Surfshark One review: Adequate antivirus protection with caveats

Our Verdict

However, the web interface does have a few more extended settings for features—manual VPN settings live here, as well as device management for antivirus coverage. It can be confusing at first, but with how simple Surfshark is, adapting to the split interfaces comes pretty quick.

Virus, malware, and threat protection

Real-time protection

Like other antivirus software, Surfshark remains on alert for threats, both local and online. On your PC, it examines opened or added files, screens downloaded email for sketchy links and attachments (including .zip and other archive files), and watches for unusual behavior from apps.

When you’re online, the app stays on the lookout for malicious downloads, as well as suspicious links (including phishing attempts). It’ll also block unauthorized use of your webcam, so long as you enable webcam protection, which is still a beta feature.

Scheduled and manual scans

PCWorld

By default, Surfshark scans your system on a daily basis. A quick scan runs on six of the days, while a full scan happens on the seventh. Both are set for the time you first install the app. You can also perform an on-demand scan—this defaults to just the installed drive on your PC, unless you’ve turned on scans of external storage drives. You can also choose a specific file or folder.

During both quick and full scans, Surfshark examines registry items, network settings, Windows’ boot sector, drivers (and affiliated areas), as well as often targeted folders (Downloads, Documents, Desktop). For a broader critical look at your files, run the full scan.

For quick and full scans, you can adjust schedule and timing, but not what is scanned. Settings are also extremely minimal—you can choose to turn on automatic scanning of external storage drives during quick and full scans, automatic scanning of external storage drives when first connected, and if quarantined items are automatically deleted.

VPN

Surfshark’s primary service is its virtual private network, which securely routes your traffic so that it registers as coming from a different location. (Useful if you want to remain anonymous, or look at content not available in your region.) Its antivirus is not available as an independent subscription—rather, malware protection is an add-on feature as you move up to more expensive plans.

You can read PCWorld’s full thoughts on Surfshark’s VPN in our review, but overall, the experience is mostly smooth and streamlined when it works. (More on that in just a moment.) You can use the VPN on an unlimited number of devices, and while active, the service automatically blocks ads and pop-ups, as well as cookie consent notifications.

You also have the option to do multi-hop connections, which sends your online traffic through two VPN services for greater anonymity. If you need to run an app or access a website independent of the VPN, you can specifically set them to bypass it.

PCWorld

I found that Surfshark didn’t work at all locations. While on a Hilton hotel’s public Wi-Fi network, the app struggled (and effectively failed) to connect, citing limited access through the hotel’s network. Meanwhile, rival ProtonVPN connected immediately. When asked, Surfshark cited possible firewall rules, DNS filtering, or port management that could have blocked access to the VPN servers.

For locations, you can choose dedicated servers in Australia, Austria, Belgium, Brazil, Bulgaria, Canada, Chile, Colombia, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hong Kong, Hungary, Iceland, India, Indonesia, Ireland, Israel, Italy, Japan, Latvia, Lithuania, Luxembourg, Malaysia, Mexico, Netherlands, New Zealand, Nigeria, Norway, Poland, Portugal, Romania, Serbia, Singapore, Slovakia, Slovenia, South Africa, South Korea, Spain, Sweden, Switzerland, Taiwan, Thailand, Türkiye, Ukraine, United Arab Emirates, United Kingdom, and the United States.

Additional virtual servers are available as well, though they’re of most use to those who care about location rather than privacy. Surfshark also makes clear in the app which are the fastest servers.

Surfshark One: Additional features

Alternative ID

One of Surfshark’s more unique features is Alternative ID, which not only creates masked email addresses but a whole false identity to help preserve your identity online.

By default, these are randomly generated. For email masks, ten domains exist (the part that comes after “@”), with an oddly strong sea theme. Five of the domains are obviously based on fish names and the randomly generated usernames often use the name of an aquatic creature. Fortunately, you can manually edit the suggestions, in case you’re aiming for a different vibe.

PCWorld

For the identity, you get assigned a full name and address. (I became Hector, a guy living in Tasmania, Australia.) Like the email masks, you can edit what the app spins together, in case you want a different name, gender, or general locale. You can’t choose a specific address, only the country and state/province, with just six countries as options—the US, Denmark, Australia, Germany, Portugal, and Brazil.

The suggested addresses are real—Surfshark says it uses a “publicly available address database provided by governmental institutions.” So if your home is part of a public database (and it very likely is), it could get used for someone else’s fake identity.

Surfshark also offers the ability to mask your phone number, but you must pay an additional subscription fee of $2.50 per month. Virtual phone numbers are limited to USA country codes, and can receive calls and text messages. You can reply to text messages through your virtual number but not return calls.

Surfshark Alert

Labeled simplyAlert, this feature looks for appearances of your email addresses in data breaches—as well as any leaked passwords, personal information, or IP addresses tied to a particular email address. For the Surfshark One subscription, you can track an unlimited number of email addresses. You can also monitor unlimited credit card and ID numbers (e.g., social security number) through this feature.

Alerts are managed in the web interface, with several settings you can tweak related to data breach reports and data breach alerts.

Surfshark Search

PCWorld

Surfshark offers a search engine that it says allows private searching for “truly organic results.” The company does not maintain the engine itself; instead it says it relies on “third-party APIs.”

You can initiate a search from the web interface or the app, but ultimately, you’ll get pointed to You can just bookmark this address for use, though it’s only available if you’re logged into your Surfshark account on that browser.

Search results are generally streamlined, with a mix of sources that include Reddit posts and YouTube videos. You can choose between Web, Images, and Videos for result types, and also change the locale to a different country. If you’re used to the additional helpful answers and suggested links from search engines like Google and Bing, Surfshark’s results may feel a bit bare-bones.

Surfshark One: Customer support

You can access Surfshark’s support and help pages through the app (Settings>Get help). From there, you can jump directly to popular support pages. Alternatively, you can head to the company’s help and contact page. To get in touch with Surfshark, you’ll file a help request or use chat.

From these settings, you can also run Surfshark’s troubleshooting tools—Collect Diagnostics(which aids the Surfshark team in identifying issues),Reset network, andRestore original settings.

Surfshark One: Updates and maintenance 

Virus database updates happen automatically in the background every three hours, as well as every time a scan starts. You can’t otherwise adjust the timing, though you can manually check for new virus definitions.

Surfshark One: Performance

Currently, Surfshark does not have data for the most recent tests from AV-Test and AV-Comparatives, two independent security organizations who evaluate antivirus software performance. However, in AV-Test’s zero-day exploit and malware tests for May and June 2025, Surfshark took home perfect scores. It caught 100 percent of the 407 zero-day attack samples and 19,213 widespread and prevalent malware samples.

AV-Test

(Note: Antivirus software companies voluntarily elect to participate in AV-Test’s benchmarks. When asked about its participation frequency, Surfshark said: “We don’t see the need to perform these every couple of months, as these tests are exactly the same month over month with just different malware samples. We normally perform these tests when we see a change in the malware landscape, or we want to test a new backend feature and verify the improved performance independently.” Currently, Surfshark has scores with AV-Test for only December 2022, June 2024, and June 2025.)

Surfshark does have more recent testing data available through AVLab. In AVLab’s March 2026 Advanced in the Wild Malware test, Surfshark scored a 70.78 percent rating for catching malware before infecting the system, and 28.74 percent rating for stopping malware after running on the system. And crucially, it missed two samples in the set. These results fall very short of rivals like ESET, Bitdefender, and Avast, all of which blocked malware 100 percent before launch.

AVLab

When left to run in the background, Surfshark affects system performance fairly little. The real-time scanner only caused under a two percent decrease for the score in PCMark 10, which simulates video conferencing, web browsing, and editing in open-source document and image apps.

Similarly, in our Handbrake encode test, which involves crunching down a large video into a smaller 1080p30 file, the increase in time to complete the task was also under two percent. Surfshark’s screening does increase when editing documents in Microsoft Office programs like Word, Excel, and PowerPoint—UL’s Procyon benchmark scores dropped by almost nine percent.

On the flip side, Surfshark can drag hard on your PC’s resources during full scans. On our budget laptop, running a continuous scan dropped PCMark 10 scores by a notable 36 percent—and that was the smallest impact. Procyon results decreased by a whopping 53 percent, and Handbrake encodes shot up in time needed by a painful 72 percent.

Of course, you can mitigate this effect by changing the schedule of system scans (especially full scans) to happen during off-hours. And with this much of an effect, you definitely want to steer clear of scan times—which could be a potential issue for those who are active on their PCs for most hours of a day.

Surfshark One: Is it worth it?

If VPN coverage is your first priority (and you’re already sold on Surfshark’s VPN), subscribing to Surfshark One should expand your security protection to include seemingly adequate antivirus protection. However, if you’re primarily in the market for antivirus software, you’ll get more bang for your buck with a different suite—and a rival won’t hit your system performance nearly so hard.