Short answer: Surfshark Antivirus is not sold on its own. It comes inside Surfshark One, the bundle that also carries the VPN, the Alert breach monitor, the Search engine and Alternative ID. Judged on its own merits it is a competent, light scanner with genuinely useful extras, scheduled and drag-and-drop scans, webcam protection, a ransomware shield. What it is not is a full security suite: there is no firewall, no parental controls and no password manager.
The facts, and where they come from
Everything in this table is what Surfshark states about Antivirus in its own product material. We have not run independent detection benchmarks, and we are not going to pretend otherwise. The labs that do that work properly (AV-TEST, AV-Comparatives) publish their own results, and at the time of writing Surfshark Antivirus does not appear in their regular comparative rounds. Treat the feature list as accurate and the effectiveness as unproven by a third party.
Detail | What Surfshark states |
|---|---|
Sold as | Part of the Surfshark One bundle only: not available standalone |
Also in the bundle | VPN, Alert (breach monitor), Search, Alternative ID |
Scan types | Quick, full, scheduled, and drag-and-drop |
Real-time protection | Yes: files scanned on download, install and use |
Threat database updates | On a rolling cycle through the day, not once daily |
Zero-day handling | Cloud Protect: unknown files analysed centrally, updates pushed to all users |
Webcam protection | Yes, with a choice between automatic vetting and per-app approval |
Ransomware shield | Yes: behaviour-based folder monitoring |
Scan exclusions | Yes, files and folders |
Firewall | No |
Parental controls | No |
Password manager | No |
Money-back window | 30 days |
Independent lab certification | Not stated |
Price and plans
Antivirus has no separate price. It is included in Surfshark One, which also carries the VPN, Alert, Search and Alternative ID. Surfshark prices that bundle on monthly, annual and two-year terms, with the longer terms substantially cheaper per month and renewing at a higher rate than the advertised first term.
We are deliberately not printing a figure here. Surfshark runs frequent promotions and the advertised rate changes often enough that any number in this review would be wrong within weeks. Check the current price before you decide, and read the renewal rate rather than the headline rate. That is the number you will actually be paying from year two.
How the plan options are laid out. Prices change - check the current page before you decide.
There is a 30-day money-back window, which is long enough to test the scanner and the VPN properly. Use it.
Apps and platforms
Antivirus is not a separate application. It runs inside the same Surfshark app as the VPN, which means the platforms it supports are a subset of the platforms the VPN supports. The browser extensions and router setups that carry the VPN do not carry the scanner.
Platform | Antivirus available |
|---|---|
Windows | Yes: inside the Surfshark desktop app |
macOS | Yes: inside the Surfshark desktop app |
Android | Yes: inside the Surfshark mobile app |
iOS | Sign-in supported; scanning on iOS is constrained by what Apple permits any third-party scanner to do |
Linux | Not stated |
Browser extensions | No: extensions carry VPN functionality only |
Routers / smart TVs / consoles | No: there is nothing for a scanner to run on |
The main screen and where each control lives.
The iOS line is worth reading twice. Apple does not let any third-party app scan the wider file system, so an "antivirus" on iPhone is a fundamentally different and much smaller product than one on Windows. That is a platform limit, not a Surfshark shortcoming, and it applies equally to every competitor.
The phone app keeps the same controls in a narrower layout.
Privacy and jurisdiction
Surfshark was founded in 2018 in the British Virgin Islands, a jurisdiction with no data retention requirements. In 2021 it moved to the Netherlands. That move drew criticism, and the criticism is not unreasonable: the Netherlands participates in the Fourteen Eyes intelligence-sharing arrangement, alongside the United States, the United Kingdom, Australia, New Zealand, France and Germany. The British Virgin Islands does not.
Surfshark's position is that Dutch law imposes no data retention obligation on it, and that a genuine no-logs policy means there is nothing to hand over regardless of who asks. Both of those things can be true at once. What the company has never given is a clear public reason for leaving a jurisdiction it had actively marketed as an advantage.
Our reading: this is a point worth knowing rather than a reason to walk away, and it applies to the whole Surfshark One bundle, not just the antivirus. If jurisdiction is your deciding factor, it should push you toward a provider that has stayed put.
Installing and using it
Antivirus runs inside the same application as the VPN, so there is nothing separate to install.
Windows and macOS: subscribe on the Surfshark site, create an account, download the installer for your operating system and run it.
Android: install Surfshark VPN from the Play Store and sign in.
iOS: install Surfshark VPN from the App Store and sign in.
The install and sign-in steps, in order.
Once you are signed in, open the app, go to the Antivirus tab and follow the setup there. Two things worth doing on day one: schedule a recurring full scan so you are not relying on remembering, and add exclusions for any folders you know will trip false positives.
Surfshark is better known for its VPN, which sits second in our ranking. Antivirus is the other half of what the company sells, and it is only available as part of the Surfshark One bundle. That matters for how you should read this review: you are never choosing this scanner against a standalone competitor. You are deciding whether the bundle is worth it, given that you are probably already weighing the VPN.
What an antivirus is actually doing now
Modern antivirus software does two things at once. It compares files against a database of known threats, and it watches how programs behave while they run. The second part is what catches something written last week that no database has seen yet. Both matter, and a scanner that only does the first is a scanner that is always slightly behind.
The scan types you can choose from, and how a schedule is set.
The features
Scans
Surfshark scans apps and files as they are downloaded, installed and used, and refreshes its threat database on a short cycle rather than daily. Four scan types are available: quick, full, scheduled, and a drag-and-drop scan for specific files you want checked immediately.
Two details are worth calling out because they are not universal. You can schedule a deep scan to a specific time, and you can exclude files and folders from scanning. The second is the one people miss until they need it, developers and anyone working with compilers or archives will hit false positives without it.
Where the scanner shows its resource use while it runs.
Cloud Protect
Cloud Protect is Surfshark's answer to zero-day threats. An unknown file is analysed centrally; if it turns out to be malicious, every Surfshark Antivirus user gets the update. If it cannot be identified outright it is compared against known virus patterns, and a match adds a new entry to the threat list. It is on by default.
Webcam protection
Camera hijacking is a real category of attack and a genuinely unpleasant one. Webcam protection watches which applications try to reach your camera and blocks the ones you have not allowed. Some products handle this by auto-scoring apps for trustworthiness, others by asking you every time. Surfshark lets you pick which of the two you want, which is the right call. The first is convenient, the second is stricter, and different people want different things.
Ransomware shield
The newest addition. It monitors the folders that applications reach into when they touch your files, and steps in when the access pattern looks like encryption rather than ordinary use. This is behaviour-based rather than signature-based, which is the only approach that works against ransomware families that did not exist yesterday.
Real-time protection watches files as they are downloaded and opened.
Performance
Surfshark calls the software lightweight, and in ordinary use that holds up: the scanner is not a visible drag on CPU or memory, including during deep scans. This is a low bar that a surprising number of security products still fail.
What else is in the bundle
Since Antivirus cannot be bought alone, the rest of Surfshark One is part of the decision.
VPN
The main event, and the reason most people arrive here. Servers across roughly a hundred countries, unlimited simultaneous connections, torrenting supported, and a strict no-logs position. We cover it properly in the Surfshark VPN review.
Alert
A breach monitor. You register email addresses, credit cards and ID numbers, and it tells you when any of them surface in a known data breach so you can change credentials before someone else uses them.
Search
A search engine with no ads and no tracking, which returns results that are not shaped by your history. Useful if you want a second opinion on results your usual engine has personalised.
Alternative ID
Generates a separate online identity and email address, so you can sign up to things without handing over your real address. It keeps your actual details away from data brokers. Treat it as a convenience feature rather than a security one.
What is missing
No firewall, no parental controls, no password manager. If you are shopping for a complete security suite for a family, this bundle does not cover it and you will end up buying something else alongside it. If you want a VPN and would like a solid scanner thrown in, that is exactly what this is.
Quarantined files are held apart until you decide what happens to them.
Merger with Nord Security
Surfshark merged with Nord Security in 2021, forming a holding company. Both parties described it as a merger rather than an acquisition, and both stated that infrastructure and server networks would stay separate. Worth knowing if you assumed you were choosing between two unrelated companies when comparing Surfshark and NordVPN.
Support
Live chat and email, around the clock, plus a documentation base with tutorials and FAQs. In our experience the chat agents are reachable quickly and do not simply paste articles at you, which is not something you can say of every provider in this category.
Where to reach support from inside the app.
The verdict
Choose Surfshark One if you were already going to buy the VPN and want a capable scanner, breach monitoring and webcam protection folded into the same subscription rather than paid for separately.
Look elsewhere if you need a firewall, parental controls or a password manager. Those are not here, and no amount of bundling changes that.
The honest summary: as an antivirus judged alone it is good, not exceptional. As the thing that comes with a VPN you already wanted, it is a genuinely good deal.
What it does well
Scheduled, quick, full and drag-and-drop scans: more control than most bundled scanners offer
File and folder exclusions, which developers and archivists will need
Webcam protection with a choice between automatic and manual approval
Ransomware shield that works on behaviour, not just signatures
No measurable drag on CPU or memory, even during deep scans
Comes with a VPN that ranks second in our own ranking
What to weigh against it
No firewall
No parental controls
No password manager in the bundle
Cannot be bought on its own: you pay for Surfshark One or nothing
The company moved its jurisdiction from the British Virgin Islands to the Netherlands, and has not fully explained why
Further reading
Surfshark VPN review: the other half of the bundle, and the part most people are actually buying
Our VPN ranking: where Surfshark sits against the rest
Frequently asked questions
Can I buy Surfshark Antivirus without the VPN?
No. It is only sold as part of Surfshark One. If you want a standalone scanner, this is not the product.
Does it replace Windows Defender?
It can, and running both at once is not advisable, two real-time scanners watching the same files tends to cause conflicts and false positives. Pick one.
Does it include a firewall?
No. Neither does it include parental controls or a password manager. If you need those, budget for a second product.
Will it slow my computer down?
Not noticeably. This is one of the areas where Surfshark does well, deep scans run without the machine becoming unusable.
Is the antivirus as good as the VPN?
No, and we would not claim otherwise. The VPN is a top-tier product that ranks second in our list. The antivirus is solid and well-featured but competes in a category with stronger dedicated options. The reason to have it is that it arrives with something you already wanted.