Open the feature list of almost any modern security suite and you will find a long column of ticks: firewall, web protection, VPN, password manager, identity monitoring, parental controls, a “system tune-up” tool, and more. Some of these are central to protecting your device; others are conveniences bundled in to make the package look fuller. This step explains each one in plain terms, so you can tell which features you would genuinely use from which are simply along for the ride.
The core protection features
- Real-time malware protection
- The heart of any antivirus product: continuous checking of files and activity, using the methods covered in the previous step. If a product does this well, it is doing its main job. Everything else is secondary.
- Web and phishing protection
- A filter that warns you away from, or blocks, websites known to host malicious software or to impersonate real organisations in order to steal login details. Because so many threats now arrive through a browser rather than a downloaded file, this is genuinely useful. Browsers and email providers also do some of this filtering themselves.
- Firewall
- A firewall controls which network connections your device is allowed to make and accept. Both Windows and macOS include a capable firewall already. A third-party product may add a more configurable one, but for most home users the built-in firewall, left on, is sufficient.
- Ransomware protection
- A specific defence that watches for the behaviour of ransomware — software that encrypts your files and demands payment — and guards designated folders against unauthorised changes. Useful, though as step seven explains, reliable backups are your strongest protection against ransomware regardless of any software.
The bundled extras
These features are commonly included, but they are separate tools that happen to be sold in the same box. Whether they add value depends entirely on whether you would otherwise use, or pay for, such a tool.
- Virtual private network (VPN)
- A VPN routes your internet traffic through an encrypted connection to a server run by the provider, which can hide your browsing from others on the same network and mask your location. It is a legitimate privacy tool, but it is not antivirus, and be wary of any claim that a VPN makes you “completely anonymous” — it does not. A bundled VPN may also have data limits or fewer options than a standalone service. If you want a VPN, judge it on its own merits.
- Password manager
- A tool that generates and stores strong, unique passwords so you do not have to remember them. Using unique passwords for every account is one of the highest-value habits in all of online security, so a password manager is worth having — whether it comes bundled or as a dedicated product. The ACSC explains the reasoning on cyber.gov.au.
- Identity or dark-web monitoring
- A service that checks whether your email address or other details appear in known data breaches and alerts you if they do. It can be reassuring, but it is informational: it tells you after the fact, and the protective action — changing a password, enabling multi-factor authentication — is still yours to take.
- Parental controls
- Tools to filter content, limit screen time, or see what a child’s device is doing. If you are a parent weighing these up, the eSafety Commissioner offers independent, non-commercial guidance at esafety.gov.au that is worth reading alongside any product’s marketing.
- System optimisation and “tune-up” tools
- Utilities that clear temporary files, manage start-up programs, or promise to speed up your computer. These have little to do with security. Some are handy; many duplicate functions your operating system already provides. Treat a large “junk found” number with the same scepticism you would treat any attention-grabbing figure.
What to watch out for
A long feature list is not the same as strong protection. The single most important feature is reliable, well-tested malware detection; a product can bundle a dozen extras and still detect poorly, or detect superbly with a short feature list. When you compare products in step five, weight the core job heavily and treat the extras as tie-breakers you will actually use.
Do you need the extras?
A simple way to decide: for each bundled extra, ask whether you would seek out and pay for that tool on its own. If you already use a password manager you trust, a second one adds nothing. If you have never wanted a VPN, a bundled one will probably sit unused. On the other hand, if a suite gathers several tools you genuinely want at a price lower than buying them separately, the bundle can be good value. The mistake is paying a premium for a wall of features you will never open.
| Feature | Type | Everyday importance |
|---|---|---|
| Real-time malware protection | Core | High — this is the main job |
| Web / phishing protection | Core | High — most threats arrive online |
| Ransomware protection | Core | Useful, but backups matter more |
| Firewall | Core | Moderate — built-in one usually suffices |
| Password manager | Extra | High value if you will use it |
| VPN | Extra | Depends entirely on your needs |
| Identity monitoring | Extra | Informational, not protective |
| System tune-up | Extra | Low — little to do with security |
Free tiers, paid tiers, and how they differ
Many vendors offer a free version alongside their paid ones, and it helps to understand the pattern. Typically the free tier includes the core malware detection engine — the same one the paid tiers use — while the paid tiers add the bundled extras, cover more devices, remove advertising for the vendor’s own upgrades, and include customer support. In other words, you are often paying not for better detection but for more features and convenience. That is a perfectly reasonable thing to pay for if you want those features; it is worth spending money on knowingly rather than assuming the paid engine catches more. Independent testing laboratories generally assess the detection engine, which is shared, so their results are informative regardless of tier.
How features map to the threats
Features make the most sense when you connect them to the risks they address, which is the subject of the next step. As a preview: web and phishing protection addresses scam links and fake login pages; real-time malware protection addresses dangerous downloads and attachments; ransomware protection and, above all, backups address file-encrypting attacks; and a password manager with multi-factor authentication addresses stolen and reused passwords. Seen this way, a feature list stops being a wall of jargon and becomes a set of answers to specific questions — and you can decide which questions actually apply to you.
One last habit when reading any feature list: notice the difference between a capability and a benefit. “Includes a VPN” is a capability; “lets you use public Wi-Fi with less exposure” is the benefit, and only you can say whether that benefit matters to how you actually live and work. Marketing tends to list capabilities because they sound impressive in a column of ticks. Translating each one into a plain benefit — and then asking whether you need that benefit — is the quickest way to see through a padded list to the handful of things that would genuinely help you.
With the vocabulary sorted, the next step looks at the other side of the equation: the threats themselves. Knowing what actually goes wrong, and how, makes it far clearer which of these features are worth caring about for your own situation.