Do Phones and Tablets Deserve a Slot on Your Antivirus Licence?

Fix it now

Multi-device licences are sold as a pool of slots, and phones are where the assumption that you should spend them on everything breaks down. What a security app is allowed to do on Android and on iOS are two very different things, and the platform documentation is unusually clear about which is which.

1. Spend slots on the machines holding the data first: the family PC, the laptop with your accounts on it, the Mac used for work.
2. Give Android a slot if one is spare. Google states Play Protect checks the device for potentially harmful apps from sources other than the Play Store and is on by default, so a paid app is adding filtering on top of a real baseline rather than filling a void.
3. Do not spend a slot on an iPhone expecting a scanner. Apple states all third-party apps are sandboxed, that sandboxing is designed to prevent apps gathering or modifying information stored by other apps, and that each app gets its own randomly assigned home directory.
4. Read what the iOS app actually is before you decide: a web and phishing filter, a breach monitor and often a VPN. Those are real features. None of them is malware detection.
5. Check the VPN allowance if that is your reason. Bitdefender publishes 200 MB/day of VPN traffic per device in Total Security, with unlimited traffic in Premium Security.
6. For a work phone carrying company mail, put the effort into device management, a passcode policy and remote wipe. An antivirus app is optional on top of those, not a substitute for them.

If a slot is genuinely spare, putting it on an Android phone costs nothing and adds a layer. If it means buying a larger pack, weigh it against covering the computers properly first.

If you were only deciding whether to install it on the iPad, the answer is above. Below is what each platform permits, where the risk on a phone actually sits, and how the slots are counted.

Why it happens

Start with the platform rules, because they decide the whole question and both vendors publish them. Apple’s platform security documentation states that all third-party apps are sandboxed, that sandboxing is designed to prevent apps from gathering or modifying information stored by other apps or from making changes to the device, and that each app has a unique home directory randomly assigned at install. An app needing information other than its own gets it only through services the operating system explicitly provides. There is, straightforwardly, nothing for a scanner to scan.

So what iOS security apps actually ship is a content filter or local VPN profile that blocks known phishing and malicious hosts, a check of whether your email address appears in a breach dump, a Wi-Fi safety check and often a full VPN. Those are useful things and we are not dismissing them. What they are not is malware detection, and a product page implying otherwise is being loose with the word.

Android permits more, and its free baseline is stronger than most people credit. Google states that Play Protect performs safety checks on apps before download from the Play Store, checks the device for potentially harmful apps from other sources, warns about problematic apps and may deactivate or remove them, and is on by default. So the question on Android is not whether the phone is protected at all; it is whether the additional filtering and monitoring a paid app adds is worth a slot.

One claim we have removed from this article: that VPN traffic allowances are commonly per account rather than per device. The one vendor here that publishes a figure publishes it per device. The general rule was not sourceable, so it has been replaced with the specific published number and an instruction to check the rest.

Full reference

What the app is allowed to do, by platform

Where the risk on a phone actually is

Not in a virus. It is in a message that looks like a delivery notice and takes you to a convincing login page, in an app installed from outside the official store because a video told you to, in a phone left in a taxi with no lock screen, and in an operating system several versions behind because the handset stopped getting updates. Only the second of those is malware in the traditional sense, and it is the one Play Protect is explicitly designed to catch – Google states it checks the device for potentially harmful apps from sources other than the Play Store.

That reframing changes what you should buy. A phishing filter helps. So do the free things you already have: Play Protect on Android, on by default; browser warnings on known-bad sites; the platform’s own device-location and remote-wipe features; and storage encryption, which both platforms apply once a lock screen is set. If the phone is out of security support, no antivirus app compensates and replacing the handset is the actual fix.

What a work phone needs instead

For a handset carrying company mail, the controls that matter are not the ones in a consumer antivirus licence. Enrol it in device management, enforce a passcode, enable remote wipe, and separate work data from personal. Then treat a security app as optional on top.

That is also the honest answer to why business endpoint bundles handle mobile the way they do. ESET places Mobile Threat Defense – which it describes as antimalware, anti-theft and MDM capabilities for Android and iOS – from ESET PROTECT Advanced upwards rather than in the entry bundle. Bitdefender sells Security for Mobile as a GravityZone add-on. Microsoft includes iOS/iPadOS and Android in Defender for Business. In every case, the management half is what the money is for.

How the slots are actually counted

Multi-device suites sell a number of installations rather than a number of people, and any mix of supported platforms can draw from the pool. Bitdefender publishes Total Security as 1 account / 5 devices, or a family plan of 5 accounts / 25 devices, covering Android, Windows, macOS and iOS. Move a slot by uninstalling on one device and signing in on another; the central account frees the seat. That flexibility is the reason not to agonise: a slot spent on a phone is not spent forever.

Two things to check before assuming. Some suites reserve features to certain platforms, so the phone app may not include everything you are paying for. And check how any VPN allowance is counted – Bitdefender publishes 200 MB/day per device, and you should not assume another vendor counts it the same way.

When a slot on a mobile device earns its place

• An Android phone used by a child or a less confident relative, where scam links and questionable app installs are a live risk. This is the strongest case.
• Any Android device where apps get installed from outside the Play Store, for whatever reason.
• A tablet that is really a shared family computer used for browsing and banking, particularly an Android one.
• Not usually: your own iPhone, kept updated, with a passcode. The suite adds a VPN and breach alerts, not protection you lack.
• Not usually: a company phone. Enrol it in device management, enforce a passcode and remote wipe, and treat the antivirus app as optional on top.
• Not at all: an iPad that mostly plays video. Apple’s sandbox means there is nothing there for a scanner to do.

Questions people ask about this