Surfshark Antivirus: the feature list, feature by feature

What each advertised feature actually does, how much it is worth, and which ones duplicate something your operating system already gives you.

By Jennifer Bell, director of publicationPublished 21 September 2026Feature analysis

A feature list is only useful if somebody tells you which entries matter. This one goes through them in order and marks each as genuinely useful, duplicated by something free, or largely cosmetic.

Real-time protection Core

The resident scanner. It hooks file operations and checks anything written, opened or executed against the signature database, then against heuristic and behavioural rules. This is the feature. Everything else on this page is an accessory to it.

Available on Windows, macOS and Android. Not available on iOS or iPadOS, where the operating system does not permit it. How the mechanism works.

Worth it? Yes, but note that Windows and macOS both ship an equivalent at no cost. The value of a third-party scanner is a second vendor’s judgement and a single management interface, not protection where there was none.

Scheduled and on-demand scanning Core

Full-disk and targeted scans, either on a timer or when you ask. The point of a scheduled scan is not to find what real-time protection missed today; it is to re-examine files that were already on the disk against signatures added since they arrived.

Worth it? Yes, once a week, overnight. Running one daily costs you performance and buys you very little.

Webcam access alerts Useful

Notifies you when an application requests the camera. Worth having, with the caveat that both Windows and macOS already show a hardware indicator light and a system-level permission prompt for camera access. This is a third notification of something you were going to be told about anyway.

Worth it? Mildly. Do not let it be the reason you subscribe.

Ad and tracker filtering Part of the VPN

Worth being precise here, because marketing tends to blur it: this is a function of the VPN component, not the antivirus. It filters requests to known advertising and tracking domains, typically at the DNS level, which also blocks a proportion of malware-distribution domains as a side effect.

DNS-level filtering is a blunter instrument than a browser content blocker — it cannot remove an element from a page, only refuse to resolve a hostname — but it works across every application on the device, not just the browser, and it costs no browser memory.

Worth it? Yes, and it pairs well with a browser-based blocker rather than replacing one.

Breach alerts Useful

You register email addresses, and in some configurations payment cards or identity documents, and the service tells you when one appears in a published breach dataset. This is genuinely useful — credential reuse after a breach is one of the most common ways ordinary accounts get taken over.

It is also a service several free tools provide, and your password manager or browser may already be doing it without you noticing. Check before valuing it highly.

Private search Cosmetic

A search front end that does not build an advertising profile from your queries. Pleasant. Several free search engines offer the same proposition. This is unlikely to be anybody’s deciding factor and we would not present it as one.

Features it does not have

A fair review names the gaps. At the time of writing the bundle does not include:

• A password manager. Some competing suites bundle one. This does not.
• A firewall. You are relying on the operating system’s, which for most home users is fine.
• Parental controls or content filtering by category.
• Encrypted cloud backup. Several rival suites include storage; this does not, and as noted elsewhere a backup is the one thing that reliably defeats ransomware.
• Any antivirus at all on iOS or iPadOS. See device support.
• A published independent detection score. We could not find a current AV-TEST or AV-Comparatives entry for this product.

The summary table