Introduction
In this article, you will learn about the NordVPN Next-gen antivirus and its Real-time protection features, what they do, how they differ, and which devices support them. You will also find a breakdown of all three features that make up Next-gen antivirus and how nexos.ai powers its detection capabilities.
NOTE: Previously known as "Scam, phishing, and malware protection," it is now called Next-gen antivirus protection. You may still see the old names in the NordVPN extension while the update rolls out.
Next-gen antivirus
Next-gen antivirus is a NordVPN security feature that guards you against a wide range of online threats - without requiring an active VPN connection. It automatically blocks ads, trackers, and malicious URLs, warns you about fraudulent or scam websites with an in-browser alert, scans your downloads for malware, checks your installed apps for security vulnerabilities, and lets you review and manage any quarantined files. Its detection capabilities are powered in part by nexos.ai, NordVPN's AI partner.
The three main parts that protect you from malicious activities are:
- Anti-malware - Scans files for malware upon download, detects double-extension threats, checks apps for vulnerabilities (Windows), and quarantines or auto-deletes malicious files.
- Advanced browsing protection - Blocks malicious websites, displays scam and fraud alerts, detects hijacked session attempts, provides search result safety indicators, offers email protection, and checks crypto wallet addresses.
- Ad and tracker blocker - Blocks ads, blocks trackers, and cleans URLs of tracking parameters.
Real-time protection
Real-time protection is a DNS-based security feature that blocks ads, trackers, and unsafe domains while you are connected to a NordVPN server. Unlike Next-gen antivirus, it requires an active VPN connection to function and does not include file scanning, quarantine, or app vulnerability checks. (Unless you are using it on Mobile phones. Then you can use it without having an active VPN connection. )
What is the difference between Next-gen antivirus and Real-time protection?
The two features serve overlapping but distinct purposes. Here is a summary of the key differences:
| Next-gen antivirus | Real-time protection | |
|---|---|---|
| VPN connection required? | No | Yes |
| Ad and tracker blocking? | Yes | Yes |
| Malicious URL blocking? | Yes (real-time, in-browser) | Yes (DNS-based) |
| Cookie banner hider? | Yes | No |
| File scanning and quarantine? | Yes | No |
| App vulnerability scanner? | Yes (Windows only) | No |
| Scam and fraud alerts? | Yes | No |
| nexos.ai-powered detection? | Yes | No |
NOTE: Real-time protection uses DNS filtering, which means protection only applies while traffic is routed through a NordVPN server. Next-gen antivirus protection operates at the application layer and is always active, regardless of VPN status.
Which devices support each feature?
Next-gen antivirus is available on:
- Windows 10 (64-bit) and Windows 11
- macOS 12 Monterey and newer - sideloaded app only (not available on the Mac App Store version)
Real-time protection is available on:
- macOS
- Windows
- Android
- iOS
- Linux
- Android TV / Amazon Fire Stick
- NordVPN Chrome Extension
- NordVPN Firefox Extension
- NordVPN Edge Extension
NOTE: Windows and macOS users have access to both features. Android, iOS, Linux, and browser extension users can only use Real-time protection. macOS App Store users do not have access to Next-gen antivirus - switching to the sideloaded version of the app is required.
What happens when a malicious file is detected?
When Next-gen antivirus detects a malicious file during a download, it quarantines the file and prompts an in-app notification. From the Protection activity view, you can review the quarantined file and choose one of the following actions:
- Keep file - removes the file from quarantine and marks its status as ALLOWED.
- Delete file - permanently removes the file from your system and marks its status as DELETED.
Quarantined files are automatically deleted after 30 days. If the Auto-delete malicious files toggle is enabled in Advanced settings, files are deleted immediately without being placed in quarantine, and the in-app notification is suppressed.
What is nexos.ai, and how does it relate to this feature?
nexos.ai is NordVPN's AI partner whose technology powers key detection elements within Next-gen antivirus. This co-branding reflects the integration of AI-driven threat intelligence into the feature's scanning and alerting capabilities.
Additional tips
- Learn how to enable Next-gen antivirus on macOS.
- Read our guide on the Anti-malware scanner and file quarantine.
- Find out how to resolve Next-gen antivirus issues on macOS.
- Learn how to switch from the Mac App Store version of NordVPN to the sideloaded version.
