In Windows Phone 8 there was no antivirus: here you can download a white paper that discusses and contains information about Windows Phone 8 security.
I wondered if in Windows 10 Mobile there would be something like the Defender embedded antivirus feature, as available in the PC version of that new Microsoft Operating System. I know that the architectures of the PC and Mobile Windows 10 versions are different, but I also know that Edge browser and, in general, all the Universal apps (e.g. the embedded Outlook app) have the same binary for all platforms … so it seems to be reasonable to make that question.
After some posts exchange in the Microsoft Social forum I realized that also in my Windows 10 Mobile phone there is no need for an antivirus and all the needed features to make it secure, also relating my privacy, are already there … even though I have to use them! So it is like in iOS phone devices, where also there no antivirus is needed because the S.O. itself was defined in a proper way to prevent virus to infect.
So, why no antivirus is needed in Windows 10 Mobile devices?
First of all, to be published in the Windows Store, an app must pass several validation tests (mainly automatic ones, even though a manual testing is foreseen for apps that are reported by users): customer apps are only available for downloading from the official Microsoft app Store (unless you explicitly set some developer specific options in Settings -> Update & Security -> For Developers and you install apps from your PC … or, worse, if you do a Jailbreak: but in this case you are warned!).
Anyway Windows 10 Mobile apps, on the contrary of Android ones, cannot have access to the whole system, but only to a secure and protected memory space and can interact through specific secured APIs. So, each installed app (and so Edge browser app too) can operate in a limited sandbox and can’t access directly to system areas: it works in a confined virtual space, like a system alone and it cannot run code outside from there. This implies also that no antivirus app could be developed because, being itself an app, it could not have access/scan the system (as antivirus applications must do).
If, for example, an app wants to make a call, send an SMS or an email, it must use platform specific features calling specific APIs and the proper interface will be shown to the user that will have to confirm his will to do that. So whilst Google App Store has multiple antivirus app available for download to counter these very real threats, in Windows 10 Mobile Store there are not!
The same white paper, that discusses and contains information about Windows Phone 8 security, is still valid in Windows 10 Mobile too.
It remains anyway the problem of the user privacy: an installed app that you agreed to have access to specific information (e.g. your position, your contacts) could send them wherever it wants (e.g. to a server that app can contact). Too often when someone installs an app, he does not read carefully all the rights that app is asking for … and too often we agree without thinking the possible consequences!
It would be very nice if in the future the Windows 10 Mobile will provide a specific functionality that, when activated, in background will check all the possible privacy concerned actions of the running apps, in order than the user can be better aware of what it is happening underneath. Anyway already now you can handle the list of apps that hare having access to some privacy information (e.g. your Contacts, your Position): if you go to Settings -> Privacy, you will see a specific section for each privacy concerned area. For example, clicking in the Contacts area link, you will see the list of all the apps you gave the rights to get your contacts … and you will probably find some that you wonder why (e.g. ilMeteo, Car Dash, Film & TV, QR code reader)!! So you better disable this right for some of them, if you like, and in any time you can change your mind going back to that section. May be you can even decide to uninstall some apps that requested “strange” permissions in order to be installed and possibly report them to Microsoft.
Finally the built-in Edge browser supports protection from malicious sites, set on as default: you can handle this option going in the Microsoft Edge’s … -> Options -> Settings – Advanced settings -> Help protect me from malicious sites and downloads with SmartScreen Filter [IT: … -> Impostazioni -> Visualizza impostazioni avanzate -> Proteggi il PC da siti e download dannosi con il filtro SmartScreen].