A typical security suite starts with antivirus and firewall protection and supplements that core with possibilities like spam filtering, parental control, backup, VPN, and more. Surfshark One integrates VPN, antivirus, and a bit of identity protection, with a few bonus features. Surfshark VPN remains the best part of this limited collection, and its antivirus capability has improved since we last tested it. That said, its score remains the same because it simply doesn’t offer as many components as some competitors. If you want a more full-featured suite with VPN included, Norton 360 Deluxe is our Editors’ Choice winner for cross-platform multi-device security suites.
How Much Does Surfshark One Cost?
You pay $40.68 per year for a five-license Surfshark One subscription, which comes out to $3.39 per month. The pricing page offers “+4 EXTRA months,” but you pay for those months, for a total bill of $54.24. Note that these prices changed frequently during our review and evaluation.
You may encounter advertisements for Surfshark Antivirus, billed as antivirus protection with a bonus VPN component, while Surfshark One presents as a VPN with included antivirus. My contacts at the company confirm that these are the same apps reviewed here, just with a different promotional emphasis.
A Surfshark One subscription lets you install antivirus protection on five Windows, macOS, or Android devices, plus unlimited VPN installations. Bitdefender Internet Security, for comparison, costs $84.99 per year for five licenses or $99.99 for 10. Its VPN component requires an extra payment to lift daily bandwidth limitations, but the Bitdefender suite also packs in vastly more security components than Surfshark.
Norton 360 Deluxe costs quite a bit more at $119.99 per year, but that gets you five security suite licenses, five no-limits VPN licenses, and 50GB of storage for online backup. If you want more Norton licenses, you must pay for one of the Norton 360 With Lifelock suites, which start at $149.99. Surfshark doesn’t limit VPN licenses, but it also doesn’t offer packages with more than five licenses for components other than the VPN.
The new Norton Ultra VPN Plus weds an enhanced Norton VPN with a subset of Norton 360’s features for $129.99 per year (after the first-year discount). But when your focus is on VPN protection, Surfshark One is a more economical choice.
Getting Started With Surfshark One
Your online Surfshark account is an important resource. It’s where you download your protection, among other things. Surfshark VPN runs on an unusually wide selection of platforms, including Android, ChromeOS, iOS, Linux, macOS, and Windows. However, Surfshark One’s antivirus is specific to Windows, macOS, and Android.
(Credit: Surfshark/PCMag)
Installation is quick and simple. The main window is mostly white, with a dark VPN status panel at the right. A left rail menu lets you select Alert, Alternative ID, Antivirus, Search, Settings, and VPN. After installation, be sure to select Antivirus and VPN right away to take care of those one-time installations.
(Credit: Surfshark/PCMag)
Alternative ID lets you mask your real email address and phone number, giving merchants and websites an alias instead. I’ll discuss this feature below.
Surfshark VPN
The heart of this suite is Surfshark VPN, a VPN with broad global coverage and no limit on connected devices. Please read our review for full details—I’ll provide a brief summary here.
Many VPNs only permit a set number of simultaneous connections—most commonly five. Surfshark imposes no such limitation. It also offers an unusual multi-hop feature where you can run your traffic through more than one VPN server, providing an additional layer of anonymity. Its split tunneling ability means you can run private communications through the VPN while sparing other connections (such as online games) from any related slowdown.
Surfshark costs a bit more monthly than the average VPN, but its unlimited connections and advanced features can make the extra cost worthwhile—and an annual plan brings the price down considerably. Other features include ad blocking and the ability to use a shared static IP address at no extra cost. That last one can be important for connecting to streaming services or other sites that try to ban VPN traffic.
(Credit: Surfshark/PCMag)
As a Surfshark user, you can connect to servers in 100 countries, well above what the average VPN offers. Surfshark’s coverage of South America and Africa goes beyond the usual, and it offers servers in several countries with repressive internet policies. We consider a VPN company’s privacy policies to be extremely important—Surfshark’s are appropriate and transparent.
Lab Test Scores: High, But Sparse
I closely track reports from four independent antivirus testing labs around the world. These labs are fully staffed with antivirus experts, and they perform various tests to evaluate just how well antivirus apps do their jobs. A few, like Avast, Bitdefender, McAfee Total Protection, and Norton, have appeared in results from at least three of the four labs for many years. As new as it is, Surfshark One has made it into the lab results from one of the four.
The analysts at AV-Test Institute score each antivirus on its essential ability to protect against malware, its minimal impact on system performance, and its usability. The usability criterion is defined as refraining from flagging legitimate programs or pages as malicious. An antivirus can earn six points each for Performance, Protection, and Usability, for a maximum of 18 points. Almost three-quarters of the antivirus apps in the latest report scored a perfect 18 points, and all but one of the rest, Surfshark included, managed 17.5 points. Those with 18 or 17.5 points receive the Top Product honor from this lab. Surfshark’s 17.5-point score is vastly better than the 15 points it garnered in my previous review.
Each lab has its own way of rating and reporting on antivirus success. I’ve developed an algorithm to map them all onto a 10-point scale and derive an aggregate score. It takes two to aggregate, though, so antiviruses like Surfshark with just one score don’t participate. Only Avast One, Norton, and Microsoft appeared in the latest reports from all four labs, scoring 9.6, 9.4, and 9.2, respectively. Tested by three labs, Bitdefender earned a perfect 10 points, closely followed by ESET Home Security Essential with 9.9. AVG Internet Security matches Bitdefender’s 10-point total, but that’s based on scores from just two labs, not four.
Effective Malware Protection
Right after installation, Surfshark offers to run a quick antivirus scan. Unless you choose otherwise, it schedules a daily quick scan, bumping up to a full scan once weekly. As usual, I declined the initial quick scan to prepare for my standard malware protection test. This test starts when I open folders containing malware samples that I collected and analyzed myself. Surfshark dove right in, identifying many files that it recognized as malware. I was pleased that it simply displayed a notification stating that threats were found rather than a separate pop-up for each discovery, as clicking away all those pop-ups can take a tediously long time. I do note that when last tested, the pop-up notification reported the number of threat reports pending; it no longer does so.
(Credit: Surfshark/PCMag)
Over a period of five minutes or so, Surfshark eliminated 72% of the samples, quite a bit lower than its 90% detection rate against an earlier set. Confronted with this same set of samples, ZoneAlarm’s Antivirus wiped out 96% on sight. When I tweaked the test to account for the additional detection layers in ZoneAlarm Extreme Security, it eliminated 100% of them.
Each antivirus gets another chance to defend against the malware samples when I launch them. In fact, some antivirus programs such as Avast, McAfee, and Webroot Internet Security don’t scan files until just before they launch. Continuing my Surfshark testing, I launched each sample that survived the initial massacre.
Surfshark blocked a few more samples right after launch, but totally missed a few others. Coming in at 91% detection and scoring 9.1 of 10 possible points, Surfshark scored well enough in this test, but not at the top. That honor belongs to Avast and AVG, with 9.9 points, closely followed by Norton and Malwarebytes Premium Security with 9.8.
(Credit: Surfshark/PCMag)
Next, I set Surfshark the task of a full virus scan on a clean test system, for timing purposes. It finished in two and a quarter hours. On one hand, that’s a half-hour over the current average. On the other hand, in theory, you only need that super-thorough full scan once right after installation. A repeat scan finished a little faster, but not as fast as apps like Bitdefender, K7 Total Security, and Trend Micro, all of which cut repeat scan time by more than 95%. As for the quick scan, it finished in less than a minute.
Collecting, analyzing, and curating samples for this test takes weeks, so I can only change the sample set once yearly. To see how an antivirus handles current malware, I test using a feed of malware-hosting URLs generously supplied by MRG-Effitas. It’s a simple test. I launch each URL, discarding any duds, and note whether the antivirus blocks access to the dangerous page, wipes out the offending download, or totally whiffs the detection.
In testing, I observed that when Surfshark replaced a dangerous page with an in-browser warning page, a notification popped up explaining what it did. The warning page is a function of the browser extension. When I experimented with a totally off-brand browser, it simply wouldn’t connect to the dangerous page, but the pop-up notification served to explain.
(Credit: Surfshark/PCMag)
Surfshark blocked access to nearly three-quarters of the verified malware-hosting URLs. The real-time antivirus eliminated another 22% at the download stage, for a total of 95% protection. That’s much better than the 81% Surfshark scored when last tested.
Even so, 10 other antivirus tools scored as well or better. In particular, Bitdefender, Guardio, Sophos Home Premium, and Trend Micro Internet Security reached a perfect 100% in this test.
For further comparison, NordVPN’s Threat Protection Pro component only checks files for malware during download. Even when I tweaked the malware-blocking test to account for that quirk, it scored just 8.8 points. However, it did much better in the malicious URL blocking test, scoring 99%.
Phishing Protection Goes From Dismal to Perfect
A malware coder needs skill to create a malicious program to get past your antivirus and work around the security protections built into Windows. A phishing fraudster, on the other hand, attacks a much weaker security component—you, the user. Phishing pages masquerade as banks, financial sites, and even dating sites, hoping to trick you into entering your login credentials. If you log in to the phony site, the fraudsters own your account. Yes, eagle-eyed web surfers can spot discrepancies that reveal the trickery, but you really want the backup of an antivirus app that does its own vetting to rat out the fakes.
To test phishing protection, I gather hundreds of recently reported phishing pages from sites that collect such things. I set up four test systems, one with a browser protected by the antivirus under test and the other three using the protection built into Chrome, Edge, and Firefox. I launch each URL in all four simultaneously and note how each protective system reacts. If any of the browsers throws an error, I discard the test item. Likewise, if the resulting page doesn’t clearly attempt to steal login credentials, I discard it.
When last tested, Surfshark earned a dreadfully low score in my phishing protection test, even with both VPN-level detection and browser-level protection active. It came in at 19%, one of the lowest scores ever. This latest test turned things around. Surfshark detected 100% of the verified phishing frauds, stating in most cases that it “detected that this is a phishing website.” In a few cases, it flagged the site as malicious rather than fraudulent or reported the page as “suspected to be a phishing website,” but I counted all these as successful detections.
(Credit: Surfshark/PCMag)
With a score of 100%, Surfshark outperformed the built-in protection components in all three browsers by 14% to 20%. Guardio, McAfee, and Trend Micro also scored 100% in their most recent tests, as did the phishing-focused Norton Genie app. NordVPN, like Surfshark, combines antivirus-style protection with a powerful VPN. Also, like Surfshark, Nord scored 100% on this test.
Alternative ID
When you click to select Alternative ID, you see a page with two choices, Alternative ID or Alternative Number. The latter works much like the masked phone number feature in the IronVest app. However, it isn’t part of your basic Surfshark One. Rather, it’s a beta service sold separately, so we’re not covering it here.
(Credit: Surfshark/PCMag)
You start by clicking Create in the Alternative ID panel, which sends you to the Surfshark console online. With no further effort on your part, Surfshark gins up a new persona for you, complete with name, birthdate, address, and email. You can hand-edit the details if you like. When you click Create Alt persona, Surfshark locks in the details.
(Credit: Surfshark/PCMag)
Another click finalizes your alternative email and confirms the real-world email to which it should forward mail. Respond to the verification email, and you’re done. You can create additional alternative emails without going through the verification process.
While this feature may be of some use in protecting the privacy of your real-world email address, it doesn’t come close to the functionality of a dedicated temporary email address service like Cloaked or IronVest. I don’t imagine it will get a lot of use.
Simple Webcam Protection
If you pore through the antivirus settings, you’ll find an option for webcam protection, with an icon indicating it’s a beta feature. As such, it’s not installed unless you click to enable it.
My virtual machine test systems don’t have virtual webcams, so I couldn’t actively test this feature. However, it looks quite simple. When an app that’s not on the trusted list tries to access your webcam, you get a query from Surfshark asking whether to make it a trusted app. If you’re trying out a new video chat service, just click to make it trusted. But if the query comes when you’re not actively using the camera, let Surfshark block access and then run a full scan for malware.
Private Search Engine
You’ve heard that the major search engines harvest tons of data from your behavior. Surfshark Search promises that you can “Search privately and get truly organic results.” This feature looks like it’s part of the main Surfshark One collection, but when you enter a search term, it opens Surfshark Search in your default browser.
(Credit: Surfshark/PCMag)
Searching with Surfshark is very much like searching with DuckDuckGo, StartPage, or any other privacy-focused search engine, with one big difference. Using the free DuckDuckGo doesn’t require you to log in, while Surfshark Search only works from your paid Surfshark account. This component doesn’t add a lot of value to Surfshark One.
Powerful Browser Extension
In addition to the standalone Surfshark app, you have the option to install Surfshark’s browser extension for Chrome, Edge, and Firefox. Clicking the browser toolbar button brings up a window that has all the choices of the standalone app, and more.
(Credit: Surfshark/PCMag)
If you connect to the VPN service from the browser extension, only your browser’s traffic runs through the encrypted connection, which could be handy at times. You can launch a search or manage alerts just as you would from the standalone app. The antivirus component must run from the standalone app; if you click it in the extension, it just prompts you to download the app.
The big difference here is the extension’s CleanWeb page, invoked by clicking the menu icon below Search. From this page, you can view the status of two useful features: ad blocking and cookie pop-up blocking. These features work even when you don’t have an active VPN connection.
(Credit: Surfshark/PCMag)
Ad blocking is self-explanatory. As a sanity check, I visited several ad-riddled sites in an unprotected browser and in one protected by Surfshark. It visibly stripped out the advertisements. On clicking the extension’s toolbar button, I found that the ad blocker panel displayed the number of ads blocked on the current site.
The cookie pop-up blocker component is not what you think. It doesn’t focus on pop-ups in general, but rather on those annoying cookie permission pop-up queries. Surfshark answers those queries before you ever see them, declining cookies or accepting only required cookies. Ghostery Privacy Suite is the only other app I’ve seen that addresses this annoyance.
Data Breach Alerts
Surfshark Alert scans known data breaches for your credit card numbers, email addresses, and national IDs. You start by entering your email address and verifying your ownership by entering an emailed code.
You manage Surfshark Alert from your online account. As soon as you enable it, it checks known breaches to see if the supplied email account has turned up. You can add your other email addresses for full coverage. Surfshark requires verification for each added address, so you can’t abuse it to troll other people’s email breaches.
If you haven’t already enabled multi-factor authentication, you’ll have to do it now. Without two-factor enabled, Surfshark will tell you that a breach occurred, but seeing the breached data requires the additional security of multi-factor.
In testing, I initially got three near-identical alerts, all marked High Severity, all relating to nothing more than the presence of my email address in Autofill data for Microsoft Edge. That might confuse some users and could obfuscate the presence of more important reporting. In addition, the alerts page is poorly laid out, making it hard to get an overview of what the scan found.
When I added an email address with a longer history, it found more than a dozen old breaches, ones I had dealt with years ago. To be fair, every similar service I’ve seen finds these same ancient breaches. It also found several where the breached personal data was nothing more than my first and last name. Given that every PCMag article I write has those in full public view, I don’t see them as valid breach alerts. These, too, could make it hard for a user to find valid breach reports.
(Credit: Surfshark/PCMag)
Despite these oddities, you should review the entire list and glance at each at least. Archive the pointless ones immediately. When you hit a real site where you have an account, go change the password and then archive the report. As for vague items like “Collection #4” where there’s no associated website, there’s no specific action you can take. Just archive them. With the initial round of reporting out of the way, any significant new breach reports will stand out.
The alert system can also look for exposure of your credit cards. When you type in the card number, Surfshark automatically determines whether it’s Visa, MasterCard, etc. I entered the standard Visa testing number with some trepidation, given that doing so in some other services resulted in over 100 hits. In two previous tests, Surfshark found just one exposure dating back to 2011. The latest scan added two more, from 2019 and 2021 respectively. I’m not sure why it doesn’t find more, as the testing number is widely used.
(Credit: Surfshark/PCMag)
The next item, titled Scan IDs, is a bit murky. Previously, it clearly referred to national IDs such as a US Social Security Number and limited its coverage to Bulgaria, Lithuania, and the US. At present, it just says ID without a qualifier. I tried a made-up SSN and an expired state driver’s license number. The latter turned up nothing, but the former generated quite a few hits. Reviewing the hits proved confusing, as the entry listed only the types of data found. Was my 10-digit sample SSN found as such, or was it treated as a phone number? It’s unclear.
You can set Surfshark to send you an overall report of data breach activity on a quarterly or yearly basis, but I don’t see much value there. More important is paying attention to new breach alerts as they happen. I was pleased to find one button to remove all data that I had entered for tracking. I always clean up after testing any such service to avoid drowning in notifications.
This kind of scan for exposed email data is common in antiviruses and suites, but Surfshark goes a bit beyond with its checking of credit cards and SSNs. On the other hand, suites like Norton 360 and Bitdefender Ultimate Security do a vastly more thorough job of combing the dark web for traces of your personal info.
(Credit: Surfshark/PCMag)
If you visit a site that’s been breached, whether or not you have an account on the site, Surfshark offers a warning in the form of a small pink tab at the top of the page. Pull down the tab and you get full details on the breach, including the date, what data was exposed, and the number of records breached. I like that it puts this info at your fingertips just when you need it.
Surfshark One Protection for macOS
As noted, you can use your five Surfshark Antivirus licenses to install antivirus protection on Windows, macOS, or Android devices. To protect a Mac, just visit your account online to download the installer. Once installed, the app looks identical to its Windows counterpart. It has the same airy main window, with the same right-side VPN panel and a left-rail menu offering choices for Alert, Antivirus, Search, Settings, and VPN. Alternative ID appears here, too, though not in the same position as the Windows app.
(Credit: Surfshark/PCMag)
What else is the same? Well, Alert and Search are web-based apps, not bound to any platform, so they’re precisely the same. And our testing of the standalone VPN showed that it has almost precisely the same features and settings as the Windows edition.
As for the antivirus, it looks amazingly similar to its Windows cousin, right down to the fact that it can detect and eliminate Windows malware. Why is that important? It’s true that your Mac can’t “catch” a Windows virus, but it could serve to transfer tainted files to a Windows box on the network. I loaded my Windows-based samples on a USB drive to test this feature and plugged it into the test Mac. Surfshark jumped into action immediately, putting 94% of the samples into quarantine.
(Credit: Surfshark/PCMag)
That’s an excellent score. The only dedicated Mac antivirus to do better recently is Avast One Basic for Mac, with 97%, though the Mac component of the Aura security suite reached 100%.
It seems likely that Surfshark would be effective against malware designed for macOS. The labs that test macOS antiviruses don’t include Surfshark, so I have no outside verification.
I tested Surfshark’s phishing protection simultaneously on Windows and macOS, expecting the same results. Indeed, when it caught a fraud, the warning page looked identical. However, many of the fraudulent pages detected on Windows slipped right past the macOS version. Sometimes, it displayed a pull-down tab at the top of a page stating, “This website has been breached or has been part of a data leak.” Even when I counted those as successful detections, the Mac edition scored just 79%, way behind the 100% score achieved by McAfee Total Protection and Trend Micro Antivirus, and by Surfshark itself on Windows.
(Credit: Surfshark/PCMag)
As in the Windows app, there’s a beta-flagged webcam protection setting buried in the antivirus settings. When you turn it on, Surfshark invites you to fill in a list of trusted apps. However, it’s easier to just wait for Surfshark’s prompt when a new app accesses the webcam. From the prompt, you can add a trusted app to the list or block all access for an untrusted app.
(Credit: Surfshark/PCMag)
Many cross-platform security suites offer a full panoply of features on Windows but drastically less for macOS. I’m pleased to see that Surfshark doesn’t stint on its Mac protection.
Surfshark One Protection for Android
You can install Surfshark on your Android device by logging in to your account, if you like, or log in on a desktop and scan the QR code for Android installation.
On Android, Surfshark clearly resembles its Mac and Windows counterparts, though the mobile form factor forces some rearrangement. The main window defaults to showing VPN status, with four buttons across the bottom labeled VPN, Alternate ID, Products, and Settings.
From the VPN window, you can pick a server location or choose a special Static IP or Multi-Hop server. Our testing of the standalone VPN shows that Surfshark brings its full power to the Android platform.
(Credit: Surfshark/PCMag)
Clicking Products brings up a page to select from all the app’s features: Alternate ID, Antivirus, Alert, Search, and VPN. Tapping VPN just goes back to the VPN page, and Alternate ID, as noted, is an extra-cost feature. You manage Alert and Search within the app, unlike on macOS or Windows, where selecting those opens a browser window, but there’s no significant difference in how those features work. That leaves Antivirus.
(Credit: Surfshark/PCMag)
The antivirus component is a bit different on Android. It offers just one kind of scan rather than a choice of quick or full, and that scan finishes in just a few minutes. But it still offers scheduled scanning and real-time protection, as well as an Android-specific Storage scan option. According to the app, Storage scan extends scanning to apps and files that have been downloaded but not installed yet.
If you’ve used Android security software before, you might be looking around for more features. Where’s the anti-theft support? Is there a scan for apps that are using inappropriate permissions? Does it back up my contacts? Will it warn me about battery-hog apps? Surfshark does none of those things. It focuses on antivirus protection and VPN.
Verdict: A Satisfactory Security Suite
Surfshark One is built around the company’s VPN, which offers unlimited device connections, lots of servers worldwide, fast download speeds, and good mobile apps. Antivirus protection is the other major component, and it has improved significantly since our last evaluation. Even so, in the realm of security suites, Surfshark One’s feature set remains sparse. When it comes to cross-platform, multi-device suites, Norton 360 Deluxe is our Editors’ Choice. It includes VPN protection for five devices, with no limits on bandwidth or available servers. On its own, Norton VPN scores 3.5 stars, the same as Surfshark. But Norton’s time-tested antivirus is much better, with high scores from four antivirus labs. In addition, its dark web scanning for exposed private data goes significantly beyond Surfshark Alert. Yes, it costs more, but you also get more.
Pros
View
More
Cons
View
More
The Bottom Line
Surfshark One offers a useful collection of components, including antivirus, identity protection, and VPN, but it falls a bit short of more robust security suites.
Like What You’re Reading?
Sign up for SecurityWatch newsletter for our top privacy and security stories delivered right to your inbox.
This newsletter may contain advertising, deals, or affiliate links. Subscribing to a newsletter indicates your consent to our Terms of Use and Privacy Policy. You may unsubscribe from the newsletters at any time.
About Neil J. Rubenking
Lead Analyst for Security
