The short answer: real-time scanning and automatic threat updates stop. On-demand scans usually keep working. Microsoft research found expired systems were four times more likely to be infected. Here is exactly what changes the day your subscription lapses.
Behavior varies slightly by vendor, but this is the typical pattern across Norton, McAfee, Bitdefender, Kaspersky, and Trend Micro.
A 30-day-out reminder gives you time to decide before your protection drops.
Done in seconds. No sign-up required.
The most-cited number on this comes from a 2014 Microsoft Security Intelligence Report: systems running expired security software were four times more likely to be infected with malware than systems running up-to-date protection. That ratio has held up across later studies because the underlying cause has not changed — without fresh definitions and active scanning, the most common malware paths (drive-by downloads, malicious email attachments, infected USB drives) are no longer screened.
Day-to-day, the risk is uneven. If you mostly use a Mac for trusted apps, the practical exposure during a short lapse is small. If you use a Windows machine for general browsing, downloading, and email, every day with no real-time protection is a measurable increase in infection probability.
"Systems that run expired security software are four times more likely to be infected with malware than those running up-to-date security software."
— Microsoft Security Intelligence Report, 2014
On Windows 10 and 11, Microsoft Defender is built in and free. It is also disabled by default whenever a third-party antivirus is installed. The disable does not lift just because the third-party tool expires. Until the expired product is uninstalled, Defender stays off — meaning a Windows machine with expired Norton or McAfee installed is, in practical terms, a Windows machine with no real-time protection at all.
The fix is simple but easy to miss: uninstall the expired antivirus first, then check Windows Security. Defender should activate automatically. Verify under Settings → Privacy & Security → Windows Security → Virus & threat protection that Defender is listed as the active provider.
Whether Defender alone is enough is a usage question. How-To Geek noted in February 2026 that Defender catches nearly everything most home users encounter. PCMag's 2026 explainer still recommends a paid third-party antivirus on Windows for the highest detection rates and bundled extras like VPN or password manager.
If your antivirus is approaching expiration and you do not yet know whether you want to renew, switch, or fall back to Defender, follow this sequence. It minimizes both the protection gap and the chance of being silently auto-charged at the higher renewal rate.
Buys you the freedom to decide without pressure. See the vendor-by-vendor cancellation guide for the steps.
New-customer price for the same vendor, competitor pricing, and whether Windows Defender alone fits your usage.
Renew at the new-customer rate, install the new tool, or uninstall to activate Defender. Do not leave the expired product installed.
Check Windows Security or your new tool's dashboard. Confirm real-time protection shows green and definitions are current.
For where to find your exact expiration date in Norton, McAfee, Bitdefender, Kaspersky, Avast, or ESET, see how to check when your antivirus expires. This page is part of the antivirus renewal reminder pillar.
Not entirely. Most paid antivirus apps drop into a degraded mode after expiration. On-demand scans of files you specifically check usually still work. Real-time scanning, automatic threat-definition updates, and behavioral monitoring stop. The product nags you to renew while protecting nothing in the background.
Riskier than most people assume. A 2014 Microsoft cybersecurity report found systems running expired security software were four times more likely to be infected with malware than systems with up-to-date protection. The risk compounds the longer the lapse continues, especially on Windows machines used for browsing and email.
On Windows 10 and 11, yes — but only if you uninstall the expired product. Windows Defender stays disabled while a third-party antivirus is installed, even after that antivirus expires. Until you uninstall the expired tool, you have effectively no real-time protection at all.
For many home users, yes. How-To Geek noted in 2026 that Defender catches almost everything, with email, browser, and firewall defenses handling the rest. PCMag's 2026 review still recommends third-party antivirus on Windows for users who want the best detection rates and extras like a VPN or password manager.
If you immediately uninstall the expired product so Windows Defender activates, the gap can be days or weeks without obvious risk. If you leave the expired antivirus installed, every day adds risk because Defender is suppressed. The cleanest order: cancel auto-renew, expire, uninstall, decide.
Compare the renewal price to the new-customer price for the same vendor and to competing vendors. If the renewal is much higher, switch or restart as a new customer. If a free option like Windows Defender is enough for your usage, uninstall the paid product so Defender activates.
A reminder 30 days before expiration gives you time to renew, switch, or activate Windows Defender on your terms — not after a silent auto-charge.
Set Antivirus Expiration ReminderLast modified: