Surfshark One review: Adequate antivirus protection with caveats

Surfshark is well-known for its VPN service, but if you subscribe to its higher tier plans, antivirus gets included as part of the package, too.

That can be a plus for those who already know and love Surfshark’s interface, as the app is extremely clean and simple. But while Surfshark offers adequate malware protection, a couple of caveats make it a harder sell, especially if you’re seeking lightweight, antivirus-focused security software.

Surfshark offers real-time scanning that hunts for malware, suspicious links, and dodgy email attachments; web protection that blocks dangerous links and remote access initiated by bad actors and unauthorized webcam access (currently a beta feature, but available to users). Additionally, system scans dig into vulnerable parts of your PC (like registry items) to look for oddities or changes.

The Surfshark One suite also includes access to the company’s VPN service (arguably the star of the show—more on that below), data breach monitoring, its “alternative ID” service that lets you create a profile with a fake email address, name, address, and birth date to feed to websites, and a private search engine.

Unlike many security suites, Surfshark does not include a firewall as part of its software.

Surfshark One supports up to five devices for antivirus and lets you install the software on Windows, macOS, and Android devices. For the VPN, you can install the software on unlimited devices and more platforms: Windows, macOS, Linux, Android, iOS, and three browsers (Chrome, Firefox, and Edge).

Surfshark One gets cheaper the more time you pay for upfront. If you buy a 12-month plan, it currently costs $55 for the first year, and includes four bonus months. If you buy a 24-month plan, it costs $70 for the first year and also includes four bonus months.

Afterward, Surfshark will charge $79 per year (or whatever renewal price is most current). Two-year plans will revert to one-year plans for renewal. Otherwise, a monthly subscription is $18 per month.

By default, users are enrolled in auto-renewal. Renewals are charged 30 days before the term refreshes. The company offers refunds if requested within the first 30 days of signup.

To install the Surfshark app, you’ll first need to create an account and purchase a subscription—and the process can be slightly awkward. A standard passphrase from our password manager (e.g., correct-horse-battery-staple) wasn’t accepted. We had to add a special character to meet the requirements. Also, you only enter the password once, so you can easily type in something different than you think you entered.

Surfshark does allow password resets, but they can be quirky. After I performed one, trying the new password gave a “There have been too many attempts to log in” error message. I had to wait about five minutes before the new password worked.

Once you have an account, you’ll use your login for the app and the web interface.

Currently, Surfshark’s antivirus protection serves as an addition to its VPN—not the other way around, as with most antivirus suites.

The app’s layout puts the emphasis on the VPN: It’s the first item in the left navigation bar, which fully slides out when you hover your mouse on that side of the window. The second and third tabs are for the Alternative ID and Alert features, which link to the web interface. Then finally comes Antivirus… but you must first install the antivirus component of the software for your PC to be protected. If you’re expecting antivirus protection from the start, this extra step can feel cumbersome (and a little annoying).

Overall, the app is pared down and minimalist—not at all technical. Every screen is simple but clean and easy to understand. There’s no home screen or dashboard. For each feature, the window is divided into two sections, with a main center pane and a right-hand sidebar.

The main area shows information related to the feature (e.g., scan options for antivirus) while the sidebar shows the feature’s status (e.g., if scan is occurring and its progress). Surfshark puts all options in these screens, so you don’t have to dig elsewhere. Also, in a nice touch, you can resize the window to see more (or less) information at once.

Meanwhile, Surfshark’s settings are sparse, especially in the app. The only real adjustment you can make to scans are if they automatically include external drives, for example. Outside of the options within each feature screen, you can really only tinker with the VPN.

The companion web interface isn’t much more robust. Though it mirrors the look of the app, with a similar layout of left navigation bar, main screen, and right sidebar, you primarily use it to manage just two features: Alternative ID and Alert. If you also subscribe to Surfshark’s separate, optional “Incogni” data broker removal service (an additional $4 per month), you’ll control it via the web as well.

However, the web interface does have a few more extended settings for features—manual VPN settings live here, as well as device management for antivirus coverage. It can be confusing at first, but with how simple Surfshark is, adapting to the split interfaces comes pretty quick.

Like other antivirus software, Surfshark remains on alert for threats, both local and online. On your PC, it examines opened or added files, screens downloaded email for sketchy links and attachments (including .zip and other archive files), and watches for unusual behavior from apps.

When you’re online, the app stays on the lookout for malicious downloads, as well as suspicious links (including phishing attempts). It’ll also block unauthorized use of your webcam, so long as you enable webcam protection, which is still a beta feature.

By default, Surfshark scans your system on a daily basis. A quick scan runs on six of the days, while a full scan happens on the seventh. Both are set for the time you first install the app. You can also perform an on-demand scan—this defaults to just the installed drive on your PC, unless you’ve turned on scans of external storage drives. You can also choose a specific file or folder.

During both quick and full scans, Surfshark examines registry items, network settings, Windows’ boot sector, drivers (and affiliated areas), as well as often targeted folders (Downloads, Documents, Desktop). For a broader critical look at your files, run the full scan.

For quick and full scans, you can adjust schedule and timing, but not what is scanned. Settings are also extremely minimal—you can choose to turn on automatic scanning of external storage drives during quick and full scans, automatic scanning of external storage drives when first connected, and if quarantined items are automatically deleted.

Surfshark’s primary service is its virtual private network, which securely routes your traffic so that it registers as coming from a different location. (Useful if you want to remain anonymous, or look at content not available in your region.) Its antivirus is not available as an independent subscription—rather, malware protection is an add-on feature as you move up to more expensive plans.

You can read PCWorld’s full thoughts on Surfshark’s VPN in our review, but overall, the experience is mostly smooth and streamlined when it works. (More on that in just a moment.) You can use the VPN on an unlimited number of devices, and while active, the service automatically blocks ads and pop-ups, as well as cookie consent notifications.

You also have the option to do multi-hop connections, which sends your online traffic through two VPN services for greater anonymity. If you need to run an app or access a website independent of the VPN, you can specifically set them to bypass it.

I found that Surfshark didn’t work at all locations. While on a Hilton hotel’s public Wi-Fi network, the app struggled (and effectively failed) to connect, citing limited access through the hotel’s network. Meanwhile, rival ProtonVPN connected immediately. When asked, Surfshark cited possible firewall rules, DNS filtering, or port management that could have blocked access to the VPN servers.

For locations, you can choose dedicated servers in Australia, Austria, Belgium, Brazil, Bulgaria, Canada, Chile, Colombia, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hong Kong, Hungary, Iceland, India, Indonesia, Ireland, Israel, Italy, Japan, Latvia, Lithuania, Luxembourg, Malaysia, Mexico, Netherlands, New Zealand, Nigeria, Norway, Poland, Portugal, Romania, Serbia, Singapore, Slovakia, Slovenia, South Africa, South Korea, Spain, Sweden, Switzerland, Taiwan, Thailand, Türkiye, Ukraine, United Arab Emirates, United Kingdom, and the United States.

Additional virtual servers are available as well, though they’re of most use to those who care about location rather than privacy. Surfshark also makes clear in the app which are the fastest servers.

One of Surfshark’s more unique features is Alternative ID, which not only creates masked email addresses but a whole false identity to help preserve your identity online.

By default, these are randomly generated. For email masks, ten domains exist (the part that comes after “@”), with an oddly strong sea theme. Five of the domains are obviously based on fish names and the randomly generated usernames often use the name of an aquatic creature. Fortunately, you can manually edit the suggestions, in case you’re aiming for a different vibe.

For the identity, you get assigned a full name and address. (I became Hector, a guy living in Tasmania, Australia.) Like the email masks, you can edit what the app spins together, in case you want a different name, gender, or general locale. You can’t choose a specific address, only the country and state/province, with just six countries as options—the US, Denmark, Australia, Germany, Portugal, and Brazil.

The suggested addresses are real—Surfshark says it uses a “publicly available address database provided by governmental institutions.” So if your home is part of a public database (and it very likely is), it could get used for someone else’s fake identity.

Surfshark also offers the ability to mask your phone number, but you must pay an additional subscription fee of $2.50 per month. Virtual phone numbers are limited to USA country codes, and can receive calls and text messages. You can reply to text messages through your virtual number but not return calls.

Labeled simply Alert, this feature looks for appearances of your email addresses in data breaches—as well as any leaked passwords, personal information, or IP addresses tied to a particular email address. For the Surfshark One subscription, you can track an unlimited number of email addresses. You can also monitor unlimited credit card and ID numbers (e.g., social security number) through this feature.

Alerts are managed in the web interface, with several settings you can tweak related to data breach reports and data breach alerts.

Surfshark offers a search engine that it says allows private searching for “truly organic results.” The company does not maintain the engine itself; instead it says it relies on “third-party APIs.”

You can initiate a search from the web interface or the app, but ultimately, you’ll get pointed to https://search.surfshark.com/. You can just bookmark this address for use, though it’s only available if you’re logged into your Surfshark account on that browser.

Search results are generally streamlined, with a mix of sources that include Reddit posts and YouTube videos. You can choose between Web, Images, and Videos for result types, and also change the locale to a different country. If you’re used to the additional helpful answers and suggested links from search engines like Google and Bing, Surfshark’s results may feel a bit bare-bones.

You can access Surfshark’s support and help pages through the app (Settings > Get help). From there, you can jump directly to popular support pages. Alternatively, you can head to the company’s help and contact page. To get in touch with Surfshark, you’ll file a help request or use chat.

From these settings, you can also run Surfshark’s troubleshooting tools—Collect Diagnostics (which aids the Surfshark team in identifying issues), Reset network, and Restore original settings.

Virus database updates happen automatically in the background every three hours, as well as every time a scan starts. You can’t otherwise adjust the timing, though you can manually check for new virus definitions.

Currently, Surfshark does not have data for the most recent tests from AV-Test and AV-Comparatives, two independent security organizations who evaluate antivirus software performance. However, in AV-Test’s zero-day exploit and malware tests for May and June 2025, Surfshark took home perfect scores. It caught 100 percent of the 407 zero-day attack samples and 19,213 widespread and prevalent malware samples.

(Note: Antivirus software companies voluntarily elect to participate in AV-Test’s benchmarks. When asked about its participation frequency, Surfshark said: “We don’t see the need to perform these every couple of months, as these tests are exactly the same month over month with just different malware samples. We normally perform these tests when we see a change in the malware landscape, or we want to test a new backend feature and verify the improved performance independently.” Currently, Surfshark has scores with AV-Test for only December 2022, June 2024, and June 2025.)

Surfshark does have more recent testing data available through AVLab. In AVLab’s March 2026 Advanced in the Wild Malware test, Surfshark scored a 70.78 percent rating for catching malware before infecting the system, and 28.74 percent rating for stopping malware after running on the system. And crucially, it missed two samples in the set. These results fall very short of rivals like ESET, Bitdefender, and Avast, all of which blocked malware 100 percent before launch.

When left to run in the background, Surfshark affects system performance fairly little. The real-time scanner only caused under a two percent decrease for the score in PCMark 10, which simulates video conferencing, web browsing, and editing in open-source document and image apps.

Similarly, in our Handbrake encode test, which involves crunching down a large video into a smaller 1080p30 file, the increase in time to complete the task was also under two percent. Surfshark’s screening does increase when editing documents in Microsoft Office programs like Word, Excel, and PowerPoint—UL’s Procyon benchmark scores dropped by almost nine percent.

On the flip side, Surfshark can drag hard on your PC’s resources during full scans. On our budget laptop, running a continuous scan dropped PCMark 10 scores by a notable 36 percent—and that was the smallest impact. Procyon results decreased by a whopping 53 percent, and Handbrake encodes shot up in time needed by a painful 72 percent.

Of course, you can mitigate this effect by changing the schedule of system scans (especially full scans) to happen during off-hours. And with this much of an effect, you definitely want to steer clear of scan times—which could be a potential issue for those who are active on their PCs for most hours of a day.

If VPN coverage is your first priority (and you’re already sold on Surfshark’s VPN), subscribing to Surfshark One should expand your security protection to include seemingly adequate antivirus protection. However, if you’re primarily in the market for antivirus software, you’ll get more bang for your buck with a different suite—and a rival won’t hit your system performance nearly so hard.