Choosing security software in Australia

The purchase is a subscription, not a product, and most of the regret in this category comes from the subscription terms rather than the software. Here is what to settle first.

Quick answer

Work out how many devices and which operating systems you need covered, then check four things on the vendor's own site before paying: the renewal price rather than the introductory one, whether auto-renewal is on by default and how to switch it off, the refund window, and what the product sends back to the vendor. Everything else is secondary. Your consumer guarantees under Australian Consumer Law apply to software bought here and cannot be signed away.

Start with the household, not the product

The useful first step is an inventory, because licence counts are priced per device and the mismatch between what you buy and what you own is where money gets wasted. Count the computers, phones and tablets that would matter if they were compromised. Include the machine a teenager uses for schoolwork and the laptop someone does the tax return on. Exclude devices that never leave the house and hold nothing — a smart television is not covered by this category of product anyway.

Then note the operating systems. A household of two Windows laptops, an Android phone and two iPhones needs a subscription that covers all four platforms, and needs to understand that the iPhone component will be a different kind of tool than the Windows one. As the page on how these products work explains, Apple's sandbox prevents conventional file scanning on iOS, so the iOS app provides web filtering and breach alerts instead. That is not a shortcoming of any particular vendor; it is the platform.

The inventory tells you the licence count you need. Buying a five-device licence for three devices is money spent on nothing. Buying a three-device licence for five means someone goes unprotected, usually the person who least notices.

The subscription is the part to read

Security software is sold on a recurring subscription with an introductory rate. The pattern is consistent across the category: a low first-year price, an automatic renewal at a substantially higher rate, and a renewal date most people have forgotten by the time it arrives. None of that is improper — it is disclosed — but it is disclosed in the terms rather than on the banner, and the banner is what most people read.

What to check, where it lives, and why it matters
Check	Where to find it	Why it matters
Renewal price	Subscription terms or the checkout page, not the headline offer	This is the price you will actually pay for most of the years you hold the subscription.
Auto-renewal default	Checkout page and account settings after purchase	Determines whether the renewal happens without you doing anything, and whether you can stop it in the account or must contact support.
Renewal date and notice	Confirmation email and account page	Some vendors charge before sending a reminder. Knowing the date lets you set your own.
Device count and transfer	Plan comparison and licence terms	Covers whether a licence can be moved when you replace a device, and whether phones count against the same total as computers.
Refund window	Refund or money-back terms	Sets the period in which a vendor offers a refund as a matter of policy. This sits on top of your legal rights, not instead of them.
Data handling	The vendor's privacy policy	Security products necessarily see a great deal of what happens on a device. What leaves the device, and where it is stored, is stated here.
Platform feature list	Per-platform product pages	Shows which features exist on which operating system, rather than the combined list on the main sales page.

All seven live on the vendor's own site. Any site that states them for you — this one included — is quoting a version that may already be out of date.

What Australian Consumer Law gives you

Software sold to Australian consumers comes with consumer guarantees that apply automatically. They are set out in the Australian Consumer Law and administered by the Australian Competition and Consumer Commission, whose site is the authoritative description of them. In general terms, goods and services supplied to consumers must be fit for their stated purpose, match the description given, and be supplied with due care and skill.

Two consequences are worth knowing before you buy.

First, these guarantees cannot be excluded by a contract term. A clause in a vendor's terms of service stating that the software is provided "as is" with no warranty of any kind does not remove rights the law grants you as a consumer in Australia. Terms of that sort are drafted for many jurisdictions at once.

Second, misleading or deceptive conduct in trade is prohibited under the same law. A product advertised as doing something it does not do is a matter you can raise with the ACCC, and the prohibition applies to the party doing the advertising — which includes sites like this one when they describe a product. It is the reason the product pages here restrict themselves to what the vendor states.

What the guarantees do not give you is a right to change your mind. Deciding you no longer want a subscription is not a failure of the product, and a refund in that situation depends on the vendor's own policy. Your rights and where to complain covers how to pursue a problem once one exists.

The privacy trade-off, stated honestly

A product that inspects files, monitors program behaviour and filters web addresses has visibility over almost everything you do on the device. That is inherent to the function, not a design flaw. The question is not whether a security product sees a lot — it must — but what it transmits, how long that is kept, and who else receives it.

The answers are in the vendor's privacy policy, and the sections worth finding are: what categories of data leave the device, whether browsing addresses are among them, whether any of it is shared with analytics or advertising partners, and which countries the data is stored in. If you are uneasy about what you find, that is a legitimate reason to choose differently.

Under the Privacy Act 1988 (Cth), the Office of the Australian Information Commissioner regulates how organisations covered by the Act handle personal information and takes privacy complaints. Its site explains which organisations are covered and how a complaint proceeds.

Free versus paid, without the marketing

Free tiers from established vendors generally include the same detection engine as the paid product. The differences are scope and support: web filtering, multi-device coverage under one account, ransomware-specific tools, a bundled VPN, and someone to contact when something breaks. Free versions also tend to prompt for upgrades, sometimes persistently.

Built-in operating system protection is the other free option, and it has improved considerably on both Windows and macOS. For a single, careful user on a current operating system who applies updates promptly, it is a defensible choice. For a shared household machine, for a device used by someone who is not confident about what they click, or where one subscription covering several platforms is genuinely simpler to manage, a paid product earns its place.

What should not drive the decision is a claim that you are currently unprotected. The Australian Cyber Security Centre publishes free guidance covering updates, backups, multi-factor authentication and passphrases, and those measures do more for most households than any purchase in this category.

Sales patterns worth discounting

A discount presented with a countdown. Introductory pricing in this category is close to permanent; the timer is decoration.
Comparison tables published by a seller, showing that seller's product winning. The criteria were chosen after the answer.
Test scores quoted without naming the laboratory, the test date and the version tested. Detection results age quickly and are meaningless without that context.
Absolute claims — total protection, complete anonymity, guaranteed removal. No product in this category can support them, and under Australian Consumer Law an absolute claim is one the seller has to be able to prove.
Any page that reports a problem with your specific device. A website cannot examine your device. Fake alerts covers this in detail.

A working sequence

List the devices and operating systems that need covering, and the person who uses each.
Decide whether built-in protection plus disciplined updates meets that need. Often it does.
If buying, compare plans on device count first, because that is what sets the price band.
Open the vendor's subscription terms and note the renewal price and date in your own calendar.
Decide on auto-renewal deliberately, and check that the setting is where the vendor said it would be.
Read the privacy policy sections on what is transmitted and where it is stored.
Install only the components you will use, and decline bundled extras you already have.
Keep the purchase confirmation. It is what a consumer guarantee claim is built on.

Where the product covered here fits

Amvix covers one product, Surfshark Antivirus, under the paid arrangement set out on the affiliate disclosure page. The listing we work from states the platforms it runs on — mobile devices (Android, iOS and Windows), desktops (Mac, Windows and Linux) and tablets (iOS, Android and Windows) — and nothing about pricing, plan structure, renewal terms or feature detail. Those are exactly the things the sequence above tells you to check, which is why the link below goes to the vendor rather than to a summary of ours.

Visit the Surfshark Antivirus website

Paid link. If you subscribe after following it, the vendor's affiliate programme pays Amvix a share of the sale, at no additional cost to you.

Our product coverage page lists what the listing does and does not state, in full.