Shops and pop-ups will happily sell you a security suite. Here's the honest version of whether you need one.
The short answer
For most home users, Windows Security (also called Microsoft Defender), which comes with Windows and is switched on by default, is enough. It scans, updates itself and generally holds up well in independent tests. If you do nothing else, don't turn it off, and don't install a second "real-time" antivirus beside it. Two of them fighting each other slows the computer down and can leave gaps.
What actually protects you more than any antivirus
- Updates. Keep Windows, your browser and your apps up to date.
- Careful clicking. Most infections today come from people being tricked, not from clever software. Phishing emails and scam messages get past every antivirus.
- A password manager and two-factor authentication. They protect you even when something slips through.
- Downloading from the official source. Cracked software and "free" downloads from random sites are the classic way in.
When a second tool helps
A free on-demand scanner such as Malwarebytes Free is useful as a second opinion when something feels off. You run it by hand, it doesn't compete with Windows Security, and it catches things other tools sometimes miss. Paid suites can add extras (web protection, family controls, a bundled VPN), which are nice to have but not essential.
The fake antivirus problem
A pop-up that says "Your PC is infected! Click to scan" is not your antivirus. It's an advert or a scam, often trying to sell you something useless or install something harmful. Close the tab, or the whole browser, and don't call any number shown. See my post on fake Microsoft calls for how the phone version of this works.
Signs it's worth a proper look
If Windows Security keeps turning itself off, shows a warning you can't clear, or the computer is behaving oddly, read what to do if your computer might be infected, or get in touch and I'll check it.