Real-time protection or a full scan: what each one catches
They sound like the same job done at different speeds. They aren't — one watches what runs, the other checks what's already sitting on the drive, and each misses what the other finds.
Antivirus software usually offers two things that look like versions of each other: real-time protection that runs constantly in the background, and a scan you start yourself. It's tempting to think the scan is just a slower, more thorough version of the same check.
It isn't. They look at different things at different moments, and understanding the difference tells you when a manual scan is worth running and when it adds very little.
What real-time protection watches
Real-time protection, sometimes called on-access scanning, checks files at the moment something happens to them: when they're downloaded, opened, copied, extracted or run. It waits for activity and inspects that.
Modern real-time protection also watches behaviour. Rather than only matching a file against known threats, it looks for suspicious actions: a program trying to encrypt lots of files quickly, altering system settings, or injecting itself into another process. It can often consult cloud-based lookups for files it hasn't seen before.
This is your main line of defence, and it can stop something never seen before if it acts like malware.
What a full scan checks
A full scan reads every file on the drive, whether or not anything has touched it recently, and checks it against the current threat definitions. That matters for one main reason: definitions improve over time.
A file that looked clean when it was downloaded six months ago may be recognised as malicious today. Real-time protection won't re-examine it until something opens or runs it. A full scan will.
A full scan also reaches files that are rarely opened: old downloads, archives, backups, files on an external drive, and items that came across before any protection was installed, for example after copying data from an old computer.
What each one misses
| Real-time protection | Full scan | |
|---|---|---|
| When it acts | As files arrive, open or run | When started or scheduled |
| Catches | New downloads, suspicious behaviour, threats as they execute | Dormant files, old downloads, items that arrived before protection |
| Misses | Files sitting untouched since before a threat was recognised | Anything arriving between scans; behaviour-only threats that leave little on disk |
| Performance cost | Small and continuous | Heavy for its duration |
A quick scan sits between the two. It checks the places malware most often lives, such as running processes, startup locations and system folders, and usually takes a few minutes. It's a sensible first check but not a substitute for a full scan when you have real doubts.
Where to find these in Windows Security
On Windows 11 the built-in Microsoft Defender Antivirus covers both. Open Windows Security, then Virus & threat protection.
- Real-time protection: under Virus & threat protection settings, choose Manage settings. Real-time protection, cloud-delivered protection and tamper protection should all be on.
- Scans: choose Scan options to pick Quick scan, Full scan, Custom scan (a single folder or drive) or Microsoft Defender Antivirus (offline scan).
The offline scan restarts the computer and checks it before Windows fully loads, which can find threats that hide while the system is running. It takes around fifteen minutes and is worth using if something seems wrong but normal scans find nothing. There's more on the built-in protection in whether Windows 11 needs extra antivirus.
If you use third-party security software instead, the same options exist under different names; the product's own help pages will show where.
When to run a full scan
With real-time protection on and definitions updating automatically, you don't need to run full scans constantly. Most products schedule a periodic scan anyway. Run one yourself when:
- You've set up a new computer or copied files across from an old one.
- You're plugging in an external drive or USB stick that's been used on other machines.
- Real-time protection was switched off for a while, or you've just installed antivirus on a machine that had none.
- The computer is behaving oddly: unexpected pop-ups, new browser extensions you didn't add, or settings changing on their own.
- You opened something you now suspect, such as an attachment from an email that turned out to be phishing.
Start a full scan when you won't need the computer for a while; on a large drive it can take an hour or more.
The honest limits
Neither approach catches everything. Real-time protection can be fooled by genuinely new techniques, and a scan only knows what its definitions know. Neither can stop you handing a password to a convincing fake login page, because no malicious file is involved at all.
That's why they work best together, alongside updates for Windows and your apps, which close the gaps malware relies on. Leave real-time protection on, let scheduled scans run, and reach for a full or offline scan when something gives you reason to.