The way Americans protect their devices is undergoing a quiet shift. According to the second annual Antivirus Market Report 2026 from cybersecurity news portal Cybernews, built-in operating system tools have overtaken traditional third-party antivirus software as the primary line of defense for the majority of US internet users, while smartphones remain dangerously underprotected.
The study, based on a survey of 1,005 US adults conducted between March 30 and April 10, 2026, also shows a sharp drop in consumer enthusiasm for AI-powered security and a measurable rise in cybercrime.
Key findings:
- 53% of US PC users and 51% of mobile users rely on built-in OS security (such as Microsoft Defender or Apple’s native tools) as their primary protection, which is roughly 139 million and 134 million Americans, respectively.
- Only 18% of mobile users invest in third-party antivirus, compared with 41% on computers; 14% of mobile users use no cybersecurity tools at all.
- Favorability toward AI-powered threat detection fell from 77% in 2025 to 47% in 2026.
- The share of Americans who reported experiencing cybercrime grew by 14% year over year.
- McAfee and Norton remain the leading third-party brands for the second year in a row; AVG dropped out of the rankings entirely.
- Paid antivirus has overtaken free versions: 68% of PC and 66% of mobile antivirus users now hold a premium subscription.
- Data breaches were named the single greatest personal cybersecurity threat by 36% of respondents.
Smartphones are severely underprotected
Smartphones are the most-used personal device as 85% of respondents use one outside of work, yet they receive the least investment in security. Beyond the 14% of mobile users who report no protection at all, another 16% are unsure what protection they have, leaving a substantial share of the US smartphone population effectively unguarded.
Compared with the 2025 report, third-party antivirus use on mobile devices fell by roughly 10 percentage points, while computer protection inched up by two.
AV market consolidates around two names
Among third-party antivirus users on computers, McAfee leads with 40% market share, followed by Norton (37%), Malwarebytes (19%), and Bitdefender (9%).
On smartphones the order flips: Norton takes 42%, McAfee 39%, Surfshark 16%, and Bitdefender 15%.
The strong showing of Surfshark and Bitdefender on mobile points to growing traction among multi-tool security users. AVG, which appeared in last year’s report, was not used by survey respondents at all in 2026.
Consumers are okay with paying more for protection
Among users who do choose third-party antivirus, paid subscriptions are now clearly preferred: 68% of PC antivirus users and 66% of mobile antivirus users hold a premium plan, a notable jump from the 32% in 2025.
The data suggests that the segment still actively purchasing antivirus is increasingly willing to spend more for stronger protection, while everyone else is migrating to whatever ships with their device.
Antivirus is becoming one tool among many
Americans are no longer relying on antivirus software in isolation. VPNs are now used by 62% of PC and laptop users and 65% of mobile users, ahead of ad blockers and password managers.
The AI hype in cybersecurity is fading
Enthusiasm for AI-based security has collapsed in just twelve months. Favorability toward AI-powered threat detection dropped from 77% in 2025 to 47% in 2026, and 9% of users said AI features would actively make them less likely to use a given antivirus product.
Cybercrime keeps climbing
The share of Americans reporting personal experience with cybercrime rose by 14% year over year. Among those affected, 74% said the experience directly influenced their decision to start or continue using antivirus protection, meaning that, for many US consumers, security upgrades still tend to follow a harmful experience instead of preventing it.
Trust is now a huge competitive differentiator
Forty percent of respondents had heard of antivirus-related controversies, including Kaspersky’s US ban over national security concerns and Avast’s case for selling user browsing data. Among those aware, 82% said the information influenced their trust or purchasing decisions. The effect was strongest among users aged 18–24.
Demographic differences persist
Women are less likely than men to fall victim to cybercrime and tend to rely more on built-in tools and free antivirus software. Men are more likely to invest in paid third-party antivirus and additional security tools. Among non-users, men also showed higher levels of distrust toward antivirus software overall.
Data breaches are the biggest cybersecurity fear
When asked to identify their greatest cybersecurity concern, 36% of respondents named data breaches at companies that store personal information, followed by phishing (31%), accidentally downloading malware (24%), and being specifically targeted by hackers (24%).
Notably, AI-related threats such as deepfake scams entered the top five, ranking ahead of the long-standing concern of unsafe public Wi-Fi.
The full report is available at: https://cybernews.com/best-antivirus-software/antivirus-market-report
Methodology
The survey was conducted online via the Cint panel between March 30 and April 10, 2026, among 1,005 US respondents aged 18 to 74. Quotas were applied to ensure balanced representation across age, gender, and region. Margin of error: ±3.1% at the 95% confidence level. Population estimates referenced in the report are based on US Census Bureau 2026 data.
Edtech Firm Instructure Admits To Being Pwned
Posted in Commentary with tags Hacked on May 4, 2026 by itnerdEducation technology firm Infrastructure, best known for its widely used learning management platform Canvas, confirmed that it was the victim of a data breach. Yesterday, the ShinyHunters cybercrime group claimed they stole 3.65 terabytes of data from more than 9,000 schools.
We are providing an update on the security incident we advised you of yesterday. While our investigation continues alongside our outside forensics experts, at this stage we believe the incident has been contained.
Here are the steps we have taken since we became aware of the incident. We have:
– Revoked privileged credentials and access tokens associated with affected systems
– Deployed patches to enhance system security
– Out of an abundance of caution, we rotated certain keys, even though there is no evidence they were misused
– Implemented increased monitoring across all platforms
While we continue actively investigating, thus far, indications are that the information involved consists of certain identifying information of users at affected institutions, such as names, email addresses, and student ID numbers, as well as messages among users. At this time, we have found no evidence that passwords, dates of birth, government identifiers, or financial information were involved. If that changes, we will notify any impacted institutions.
Brian Bell, CEO of customer identity and access management platform FusionAuth:
“This is the uncomfortable truth for edtech: student data now moves through a sprawling web of identity systems, APIs, and third-party integrations. Instructure has not confirmed how the attackers got in, but its response shows where the risk had to be contained, privileged credentials, access tokens, and application keys. In edtech, credential governance is student data protection.”
Ensar Seker, CISO at threat intel company SOCRadar:
“The disruption tied to API keys is a strong indicator that identity and access management, not just perimeter security, was the real failure point. When privileged tokens or API credentials are exposed, attackers can bypass traditional defenses and operate as trusted entities. In environments like Instructure’s Canvas, where integrations and automation are core, this creates a high-impact blast radius very quickly.
“The involvement of ShinyHunters and claims of access to a Salesforce instance suggest this may be more than a single-system breach, it points to lateral movement across SaaS ecosystems. Organizations often underestimate how interconnected these platforms are; once attackers gain a foothold, misconfigured integrations and over-permissioned tokens allow them to pivot and aggregate data at scale. Even if highly sensitive fields like financial data or government IDs were not exposed, the combination of names, emails, student IDs, and communications still creates long-term risk. This type of dataset is extremely valuable for phishing, identity correlation, and social engineering campaigns, especially in education, where users are less likely to question trusted platforms.
“The key lesson here is that revoking credentials after the fact is necessary but not sufficient. Organizations need continuous monitoring of API behavior, strict token lifecycle management, and least-privilege enforcement across all integrations. In modern breaches, it’s not just about how attackers get in, it’s about how long they can operate undetected using legitimate access.”
This likely won’t end well in the long term as ShinyHunters is involved. They are on a tear as of late with no end in sight to their spree of hacking anything within their reach.
Leave a comment »