Review

Renew or Switch Antivirus? How to Judge Your Vendor at Renewal Time

12 min read Updated October 5, 2026 Antivirus Comparisons

Fix it now

Start ninety days out and decide on your own evidence rather than a review round. Switching costs real hours – Bitdefender, for example, supplies its console-migration patch only for estates of more than 20 endpoints and otherwise tells you to reinstall every agent by hand – so the bar for moving should be a structural change, not a bad quarter.

Renew if the product still covers every platform you run, the tier you bought still contains what you bought it for, and your own ticket history does not blame the agent for anything recurring.
Switch if something structural has changed: a platform the product no longer covers properly, a capability that moved to a tier you will not buy, support that failed you during an actual incident, or a workforce that is now remote with a console that cannot reach it.
Do not switch on a single test round or a single false positive. Do switch on a pattern in your own ticket queue.
Ask for a renewal quote and a competing quote for the same tier and term in the same week, so you are comparing documents rather than impressions.
Whatever you decide, never let cover lapse. Overlap the old and the new licence by at least two weeks and move machines in waves.
Before the tenancy closes, export whatever detection history you are required to retain. It does not come with you.

One machine, one real-time product, at every moment of the change. On Windows client Microsoft Defender goes into disabled mode automatically once another product registers, but on Windows Server Microsoft’s instruction is to disable or uninstall it manually – so a server mid-migration is where the mess happens.

If the evidence already points one way, stop here and place the order with an overlap. Below is how to gather that evidence, what a switch actually costs, and how to run one without a gap.

Why it happens

Renewal quotes arrive with a deadline attached, which is how most antivirus decisions get made by default. The decision is not really renew-or-switch, it is whether you have evidence. Gather it before any number is in front of you, because once a price is on the table the conversation becomes about the price, and the price is rarely the most important part of this.

Four sources tell you nearly everything. Your own ticket queue: how many calls in the last year were caused by the antivirus rather than solved by it, how many exclusions you have had to add, how often a deployment failed. The console: how many machines are reporting, how many have not checked in for a month, how long detection history is retained and whether that satisfies your obligations. The vendor’s behaviour across the term: did the tier you bought keep the features you bought it for, and what happened the one time you needed support urgently. And your own estate: Macs, Linux servers, virtual desktops, remote laptops or regulated data the current product handles badly.

Then price the switch honestly, because this is where optimism creeps in. Bitdefender publishes the clearest example of what a migration really involves: its supported route between console models uses a patch deployed to the agents by Group Policy or another mass-deployment tool, and it supplies that patch only for environments with more than 20 managed endpoints – below that, its documented instruction is to reinstall and reconfigure each agent manually. A change of vendor is at least that much work and usually more, because the policies and exclusions do not come with you either.

The product no longer fits the estate

You have this one if You have added a platform, a virtual desktop environment or a remote workforce the current console cannot reach.

This is the strongest reason to move and it will not improve on its own. A console that cannot manage machines outside the office is a structural mismatch, not a configuration problem.
Check first whether your existing vendor publishes a different console model. ESET and Bitdefender both publish cloud and on-premises options, so the fix may be a migration within the same licence rather than a new vendor.
If it is a genuinely missing platform, shortlist on that requirement alone and ignore everything else until two products have passed it.

The tier was repackaged under you

You have this one if Something you relied on has moved up a level, or the bundle you renew no longer contains what it did.

Get the current published tier contents from the vendor’s own page, not from the renewal document, and write down exactly which capability moved.
Price the tier that now contains it against a competing product at the equivalent tier, over the same term.
If the capability is one nobody actually uses, the honest move is down a tier rather than out to another vendor.

You are unhappy but cannot afford the migration this quarter

You have this one if Real problems, no capacity, and a deadline in three weeks.

Renew for the shortest term you can get rather than the cheapest per year, and write down the specific problems with dates.
Give the vendor a defined opportunity to fix them and a review date in the calendar.
Decide next time from a record rather than a memory. A short renewal costs slightly more per year and buys you a decision made properly.

The reasons that do not hold up are worth naming, because they come up every year. A single test round that placed your vendor mid-table – results move between rounds and one publication is not a trend. A single false positive, however annoying, unless it is a pattern. A cheaper first-year price on a competitor, unless you have compared the second-year figure as well. And what a colleague runs at home, which tells you nothing about how a product behaves across fifty managed endpoints.

Full reference

Renewing against switching, with the costs shown

Dimension	Renewing the incumbent	Switching vendor
Deployment effort	None	Remove old agents, deploy new ones, in waves
Policy work	Existing policies carry forward	Rebuild every policy and exclusion from scratch
False positives	Known and already tuned out	A new set, discovered by your users
Training	None	Administrators learn a console; users see new prompts
Historic detection data	Retained in place	Left behind unless you export it first
Leverage on the number	Real, if you have an alternative quote in hand	Real, and usually strongest in the first term
Risk during the change	None	A window where machines are between products
Chance of fixing an existing problem	Low, if the problem is the product	High, if you diagnosed the problem correctly
Time to complete for a mid-sized estate	An afternoon	Weeks, with a long tail

The ninety-day timetable

Ninety days out: assemble the evidence from the four sources and write down what would have to be true for you to switch. Do this before you see any pricing.
Sixty days out: request a renewal quote and at least one competing quote for the same tier and the same term. Ask for the multi-year figure alongside the annual one.
Forty-five days out: if a move is genuinely on the table, trial the alternative on five real machines covering your most awkward line-of-business software – not on a clean virtual machine, which tells you nothing.
Thirty days out: decide. If switching, buy with an overlap so both licences are live during the move.
Through the change: migrate in waves, removing the old product with the vendor’s own removal tool before installing the new agent on each machine.
Before the old tenancy closes: export anything you are required to retain, in a format you can still read in two years.

Reasons to switch that hold up

The product does not properly support a platform you now depend on, and the vendor has no roadmap you can rely on.
The capability you need has moved to a tier you are not willing to buy, or has been withdrawn.
Support failed you during an actual incident, as against being slow on a licensing question.
The agent is a persistent cause of tickets against your line-of-business software and the vendor has not helped you resolve it.
You are moving to a managed service and the incumbent does not offer one you find credible.
The console cannot manage machines outside the office and your workforce is now outside the office. This one is structural and will not improve.

Running the change without a gap

Never let the old licence expire on the assumption that the agent keeps working. Whether protection degrades on expiry, and how fast, is a per-product behaviour rather than an industry rule – so get the answer from your own vendor in writing before you plan a date, and until you have it, assume the worst and overlap.

On the machines themselves, the rule is one real-time product at every moment. Microsoft documents that on Windows client, Defender Antivirus goes into disabled mode automatically when a non-Microsoft antivirus solution is installed, so the handover there is managed for you. Windows Server is different: Microsoft’s instruction is to disable or uninstall Defender Antivirus manually when running a non-Microsoft product on a server that is not onboarded to Defender for Endpoint. A server left with two engines during a migration is the most common way a routine change becomes an outage.

What to ask for on the quote, whichever way you go

The same tier and the same term on both documents, so the comparison is real.
The multi-year price alongside the annual one, because term length usually moves the annualised figure more than the tier does.
What the tier contains today, from the vendor’s current page rather than the quote’s product name.
The supported migration path for an estate of your size, in writing, before you commit to a date.
Retention: how long detection history is kept at that tier, and what you can export when you leave.

The version trap, and why renewals are a good moment to check it

Version-locked licensing is not unique to security software and it behaves the same way everywhere: entitlements reach backwards, not forwards. Microsoft’s rule for Windows Server is a clean illustration – a Windows Server 2025 CAL permits access to Windows Server 2025 and prior versions of the server software, but an older CAL does not reach a newer server. Renewal season is when you find out whether anything else you own has the same shape, so it is worth listing your version-locked entitlements at the same time and checking that none of them is about to be outrun by a server or an operating system upgrade already in the plan.

When a licence is the actual fix

If the evidence says the incumbent is doing its job, renewing is usually the cheaper and lower-risk decision, and Arco can quote renewal licences for the main vendors so you can compare against whatever the in-product renewal offer says. It is worth asking us for both: a renewal price and a competing product at the same tier and term. Sometimes that moves the incumbent’s number; sometimes it confirms that staying is right, which is a useful thing to have on paper when somebody asks why you did not shop around. If you do move, ask us to build the overlap into the dates rather than lining the two terms up end to end.

Questions people ask about this

Is the automatic renewal price the best price?

Frequently not. In-product automatic renewal is a convenience and is priced as one. Asking a reseller for a renewal quote costs one email and often produces a different document, particularly if you are willing to commit to a longer term. Ask for the annual and multi-year figures on the same quote so you can see the actual trade.

How long should a switch take for fifty machines?

Plan several weeks, not a weekend. The technical work is quick; the tail is what takes time – machines that are off, users on leave, and one application that needs an exclusion nobody predicted. Waves of ten with a few days between them is a realistic shape, and it keeps every machine protected by exactly one product throughout.

Can we run the new product alongside the old one during the change?

Across the estate, yes, machine by machine. On a single machine, no. Two real-time engines inspecting the same files cause performance problems and mutual false positives. On Windows client Defender steps aside automatically when another product registers; on Windows Server Microsoft’s instruction is to disable or uninstall it manually, so servers need deliberate handling.

We are unhappy but cannot afford the migration effort right now. What then?

Renew for the shortest term you can get, write down the specific problems with dates, and give the vendor a defined opportunity to fix them with a review date in the calendar. Then decide next time from a record rather than a memory. A short renewal costs slightly more per year and buys you a decision made properly.

Should a mid-table result in a public test round make us switch?

On its own, no. Results move between rounds and one publication is not a trend. Your own ticket history is a better signal than anyone’s test round because it measures the product against your software, your users and your network. Switch on a pattern you can point at in your own data, not on someone else’s ranking.

Was this article helpful?

Your feedback helps us improve our documentation.

Review Norton Small Business vs Bitdefender Small Office Security Compared Review Malwarebytes Premium vs ThreatDown: Home Tool or a Real Console? Review Panda Dome Essential, Advanced, Complete or Premium: Picking a Tier Review Avast One vs Avast Premium Security: What You Are Actually Buying

← Back to Knowledge Base