Why Apple iPhones don't need antivirus software

You've been conditioned to believe every device needs the best antivirus software, but that isn't true for Apple's iPhones and iPads. While many security companies offer products that support the iPhone, they're not really antivirus software; Apple has made sure that you don't need it.

Why? Apple says it "designed the iOS platform with security at its core." That's more than just a simple platitude, While iPhones and iPads aren't completely fool-proof devices — especially after they've been jailbroken — the iOS platform sandboxes apps inside of a user partition that limits access to the system. (That's not true of Macs, which is why they need the best Mac antivirus programs.)

  • Maybe not antivirus, but you could use a Mac VPN...
  • ...or an iPhone VPN to protect your data

Keep iOS updated

While you may read stories about iPhone security and privacy, such as a backdoor flaw in its Wi-Fi chip and how an iCloud account can hold a device hostage, third-party solutions can't touch those issues. Apple guards the iPhone's security measures so closely that the most you can do is install iOS updates, which normally include security fixes.

Of course, don't feel the need to do so immediately, as some updates are less stable than others. Unless you're a high-profile individual and you suspect the target of online attacks, you can probably wait a week or two after the most recent update comes out.

iOS doesn't let antivirus work

In order to understand why you don't need antivirus software for your iOS device, it's important to understand how those programs function on devices that run other operating systems. Rich Mogull, analyst & CEO of the Securosis security firm, tells us that in order for antivirus software to work, it needs hooks into the operating system that — when available — "also create potential vulnerabilities."

Mogull explained that these hooks provide "very deep access to monitor what's going on and detect malware," and can lead to situations where the antivirus software "becomes the target of the attack." iOS doesn't allow for the possibility to latch such hooks into its system, thanks to a design that deeply separates the apps from the rest of the system, a process commonly known as sandboxing.

Credit: Denys Prykhodov / Shutterstock.com

(Image credit: Denys Prykhodov / Shutterstock.com)

That strong fence between apps and operating system has currently proven a successful design choice, as Mogull told us that "history shows this is far better" and that "it stops malicious software before it can ever get a foothold." 

Android also sandboxes apps, but gives apps far more leeway in affecting other apps and the operating system than Apple does with iOS. That's why your Android phone needs one of the best Android antivirus apps.

This way, no apps you download or websites you visit have a chance at cracking the digital safe that contains fingerprint information used by iPhone Touch ID sensors, or steal photos off your device. Sure, you could accidentally click on permissions that let an app access those photos, but no app can access data without asking.

So, for the time being, iOS is proving that its architecture is strong enough to not need antivirus software, which may have been the reason why Apple removed a number of antivirus apps from the App Store in March 2015. Sure, Mac, PC and Android platforms practically require antivirus software, but that's because those operating systems bear more open designs.

And what of the iOS security apps?

The various iOS security apps made by antivirus vendors vary in their functionality. Some, such as Avira Mobile Security, let you remotely wipe your phone if it is lost or falls into the wrong hands. But the same functions are found on Apple's Find My iPhone app, which requires iOS 8.

Bitdefender Mobile Security provides the same remote location, lock and wipe tricks you get with Find My iPhone, it does offer one unique trick. After you register your email accounts with the app, it will alert you if your accounts ever get breached so that you can change your passwords immediately.

McAfee's Private Photo Vault, Backup, Mobile Security app offers users a way to lock photos behind a six-digit PIN, but many iOS users already use a password to lock their devices. You can get an app like this if you want a second level of security, but we're not sure why you'd need it, aside from hiding things from anyone that knows your unlock code.

Apps such as Webroot SecureWeb Browser offer protection against malicious websites, promising to save you from phishing attacks. While that sounds like a great feature, Safari on iOS offers a Fraudulent Website Warning feature that is enabled by default. 

Most website screeners work off publicly available lists of known malicious URLs, so it's unlikely that McAfee's would be much better than Apple's. Also, phishing attacks are so prevalent that by now you shouldn't need an app to remind you not to click on questionable links or type your username and password into suspicious-looking websites.

TOPICS
Henry T. Casey
Managing Editor (Entertainment, Streaming)

Henry is a managing editor at Tom’s Guide covering streaming media, laptops and all things Apple, reviewing devices and services for the past seven years. Prior to joining Tom's Guide, he reviewed software and hardware for TechRadar Pro, and interviewed artists for Patek Philippe International Magazine. He's also covered the wild world of professional wrestling for Cageside Seats, interviewing athletes and other industry veterans.

  • jlaw3x7
    If a device is jailbroken, the attack surface has already been dramatically widened. Thinking that one can stop malicious software before it gets a foothold is a fallacy given the device is already in a compromised state. Some might assume that only knowledgeable users (which can avoid such threats) jailbreak their devices, but a review of enthusiast forums would quickly reveal the inaccuracy of that line of thinking. Even so, we are all human and make mistakes. A jailbroken device needs to be protected from malicious software and mobile security software can provide a valuable solution for these devices.
    Reply
  • philometis
    Excellent article on the inherent security of iOS, however I encountered an issue that isn’t explained by your article - perhaps not surprisingly it was while I was using Chrome on my iPad Pro - Chrome locked up because of what I assume was adware - in my case, giftkindlebook.top says congratulations... I’ve never had a similar issue using Safari, but those of us that don’t belong to the Apple cult are used to using Chrome, so why doesn’t the “protection” extend to Chrome? I could guess but I don’t want to be cynical ;-)
    Reply
  • Graybush
    20694058 said:
    Excellent article on the inherent security of iOS, however I encountered an issue that isn’t explained by your article - perhaps not surprisingly it was while I was using Chrome on my iPad Pro - Chrome locked up because of what I assume was adware - in my case, giftkindlebook.top says congratulations... I’ve never had a similar issue using Safari, but those of us that don’t belong to the Apple cult are used to using Chrome, so why doesn’t the “protection” extend to Chrome? I could guess but I don’t want to be cynical ;-)

    Hey there!

    Your response prompted Henry to write our latest installment of 'Help Me, Tom's Guide!'. You can check it out here: https://www.tomsguide.com/us/how-to-stop-ios-browser-hijacking,review-5151.html
    Reply
  • aussecpaul
    I am calling BS on this article as of now. I am 99% sure I have a virus right now. I'll update if I am wrong but 20 yrs net/sys engineer, 15 in infosec. What I am seeing at this very moment is virus. Blocking all AV apps. Blocking MMS inbound. Phone is not jail broken. But just in general, anyone that says you don't need anti-virus is 100% complicit in idiocracy. How you can even write for a well known site is amazing. DUMBEST advice ever heard!!!! Again, if I am wrong, I'll update but I stick by the lack of professionalism to say one does not need anti-virus.
    Reply