot reinstall it or update it from Play.
The advice for everyone else is the part to notice. The vendor recommends "downloading our apps for Android from other mobile stores" or "directly from our site". A security company is telling you to sideload. Sit with that one.
So I am not picking it. Chasing that number means installing security software from outside Play review. Never install an antivirus from an APK.
The case against installing anything, credited
The strongest case against this page is Engadget's, dated 16 August 2026 and written by Jack Whitcombe. The piece opens with "The short answer is probably not, but it depends on how you use your device."
The same piece adds that "There's nothing wrong with not having an Android antivirus installed". It also records that Google "blocked 27 million new malicious apps from the Play Store in 2025 alone".
That piece then names the three cases where the answer flips. Sideloading is the first. Obvious signs of infection are the second. An older phone with no security updates is the third.
Each of those three maps to a row above. A sideloader wants Sophos. An infected phone wants the scanner. An unpatched phone wants the row nobody can buy.
The decision itself is not this page's job. My antivirus decision guide runs the three personas and names no product. The public Wi-Fi half of the question sits in my VPN decision guide.
Nigeria: the lender list, and what to do
Nigeria's consumer regulator publishes an approvals register for digital money lenders. I counted it on 9 October 2026 and it runs to entry 525. The first entry is a loan app, and the last entry is two.
That register is the safe-lender check. Search the app's name there before you install it. If the app is not on it, that is a reason to stop rather than a reason to argue.
Now the limit, stated plainly. An antivirus cannot un-send contacts a loan app already harvested. It stops the next APK and nothing more.
If that already happened, work the removal procedure. My malware removal guide covers the steps, and the decision guide covers the persona test that decides what to install next.
That habit is the one that matters here. A forward promising a cleaner phone, a cracked app, or a "loan-safe" APK carries the same risk as any other sideload. My free VPN roundup covers that parallel.
Questions readers ask
Is Play Protect enough on its own?
Yes, if every app comes from the Play Store and you never switch the scanner off. The July round gave it the full 18 of 18, and the dissenting guidance is right for that reader.
Will an antivirus slow my phone down?
Not measurably, on the second lab's own words. It reports the products "had only a minor influence on battery life". That is the lab's result, not a measurement I took.
The scanner has no lab row, so is it worthless?
No. Fifty million installs and a review chorus about adware removal is real standing, and it is not a score.
A loan app already took my contacts, will an antivirus fix it?
No. An antivirus cannot un-send contacts that already left the phone. Work the removal procedure, then check every lender against the register.
Why is the best false-positive count not the pick?
Because you cannot buy it from Play, and its own advice sends readers to other stores or its own site. That means sideloading security software.
What to do next
Bitdefender is the pick if you want the lab's favourite at 100% with two false positives. Sophos is the pick if your money is tight and you still want 18 of 18. Kaspersky is the one you cannot buy from Play, so it stays off your phone.
Install one from the Play Store only. The rest of the troubleshooting set sits in the Android problems hub, and my How We Test page names the phone this runs on.
Comments
New posts held for reviewCouldn't load comments - the thread service didn't answer. Nothing is being hidden: no approved comments are saved with this page.
No approved comments yet - the first one is yours. New posts are held for review before they appear.