A VPN company asking for deeper access to your device should make you pause. IPVanish has announced a next-generation antivirus for Windows and macOS, and it is a very different kind of product from a tunnel that encrypts your traffic. An antivirus sees your files, your downloads and the pages you open. That is a lot of trust to hand over.
What IPVanish is actually shipping
The antivirus is built into the IPVanish desktop app. It is included with the new Complete plan and the existing Advanced plan. Existing Advanced customers get it at no extra cost. The company says it replaces Threat Protection Pro, which it describes as having evolved into the antivirus.
The engine is not IPVanish’s own. It comes from VIPRE, which IPVanish says has more than 25 years of antivirus experience and protects over one million devices. IPVanish points to a March 2026 AV-Comparatives Malware Protection Test, where VIPRE received an Advanced+ rating. That is a real independent result, but it is a test of the engine’s malware detection. It says nothing about data handling in the IPVanish app wrapped around it.
Features, in brief
- Web protection that blocks malicious sites, ads and trackers, even when the VPN is off.
- Real-time analysis of specific pages and files, aimed at phishing, scams and malware.
- Automatic scanning of downloads, with quarantine for anything flagged.
- Network monitoring for suspicious activity, on Windows only.
- Device scans: Quick, Full and Folder.
Setup differs by platform. On Windows, the antivirus downloads in the background after the update. On macOS, you start the installation yourself from the new Antivirus tab.
The privacy questions IPVanish doesn’t answer
The announcement is heavy on protection and silent on telemetry. Real-time page analysis means something is inspecting the URLs and content you visit. Does that happen locally, or are URLs and file hashes sent to a cloud service? Who receives them, VIPRE, IPVanish, or both? How long are they kept? None of this is addressed in the post.
It matters because the web protection works with the VPN disconnected. In that mode, the VPN’s no-logs promise does not cover your traffic at all. Any URL checking happens outside the tunnel, under whatever policy governs the antivirus. Read that policy before you turn the feature on, not after.
The post also leans on lineage. It says the engine first reached customers through Link Checker, then Threat Protection. That shows continuity, but it also shows that link data has been flowing to a security backend for some time. Familiarity is not the same as transparency.
Why it matters
VPN vendors are bundling. Antivirus, breach alerts and tracker blocking are becoming standard add-ons, partly because the core VPN product has become a commodity and bundles raise the price of a plan. For some users, one app and one bill is a real convenience. For privacy-minded users, it concentrates more data and more trust in one company.
Still, the case for the product is not weak. Plenty of people never run a dedicated scanner, and a respected engine with download scanning beats nothing. Built-in Windows Defender is also a strong baseline, so the real question is whether you need a second layer and whether you trust this vendor to hold it.
My advice is simple. If you are on Advanced, try it, but check the privacy policy and the app’s telemetry settings first. If you are weighing Complete, price it against a standalone antivirus and a standalone VPN. And ask IPVanish to say plainly what leaves your device. A security tool that scans everything you do owes you that answer.