Why the bundle hides the comparison
Two subscriptions can list the same eight features and behave completely differently, because a feature list describes what is included rather than what is done with it. The useful question is narrower: for each component, what does it inspect, where does it run, and what class of problem does it fail against? Once those three answers are written down, most of the difference between products turns out to sit in the platform and the price rather than in the feature list.
The criteria used below were fixed before any product was described, in the order set out in how comparisons here are built. They are: the job performed, where the component runs, the failure mode, and whether something free already does it.
| Component | Where it runs | Its characteristic failure | Free equivalent worth knowing about |
|---|---|---|---|
| Malware scanning | On the device, against files and installed applications | Something genuinely new, or something you installed and authorised yourself | Microsoft Defender on Windows; Google Play Protect on Android; application review on iOS |
| Web and link filtering | Between the browser and the network, before a page loads | An address too new to be on any reputation list | Safe Browsing in Chrome and Firefox; Fraudulent Website Warning in Safari |
| VPN | Between the device and the provider's server | Anything after the tunnel ends, and anything you are signed in to | Nothing equivalent; the free tier of a reputable provider is the nearest thing |
| Password manager | In the browser and the operating system keychain | A password reused outside it, or a weak master password | The manager built into your browser or operating system |
| Breach and identity monitoring | On the provider's servers, against breach corpora | Everything after the alert; it reports, it does not remediate | Free breach-notification services and provider-issued alerts |
Malware scanning
A scanner compares what is on the device against two kinds of knowledge: signatures, which are fingerprints of files already identified as malicious, and behavioural rules, which describe patterns of activity that tend to indicate malicious code regardless of what the file looks like. Signatures are precise and always slightly out of date. Behavioural rules catch newer things and produce more false alarms. Every scanner balances the two, and the balance is rarely disclosed in any detail.
The limit is structural rather than a shortcoming of any product. A scanner is looking for code that arrived without your informed consent. It is not looking for an application you searched for, installed, and granted permissions to, which is the route most consumer losses now travel. The Australian Cyber Security Centre publishes guidance for individuals and families that puts updates, multi-factor authentication and backups alongside protective software rather than behind it, and that ordering is worth taking seriously.
What a scanner is worth on each platform
The answer differs so much by operating system that a single verdict is meaningless. Windows allows deep inspection and ships with Defender. Android allows a constrained form of it and ships with Play Protect. iOS does not permit third-party applications to scan other applications at all. The platform comparison works through each case.
Web and link filtering
Filtering is the component that earns its keep most reliably, because the majority of consumer incidents begin with a link rather than a file. The tool checks an address against reputation data before the page renders and blocks or warns on a match. It is the only part of a subscription that intervenes at the moment a person is about to be deceived.
Two limits matter. The first is coverage: a filter only protects the browsers and applications it has been given access to, so a link opened inside a messaging app may bypass it entirely. The second is novelty: a domain registered an hour ago has no reputation to check. Filtering reduces exposure; it does not close it, and any description of it as blocking phishing without qualification is overstated.
Browsers already do a version of this at no cost, which is the honest context for the paid version. The paid one may cover more applications, or apply to the whole device rather than one browser — worth confirming against the vendor's own current description rather than assuming.
VPN
A VPN encrypts traffic between your device and a server operated by the VPN provider, then sends it onward from there. Two consequences follow. The network you are joined to — a café, an airport, a hotel — sees an encrypted tunnel rather than your destinations. The sites you visit see the VPN server's address rather than yours.
What follows from that is narrower than the advertising suggests, and this is the component most often oversold:
- It does not make you anonymous. Signing in to an account identifies you regardless of the address the request came from.
- It does not block malware or phishing. Those are different components that some products bundle alongside it.
- It does not hide your activity from the VPN provider, who is now positioned where your internet provider used to be. You have moved trust, not removed it.
- It does not encrypt anything beyond the exit server. From there onward, ordinary transport security applies.
Two settings decide whether a VPN does its job in practice. A kill switch stops traffic if the tunnel drops, which prevents a silent fallback to the unprotected connection. DNS handling determines whether name lookups travel inside the tunnel or leak outside it. Both are defined on the security terms page, and both are worth checking in a product's settings rather than in its feature list.
Password managers
Credential reuse is the mechanism that turns one organisation's breach into a problem across every account sharing that password. A manager generates a distinct password per site and stores it encrypted behind one master credential, which is the practical fix for reuse.
The bundled version competes with a capable free one. Browsers and both major mobile platforms include managers that sync across devices at no cost. A paid manager may offer cross-browser portability, secure sharing or a broader feature set; whether that is worth a subscription is a judgement about how you work, not a security ranking. What matters far more than which manager you choose is that you stop reusing passwords and turn on multi-factor authentication where it is offered.
Breach and identity monitoring
Monitoring searches breach data for an email address, and sometimes other identifiers, and notifies you when one appears. It is genuinely useful as an early warning, and it is frequently described in terms that promise more than notification.
The alert arrives after the disclosure, not before it. The service cannot withdraw leaked data, and it cannot act for you. The response is always the same and always yours to perform: change the password on the affected account, change it anywhere it was reused, and enable multi-factor authentication. In Australia, the Notifiable Data Breaches scheme requires organisations to notify affected individuals and the Office of the Australian Information Commissioner where a breach is likely to result in serious harm, so for many breaches you will hear directly from the organisation involved.
Putting the components in order
If the question is which components carry the most weight for a household in Australia, the answer suggested by public guidance rather than by any product is fairly consistent: keep the operating system and applications updated, turn on multi-factor authentication for email and banking first, stop reusing passwords, and keep a backup you could actually restore from. Protective software sits alongside those measures and adds most where it filters links and where the platform permits real scanning.
The one product covered in detail on this site is described on products covered in this library, which keeps the vendor's statements separate from what is simply not stated. Pricing behaviour over time — introductory term against renewal term — is handled in subscriptions, renewals and refunds.