Product detail

What is actually inside Avast Premium Security

A feature-by-feature walk through the paid tier: what each shield does, what it cannot do, and the four things people keep assuming are included when they are not.

Everything below describes the tier as documented by the vendor at the time of writing. Feature availability differs by operating system and changes between releases. Avast’s own comparison table is authoritative; if it disagrees with this page, it is right and we are out of date.

The core engine and its shields

File Shield

The real-time scanner. It inspects files at the moment they are opened, written, copied or executed, rather than only during a scheduled scan. This is the component that matters most, and it is also the one shared with Avast’s free product — the paid tier does not buy you a better detection engine, it buys you the layers around it.

Behaviour Shield

Watches running programs for patterns that legitimate software does not exhibit: mass file rewriting, injection into other processes, tampering with security services, deletion of shadow copies. It is the last line before damage, and it is the reason a brand-new threat with no signature can still be stopped.

Web Shield and Real Site

Web Shield checks addresses and downloaded content against reputation data before the page or file reaches you. Real Site addresses a narrower but nastier problem: DNS hijacking, where your request for your bank is quietly answered by somebody else’s server. Real Site routes DNS resolution through Avast’s own encrypted channel so that a poisoned resolver on your network or router cannot redirect you.

Mail Shield

Scans inbound and outbound messages and their attachments in a desktop mail client. Note the qualifier: if you read your mail in a browser, your webmail provider’s own filtering is doing this work and Web Shield covers the links.

Ransomware Shield

A permission list applied to folders you nominate. Only approved applications may modify files inside them; anything else is blocked and you are asked. Effective, and the single strongest argument for the paid tier — but it needs configuring, because the default folder set will not match everyone.

Enhanced Firewall

A two-way firewall with per-application rules, covering outbound traffic as well as inbound. Windows has a perfectly good firewall of its own; what you are paying for is a usable interface on top of it and network-profile handling that does not require you to understand the underlying model.

Sandbox

Runs a chosen application in an isolated environment so that whatever it does cannot touch the rest of the system. Genuinely useful if you ever need to open something you do not trust. Present on Windows.

Wi-Fi Inspector

Scans your local network for weak router settings, default credentials and devices you did not expect. A one-off audit tool rather than continuous protection, but a worthwhile one — home routers are a persistently weak link.

Webcam Shield

Blocks applications from accessing the camera without permission. Windows.

Sensitive Data Shield

Identifies documents on the machine that appear to contain personal or financial data and restricts which applications may read them.

Remote Access Shield

Blocks unauthorised attempts to reach the machine over remote-desktop protocols. Relevant if you have ever enabled RDP; if you have, also close it at the router.

Data Shredder

Overwrites files so that ordinary recovery tools cannot retrieve them. Worth knowing that on modern solid-state drives with wear levelling, overwriting a specific file is not a guarantee in the way it was on spinning disks. Full-disk encryption is the more reliable answer to that problem.

The four things that are not in this tier

This is the section we would want to read first, so it gets a table.

Platform differences

A multi-device licence covers Windows, macOS, Android and iOS. It does not deliver the same product on each.

• Windows — the complete feature set. Everything described above.
• macOS — the core engine and web protection, with a materially shorter list of extras. Several Windows-only components, including Sandbox, simply do not exist here.
• Android — anti-malware for installed apps, web protection, Wi-Fi checks and anti-theft features. A different product in practice.
• iOS — the most restricted by far. Apple does not permit third-party apps the kind of system access an anti-malware engine needs, so what you get is web filtering and network checks. This is a platform limitation, not a vendor failing, and it applies equally to every competitor.

If the phones are the reason you are buying a multi-device licence, read the per-platform feature table before you pay. It is the most common way people end up feeling misled by a purchase that was in fact accurately described in the small print.

What none of it does

No configuration of this product protects you from giving your password to a convincing phone call, from reusing that password on a site that is later breached, or from losing the only copy of your files to a failed disk. Those are the data layer, and they are yours. See how protection works for where the boundary sits.

Feature descriptions compiled from Avast’s published product and support documentation and checked on 21 September 2026. Assessments are the author’s. Where this page and the vendor’s documentation diverge, the vendor’s documentation prevails.