For a Windows small business the free antivirus is already installed: Microsoft Defender Antivirus is built into Windows 10, 11 and Server, and Defender for Business at $3 a user is the console. The consumer free products are a mixed set — AVG’s says ‘not for business or commercial use’, Avast’s business page says free antivirus ‘will not provide an effective level of protection’ for a company, Bitdefender’s is Windows-only and silent on commercial use, Comodo’s FAQ says business users may use it, Malwarebytes Free only cleans up. The open-source layer is where small businesses get a real console: Wazuh (XDR and SIEM, GPL/AGPL), CrowdSec (MIT), OSSEC, ClamAV, osquery, Velociraptor. Cloudflare Zero Trust is free for 50 users and Chrome Enterprise Core manages browsers at no cost. Kaspersky is banned in the US and Sophos Home is now a trial. Prices are USD and were checked on 27 October 2026. How we score · All Kurums Free lists
TL;DR — the free security tool that fits
- A Windows office with no IT person: Microsoft Defender Antivirus — already on; add Defender for Business at $3 a user when you need to see every device.
- A second opinion on an infected PC: Malwarebytes Free — on-demand scan and removal only, no real-time protection.
- Servers and a central dashboard, free: Wazuh — open-source XDR and SIEM with agents for Windows, Linux and macOS; Cloud from $571.
- A VPS or web server facing the internet: CrowdSec — MIT-licensed engine with crowd-sourced blocklists; free Community console.
- DNS filtering and a device client for a small team: Cloudflare Zero Trust Free — 50 users, WARP client, gateway and access.
Which antivirus & endpoint security for small business tools have a free plan in 2026?
Every tool below protects or monitors endpoints at no charge with no end date. The first question for a business is whether it is allowed to: AVG’s download page says free is ‘for personal and family use only, not for business or commercial use’, so it is excluded; Avast discontinued its free business edition in 2018 and discourages companies from using the consumer one; Bitdefender’s free page does not address commercial use; Comodo’s FAQ says business users can use it. Defender’s licence is the Windows licence. The open-source tools — GPL, AGPL, MIT, Apache — permit commercial use by their terms.
The second question is what ‘antivirus’ means. Defender, Bitdefender, Comodo and Avast are real-time antivirus. Malwarebytes Free is a cleaner. ClamAV scans on demand except on Linux. Wazuh, OSSEC, osquery and Velociraptor are detection, logging, telemetry and forensics — the layer that tells you what happened across many machines — and need someone to run them. Cloudflare Zero Trust and Chrome Enterprise Core are network and browser controls, not malware engines. The paid prices that did not render (Malwarebytes, Avast business, Bitdefender) are marked as such.
The table shows the platform, the commercial-use answer and the Free Score; Core job weights real-time protection and a console. Open a row for licence, caveats and the page we checked.
| Company | Free as | Key limit | Card | Free Score | |
|---|---|---|---|---|---|
| M |
Free forever | Built into Windows 10/11/Server · console paid | No | 88 | Scorecard ↓ |
| W |
Open source | Open-source XDR & SIEM · self-hosted · Cloud from $571 | No | 82 | Scorecard ↓ |
| C |
Free forever | 50 users · WARP client · gateway, access, DLP profiles | No | 78 | Scorecard ↓ |
| C |
Open source | MIT engine · free Community console · crowd blocklists | No | 74 | Scorecard ↓ |
| B |
Free forever | Windows only · real-time · commercial use not stated | No | 68 | Scorecard ↓ |
| C |
Free forever | Windows 7–10 · AV, firewall, sandbox · business use allowed | No | 64 | Scorecard ↓ |
| C |
Open source | GPLv2 · on-demand · real-time on Linux only | No | 62 | Scorecard ↓ |
| C |
Free forever | No cost · browser policies & extensions · reporting only | No | 60 | Scorecard ↓ |
| M |
Free forever | Cleanup only · no real-time · prices not rendered | No | 58 | Scorecard ↓ |
| O |
Open source | Open-source HIDS · OSSEC+ free with registration | No | 58 | Scorecard ↓ |
| O |
Open source | Apache 2.0 / GPL 2.0 · telemetry · needs a fleet manager | No | 52 | Scorecard ↓ |
| V |
Open source | AGPLv3 · DFIR & hunting · expert tool | No | 50 | Scorecard ↓ |
| A |
Free forever | 1 device · 12-month reactivation · business discouraged | No | 44 | Scorecard ↓ |
Free tiers verified 27 October 2026 on each vendor’s pricing page (third-party sources named in the Scorecard where the vendor page was silent). Order is by Free Score only; sponsorship never changes it.
What do the free security tool plans actually include?
Open any row for the eight-field Scorecard. The “Why it ranks here” note under each row explains the score in plain terms.
1M
Microsoft Defender AntivirusUS · built into Windows 10, Windows 11 and Windows Server with real-time protection; central management, EDR and vulnerability management are Defender for Business at $3 a user a month for up to 300 usersFree foreverBuilt into Windows 10/11/Server · console paidNo card88⌄
- What’s free
- Antivirus built into Windows 10, 11 and Windows Server; real-time protection
- Hard limits
- Windows only · no central console free · runs passive when another AV is installed
- Time limit
- None
- Card required
- No.
- Upgrade trigger
- Seeing every device in one place, EDR or vulnerability management
- Cheapest paid step
- Defender for Business $3/user/month annual (up to 300 users, 5 devices a user); one-month trial needs a card and auto-converts
- Best free for
- Every Windows small business, as the baseline
- Verified
- Oct 2026 · learn.microsoft.com and microsoft.com/security/business (Defender for Business)
2W
WazuhUS · a unified XDR and SIEM platform with agents for Windows, Linux and macOS, the engine under AGPLv3 and the rest GPLv2; Wazuh Cloud has a 14-day trial with no card and starts at $571 a monthOpen sourceOpen-source XDR & SIEM · self-hosted · Cloud from $571No card82⌄
- What’s free
- Open-source XDR and SIEM; agents, vulnerability detection, file integrity, log analysis; AGPLv3 engine, GPLv2 elsewhere
- Hard limits
- Self-hosted · setup complexity · Cloud is paid
- Time limit
- None
- Card required
- No. Cloud trial: no card.
- Upgrade trigger
- Managed hosting or support
- Cheapest paid step
- Wazuh Cloud Small from $571/month
- Best free for
- A business with one technical person who wants a free central security dashboard across every machine
- Verified
- Oct 2026 · wazuh.com and github.com/wazuh/wazuh
Why it ranks here. The closest free thing to a commercial EDR console, with the effort of running a server; it complements Defender rather than replacing it.
3C
Cloudflare Zero Trust FreeUS · the Free plan covers 50 users with the device client, DNS and web filtering, zero-trust access to internal apps, predefined DLP profiles and 24-hour logs; pay-as-you-go is $7 a userFree forever50 users · WARP client · gateway, access, DLP profilesNo card78⌄
- What’s free
- 50 users; connector and device client; ZTNA; secure web gateway; DEX; network flow monitoring; CASB with 2 read-only links; predefined DLP profiles
- Hard limits
- 50 users · 24-hour log retention · community support · no remote browser isolation or email security · 50 custom apps
- Time limit
- None
- Card required
- Not stated.
- Upgrade trigger
- A 51st user, longer logs or RBI
- Cheapest paid step
- Pay-as-you-go $7/user/month
- Best free for
- A small team that wants DNS filtering, a VPN replacement and app access control at $0
- Verified
- Oct 2026 · cloudflare.com/plans/sase-zero-trust and developers.cloudflare.com/cloudflare-one/account-limits
Why it ranks here. Not antivirus — the layer that stops malicious sites before the antivirus has to; 50 users free is unusually generous.
4C
CrowdSecFrance · an MIT-licensed security engine that detects and blocks attackers on servers using crowd-sourced blocklists, with a free Community console; premium blocklists and the IP reputation API are paidOpen sourceMIT engine · free Community console · crowd blocklistsNo card74⌄
- What’s free
- Security Engine under MIT; free Community console plan
- Hard limits
- Community plan limits not stated · server-side, not endpoint AV
- Time limit
- None
- Card required
- Not stated.
- Upgrade trigger
- Premium blocklists or the reputation API
- Cheapest paid step
- IP Reputation API $49/month; Platinum blocklists from $1,900/month
- Best free for
- Any internet-facing server or VPS
- Verified
- Oct 2026 · crowdsec.net/pricing and github.com/crowdsecurity/crowdsec
Why it ranks here. Fail2ban with a shared brain; protects your servers, not your laptops.
5B
Bitdefender Antivirus FreeRomania · basic real-time protection with behavioural analysis and Advanced Threat Defense on Windows, ‘completely free to use, forever’, with a Bitdefender Central account; the page does not address business useFree foreverWindows only · real-time · commercial use not statedNo card68⌄
- What’s free
- Real-time protection, behavioural analysis, Advanced Threat Defense, basic VPN 200 MB a day; free forever
- Hard limits
- Windows only · Central account required · commercial-use permission not stated · no console
- Time limit
- None
- Card required
- No.
- Upgrade trigger
- Mac or mobile, or a business console (GravityZone)
- Cheapest paid step
- Not stated on the fetched page
- Best free for
- A lightweight Windows baseline where Defender is not wanted
- Verified
- Oct 2026 · bitdefender.com/en-us/consumer/free-antivirus
Why it ranks here. A strong engine, free, on one platform, from a consumer page that says nothing about companies; read its terms before deploying.
6C
Comodo Internet SecurityUS · free antivirus with a firewall, auto-sandbox and secure shopping on Windows 7 to 10; the FAQ says it is available to business users, with larger networks pointed to enterprise products; Pro is $29.99 a yearFree foreverWindows 7–10 · AV, firewall, sandbox · business use allowedNo card64⌄
- What’s free
- Antivirus, firewall, sandbox, Secure Shopping
- Hard limits
- Windows only · Windows 11 not listed on the page · no console
- Time limit
- None
- Card required
- No.
- Upgrade trigger
- Support and the virus-free guarantee
- Cheapest paid step
- CIS Pro $29.99/year (3 licences $39.99)
- Best free for
- A Windows user who wants a sandbox and firewall free and is explicitly allowed to use it at work
- Verified
- Oct 2026 · comodo.com
Why it ranks here. The one consumer free AV whose page says business users are welcome; the missing Windows 11 line is a concern.
7C
ClamAVUS (Cisco) · the open-source engine under GPLv2 for Linux, FreeBSD, macOS and Windows; real-time protection only on Linux via ClamOnAccOpen sourceGPLv2 · on-demand · real-time on Linux onlyNo card62⌄
- What’s free
- GPLv2 engine; Linux, FreeBSD, macOS 13–15, Windows 10/11; real-time on Linux
- Hard limits
- On-demand elsewhere · no central management
- Time limit
- None
- Card required
- No.
- Upgrade trigger
- None
- Cheapest paid step
- None
- Best free for
- Scanning mail and file servers on Linux
- Verified
- Oct 2026 · docs.clamav.net
Why it ranks here. The standard for scanning uploads and mail; not a desktop antivirus.
8C
Chrome Enterprise CoreUS · cloud management of Chrome at no cost — hundreds of policies, extension control and security-event reports — with action on insights and DLP in Chrome Enterprise PremiumFree foreverNo cost · browser policies & extensions · reporting onlyNo card60⌄
- What’s free
- No-cost cloud browser management; policies; extension control; security-event reports
- Hard limits
- Reporting only · browser scope
- Time limit
- None
- Card required
- No.
- Upgrade trigger
- Acting on insights or DLP
- Cheapest paid step
- Chrome Enterprise Premium — price not stated
- Best free for
- Locking down extensions across a fleet of laptops
- Verified
- Oct 2026 · chromeenterprise.google
Why it ranks here. Free control over the program most attacks arrive through.
9M
Malwarebytes FreeUS · a cleanup tool that finds and removes infections already on the device; real-time, ransomware and phishing protection are Premium, whose prices did not render on the pageFree foreverCleanup only · no real-time · prices not renderedNo card58⌄
- What’s free
- On-demand scan and removal
- Hard limits
- No real-time protection
- Time limit
- None
- Card required
- No.
- Upgrade trigger
- Real-time protection
- Cheapest paid step
- Standard and business ‘Sole proprietor’ plans — prices not rendered
- Best free for
- A second-opinion scanner next to Defender
- Verified
- Oct 2026 · malwarebytes.com (pricing placeholders not rendered)
Why it ranks here. The best free cleaner and not a replacement for anything.
10O
OSSEC / OSSEC+US · a free open-source host intrusion detection system; OSSEC+ adds rules and threat intelligence at no cost with registration; Atomic OSSEC is about $5 an agent a monthOpen sourceOpen-source HIDS · OSSEC+ free with registrationNo card58⌄
- What’s free
- Free open-source HIDS; OSSEC+ at no cost with registration
- Hard limits
- HIDS, not antivirus · licence not named on the page
- Time limit
- None
- Card required
- No.
- Upgrade trigger
- Enterprise features
- Cheapest paid step
- Atomic OSSEC about $5/agent/month; 14-day trial to 10 endpoints
- Best free for
- File-integrity and log monitoring on servers
- Verified
- Oct 2026 · ossec.net (licence name not stated on the page)
Why it ranks here. Wazuh’s ancestor; Wazuh is the better-maintained fork.
11O
osqueryUS · SQL-powered operating-system instrumentation for Linux, macOS and Windows, dual-licensed Apache 2.0 and GPL 2.0; no detection logic out of the boxOpen sourceApache 2.0 / GPL 2.0 · telemetry · needs a fleet managerNo card52⌄
- What’s free
- OS instrumentation, monitoring and analytics; Linux, macOS, Windows
- Hard limits
- No detection out of the box · needs a fleet manager
- Time limit
- None
- Card required
- No.
- Upgrade trigger
- None
- Cheapest paid step
- None
- Best free for
- Endpoint telemetry feeding a SIEM
- Verified
- Oct 2026 · github.com/osquery/osquery
Why it ranks here. A building block, not a product.
12V
VelociraptorUS (Rapid7) · an AGPLv3 endpoint visibility and digital forensics tool with binaries for Windows, Linux and macOS; no antivirus engineOpen sourceAGPLv3 · DFIR & hunting · expert toolNo card50⌄
- What’s free
- AGPLv3; Windows, Linux, macOS binaries; Rapid7-backed
- Hard limits
- DFIR and hunting, not prevention
- Time limit
- None
- Card required
- No.
- Upgrade trigger
- None
- Cheapest paid step
- None
- Best free for
- Incident response after something has happened
- Verified
- Oct 2026 · docs.velociraptor.app and the GitHub licence
Why it ranks here. The free tool a responder brings; not one a small business runs daily.
13A
Avast Free AntivirusCzech Republic · a full consumer antivirus on one device with a prompt to reactivate after 12 months; Avast’s business page says free antivirus ‘will not provide an effective level of protection’ for businesses, and its free business edition ended in 2018Free forever1 device · 12-month reactivation · business discouragedNo card44⌄
- What’s free
- Web, file, behaviour, ransomware and mail shields; firewall; Windows 7–11
- Hard limits
- One device · 12-month reactivation prompt · commercial use discouraged by the vendor · upsell-heavy
- Time limit
- 12-month reactivation
- Card required
- No.
- Upgrade trigger
- A business console
- Cheapest paid step
- Business plans — prices not shown
- Best free for
- A sole trader’s home office, knowing what the vendor says
- Verified
- Oct 2026 · avast.com and avast.com/business; 2018 discontinuation from securityboulevard.com
Why it ranks here. Listed because the brand is searched; the vendor’s own business page is the reason not to.
Which free security tool has no credit-card requirement?
Everything here is free without a card except Defender for Business’s trial, which needs one and auto-converts after a month. Avast prompts for reactivation at 12 months. Nothing else expires.
The exclusions: AVG Free’s page prohibits business use; Avast’s free business edition was discontinued in 2018; Kaspersky stopped US sales in July 2024 and signature updates for US users in September 2024, and its ‘free antivirus’ page offers a 30-day trial of Standard; Sophos Home’s page shows only a trial, the free edition having gone.
When does the free plan stop being enough?
Kurums Match: which free security tool fits your situation?
Windows office, no IT staff
Defender Antivirus, then Defender for Business.
One IT person, many machines
Wazuh plus Defender.
VPS or web server
CrowdSec.
Small team, web filtering
Cloudflare Zero Trust Free.
Fleet of Chrome laptops
Chrome Enterprise Core.
Infected PC today
Malwarebytes Free.
Linux mail server
ClamAV.
How we score free tiers
Duration (30): free forever scores 30, a 30-day-plus trial 15, a trial of 14 days or less 8, credit-based tiers 12. Capacity (30): whether the limits carry a team of three for twelve months. Core job (25): whether the free tier does the category’s main work — here, real-time malware protection on every company device, with a way to see all of them in one place. Friction (15): no card 15; card but no auto-charge 8; auto-charge 0; self-hosting deducts for setup and maintenance.
Each free tier was checked on the vendor’s pricing page on 27 October 2026; where the vendor page was silent, the Scorecard names the third-party source used. Free tiers change, so this list is re-verified every quarter and a discontinued free plan stays listed for one month with a notice. Order is by Free Score only. Kurums Free sells no placement; sponsorship, affiliate links and vendor requests never change a score, a rank or a label. Vendors can submit corrections through the Update your free tier form.
How did we verify these free tiers?
We opened each vendor’s download, pricing or documentation page and, for open-source projects, the repository, and recorded platforms, commercial-use terms, licences, real-time protection and the paid step. Malwarebytes’, Avast’s and Bitdefender’s paid prices did not render and are marked as such; Avast’s business pages returned client errors and its 2018 discontinuation is cited from Security Boulevard; Kaspersky’s US status is from its own July 2024 press release; osquery’s homepage is a script shell and its repository was used.
Prices are USD. Nothing here is security advice for a regulated environment.
Frequently asked questions
Can a small business use free antivirus legally?
It depends on the product. AVG Free’s page prohibits business use. Avast discourages it. Bitdefender Free does not address it. Comodo’s FAQ allows it. Microsoft Defender is covered by the Windows licence, and the open-source tools permit commercial use by their terms.
Is Microsoft Defender enough for a small business?
Defender Antivirus provides real-time protection on every Windows machine free. What it lacks free is a central console; Defender for Business adds that with EDR for $3 a user a month.
What is the best free EDR?
Wazuh — an open-source XDR and SIEM with agents for Windows, Linux and macOS, self-hosted. It needs someone technical to run it; Wazuh Cloud starts at $571 a month.
Is Malwarebytes Free real-time protection?
No. Malwarebytes Free is a cleanup tool that finds and removes existing infections; real-time, ransomware and phishing protection are in Premium.
Is Kaspersky free antivirus available?
Its ‘free antivirus’ page offers a 30-day trial of Kaspersky Standard. Kaspersky stopped US sales in July 2024 and signature updates for US users in September 2024.
Is Cloudflare Zero Trust really free?
The Free plan covers 50 users with the device client, DNS and web filtering, zero-trust access and 24 hours of logs. Pay-as-you-go is $7 a user.
Discover more from Kurums | Business Intelligence
Subscribe to get the latest posts sent to your email.