Aura Review | PCMag

Most security companies start with an antivirus and build up to two or more tiers of security suites. Aura offers all customers the maximum security it can muster—a noble goal. You get antivirus and VPN protection, a password manager, a parental control system, and a collection of identity and credit protection tools, and you can use Aura on your Windows, macOS, Android, and iOS devices. The identity theft and credit tools proved impressive in testing, but the more mundane security components didn’t all do well. Our Editors’ Choice winners for identity protection services are Norton 360 with LifeLock and Bitdefender Ultimate Security, both of which combine powerful identity theft remediation with top-notch device-level protection.

How Much Does Aura Cost?

Aura emphasizes personal protection, and its pricing scheme reflects that emphasis. You pay $144 per year to protect just yourself, $264 for a Couple subscription (two licenses), or $444 per year for a Family of up to five adults. The Couple and Family plans include parental controls as well as a degree of identity protection for unlimited kids.

I was surprised by these prices until I scanned the fine print. You get to install antivirus and VPN protection for up to 10 devices per adult member. The prices I’ve listed aren’t for one, two, and five devices—they’re for 10, 20, and 50. These are all list prices, billed annually.

Looking at other cross-platform suites that offer 10-license subscriptions, I find Aura’s pricing on the high side of the middle. Top-tier suites from ESET, F-Secure, Trend Micro, and ZoneAlarm cost about five dollars less than Aura at the 10-device level. Bitdefender’s top-tier suite goes for quite a bit less, though, at $104.99 per year. And many entry-level suites cost less than $100, among them Bitdefender, F-Secure, and AVG.

On the higher side, Norton 360 With LifeLock (which, like Aura, includes identity protection) goes for $249.99 at the 10-license tier. Bitdefender Ultimate Security also adds identity protection at $179.99 per year for 10 devices. ESET Smart Security Premium runs $149.99, just a bit above Aura. And Panda Dome Premium tops the list at $274.99 per year.

It’s Surprisingly Easy to Be More Secure Online

Not many security services offer 20-license subscriptions, but there are a few that go up to 50. ZoneAlarm’s commercial antivirus costs $399.95 per year for 50 licenses, which is less than Aura’s $444, but it offers quite a bit less. And with ZoneAlarm Extreme Security NextGen, you pay $549.95 for 50 licenses. ESET Smart Security Premium’s pricing simply goes up by $10 for each added license. At the 50-license mark, it’s just a few cents different from ZoneAlarm and well above Aura’s price.

When you hit 50 devices, that’s not so different from unlimited licenses. In truth, competitors with unlimited licensing significantly undercut Aura’s 50-license price. McAfee+ charges $139.99 for a subscription that lets you protect every device in your household. To be fair, McAfee+ doesn’t include identity protection at that level—at the Advanced level, it runs $199.99 per year. Pay $334.99 per year, and you can install Panda Dome Premium on all your devices. Norton’s Ultimate tier, which costs $349.99, gives you the maximum LifeLock identity protection along with the option to install security and VPN protection on unlimited devices.

Price per device isn’t the only consideration here, of course. Of the services discussed above, only Bitdefender, McAfee, and Norton offer identity protection at the level Aura does.

No Scores From Independent Antivirus Labs

When you go to buy a new refrigerator, you probably check consumer websites to see which ones exhibit the best performance. In the antivirus world, I look to four independent testing labs around the world for reports on just how well the many antivirus choices do their jobs. They are AV-Test Institute, AV-Comparatives, MRG-Effitas, and SE Labs. Aura doesn’t appear in reports from any of these labs, alas.

When last reviewed, Aura relied on a licensed version of another company’s antivirus. My contacts weren’t allowed to say which company, but I deduced it was Avira. The company has since switched to an in-house antivirus based on a technology acquisition. The labs haven’t yet tested the current antivirus.

Over the years, I’ve developed an algorithm to map the various lab scores onto a 10-point scale and create an aggregate score for those with scores from two or more labs. Avast One Gold, Norton, and Microsoft Defender Antivirus appear in the latest reports from all four labs; Norton leads with an aggregate score of 9.8. Tested by three labs, Bitdefender, Kaspersky, and McAfee earned a perfect 10 points based on three perfect scores.

Getting Started With Aura

When you’re new to Aura, you introduce yourself, supplying personal information that will be used to monitor your identity. Once you’ve got that settled, Aura presents a lengthy collection of steps to set up your protection. Two of these steps relate to device-level antivirus protection: Get Mobile App (for Android and iOS) and Open Desktop App (for Windows and macOS). I’ll discuss the Mac and mobile options below. Note that you can also download the desktop app and browser extension by scrolling to the bottom of the online dashboard and locating the Downloads section.

(Credit: Aura/PCMag)

Most of Aura’s light-colored main window is devoted to a simple panel that welcomes you by name (remember, you told it your name and other details). Unlike most other antiviruses, Aura doesn’t use this panel to report security status; it welcomes you even if you’ve turned the antivirus off.

Below the welcome panel are two smaller panels labeled Antivirus and Online Security. The Antivirus panel offers a simple toggle to turn antivirus protection on or off and links to an antivirus detail page. Online Security doesn’t refer to the browser extension but rather to Aura’s very simple VPN, which I’ll discuss below. It reports whether your current connection is secure and whether you’ve engaged the VPN. A click takes you to the online security detail page.

(Credit: Aura/PCMag)

Down the left, a simple menu offers Home, Antivirus, Online Security, Safe Gaming, and Preferences. Safe Gaming is a kind of parental control system powered by Aura partner Kidas. As for Preferences, this app includes a bare minimum of settings, things like whether it should launch at startup (enabled by default) and whether the VPN should kick in automatically when you connect to a vulnerable network (disabled by default).

Improved Antivirus Protection

When I previously reviewed it, Aura was licensing an antivirus engine from Avira. The current antivirus is all in-house.

As with any new antivirus, you should perform a full scan after installing Aura. The scan window displays its progress, showing the number of files processed and the elapsed time. The new in-house antivirus runs much faster than the previous licensed version. On my clean test system, it finished in 13 minutes; its previous time was over two hours. The average for recent antiviruses is an hour and 45 minutes, so Aura is among the speedy set.

Apparently, it performed some optimization during that scan, as a second scan took half as long. Others have sped up subsequent scans even more. A half-dozen of them cut the repeat scan time by 90% or more, among them Bitdefender, K7 Ultimate Security, and Trend Micro Maximum Security.

When I exposed Aura to folders containing my collection of malware samples, it started quarantining all those that it recognized, quickly eliminating 91% of the samples on sight. Not all antivirus utilities scan files as soon as they’re displayed by Windows Explorer. Avast and AVG are among those that wait until just before program execution. I’ve only tested a handful of antivirus apps with this relatively new malware collection. Of those, Aura scored highest at this stage. Norton and Bitdefender wiped out 73% and 72% on sight.

That initial culling is just the beginning of my hands-on malware protection test. For the next phase, I launch all the surviving samples, carefully noting how the antivirus reacts. Aura detected almost every sample either on launch or shortly thereafter, for a total detection percentage of 99%. Tested with the same samples, Avast, AVG, and Norton also achieved 99% detection. Aura did allow some of the detected samples to place executable files on the test system, which brought its final score to 9.6 of 10 possible points, a nice jump from its previous score of 8.9 points. Aura’s current score is quite good, but Avast and AVG earned 9.9 points.

It’s true that Bitdefender Ultimate Security scored just 8.6 points in this test. However, Bitdefender routinely receives perfect scores in independent lab tests. When my results don’t align with observations by the labs, I defer to the labs.

Tested against my previous sample collection, Malwarebytes Premium led the pack with 98% detection and 9.8 points. Guardio also received 9.8 points, but only because I modified the test to account for the fact that Guardio only checks for malware in files downloaded to Chrome from the internet.

It takes me weeks to gather and analyze a new set of samples, so I necessarily use the same collection for up to a year. To see how each antivirus handles the freshest in-the-wild malware, I start with a feed of malware-hosting websites supplied by testing lab MRG-Effitas. In a virtual machine, I launch each URL and note whether the antivirus prevents access to the site entirely, eliminates the malware payload, or fails to react at all. I keep at it until I have 100 data points.

(Credit: Aura/PCMag)

Aura’s VPN-based online security blocked access to 52% of the malware-hosting sites, replacing the dangerous page with a notification stating it was “classified as malicious.” This page doesn’t have Aura’s name on it anywhere, which surprised me a bit. Most antivirus tools make sure to get credit for their work. For the rare malware-hosting page using a secure HTTPS connection, Aura can’t swap in that page, so the browser just displays an error.

Even pages not blocked at the browser level didn’t manage to do any harm, for the most part. Aura’s real-time malware protection foiled another 41%, for a total of 99% protection. That’s much better than the 85% it scored when last tested.

(Credit: Aura/PCMag)

Aura’s 99% score is matched by G Data Total Security, Malwarebytes, and McAfee. Five competitors earned a perfect 100% score, among them Bitdefender, Sophos Home Premium, and ZoneAlarm.

Aura handles blocking malicious sites at the VPN level. On the one hand, that means it protects any browser and any internet-aware application. On the other hand, VPN-based filtering works at the domain level, not page by page. If hackers have subverted pages in an otherwise clean domain to spread malware, they can elude domain-based detection. Fortunately, Aura also offers a Safe Browsing extension for Chrome, Edge, and Firefox. In this test, I didn’t see the extension kick in because the VPN took care of blocking.

Dismal Phishing Protection

I mentioned hackers subverting pages in clean domains to distribute malware. That’s not an easy task, nor is writing malware in the first place. You know what is easy? Fooling people into giving away their secret login credentials! Phishing fraudsters create websites that perfectly mimic bank sites, email sites, or any kind of sensitive site. Yes, you can detect these phishing fakes if you’re alert, but if you unwittingly log in to the fake site, the perpetrators totally own your account.

To test an antivirus tool’s ability to detect and deflect phishing frauds, I start by collecting recent reports from websites that track phishing. I make sure to include both verified fakes and URLs that are too new to have been blacklisted. I line up four browsers, one protected by the antivirus under test and the other three relying on phishing protection built into Chrome, Edge, and Firefox. Then, I simply run through my list of suspect URLs, launching each simultaneously in all four browsers. If any browser can’t load a URL, I drop it. I also drop any that don’t visibly try to steal login credentials.

Phishing fraudsters do their best to make their fakes believable. That includes using a secure HTTPS connection. More than 90% of my latest collection are HTTPS addresses. As noted, when the VPN-based Safe Browsing system blocks a secure page, the browser just displays an error. That makes evaluating success tough. For the phishing test, I turned off that system and relied on the corresponding protection in the browser extension.

(Credit: Aura/PCMag)

When tested previously, Aura detected 80% of the verified phishing pages, a mediocre score. The results this time were quite different, and not in a good way. Aura’s 5% detection rate is among the lowest scores ever in this test. At the other end of the spectrum, Guardio, McAfee, Trend Micro, and ZoneAlarm managed 100% protection, as did the free, fraud-fighting Norton Genie.

VPN for Dummies

You won’t find a menu option or link to VPN protection in Aura. Its designers didn’t want to scare off users by mentioning a scarily technical topic like VPN. But, spelled out or not, VPN technology is present.

To make this component work, Aura licenses the technology and server network of Hotspot Shield VPN from its owner, Pango. In the past, there’s been a bit of confusion about just who owns what. My Aura contact clarified, stating, “Aura and Pango are both owned by the same holding company, which is also called Aura. They operate independently.”

(Credit: Aura/PCMag)

In any case, familiarity with Hotspot Shield won’t help you understand this app. All you can do with Online Security is turn it on or off. There’s no choice of server—you just get a US-based server chosen at random. The split-tunneling feature that lets Hotspot Shield route some traffic outside the encrypted VPN connection is absent.

The Online Security page reports the location of the server you’re using. It also reports on the security of your connection to the internet. You can set Aura to turn on Online Security any time you’re on an insecure Wi-Fi connection, but you’re better off just leaving it on. If you don’t keep Online Security active, be sure to install the Safe Browsing extension in all your browsers.

Perhaps this is a good way to handle VPN protection for the masses. Figuring out which server in Djibouti has the lowest latency isn’t something most users want to deal with. When Online Security is turned on, your internet traffic is encrypted and protected from any outside snooping. Your IP address is hidden and replaced by the IP address of the VPN server. You don’t have the option to spoof a particular location, perhaps to watch region-locked streaming content. But maybe you didn’t want to do that?

Enhanced Password Manager

You can download Aura’s password manager through the My Aura online console. If you don’t jump right into installing password management, the console will remind you to set it up. Aura’s password manager has apps for iOS and Android as well as browser extensions for Chrome, Firefox, Edge, and Safari.

Simple Tricks to Remember Insanely Secure Passwords

When you first signed up for Aura, you created a password for your account. Did you make that password long, strong, and unguessable? If not, you should change it now because it’s also the master password that unlocks the password manager. When you install Aura on your mobile devices (discussed below), be sure to enable biometric activation; otherwise, you’ll be typing that long, strong password every time Aura logs you out due to inactivity.

(Credit: Aura/PCMag)

If you’re switching your password management to Aura, you can save a lot of pain by importing existing passwords. Aura supports importing from Dashlane, 1Password, Bitdefender Password Manager, KeePass, LastPass, NordPass, and Norton Password Manager. It can also import passwords stored in Chrome, Edge, Firefox, and Safari. For each supported password source, Aura provides detailed instructions on how to generate a CSV file for import. In practice, I had no trouble importing several dozen passwords exported from Keeper Password Manager, which is not an officially supported source.

When I previously reviewed this password manager, its ability to capture passwords as you log in was spotty, and it didn’t support automated replay for stored passwords. This time around, it proved more successful. A floating icon with the Aura “A” indicates that the password manager is ready for action. After you log in, it asks permission to save the captured data. Once you’ve done that, you can enable Auto-Save, meaning Aura will save your data without requiring permission. In testing, it captured both simple logins and two-page logins.

(Credit: Aura/PCMag)

There’s no option to tag the entry, put it in a folder, or give it a friendly name the way you can with LastPass, 1Password, and many others. Since you don’t have to make such decisions, you might as well turn on Auto-Save, which goes straight to saving the captured credentials (unless you click Undo before the timer runs out).

When you open the login page for a site with credentials saved, Aura offers to fill them for you. If you have more than one set, it displays your options in a floating menu. And if it seems you’re entering a brand-new password, Aura offers a suggestion from its password generator. By observation, Aura generates random passwords of 12 characters, including small letters, capital letters, digits, and punctuation. I found no settings for the password generator; you can’t adjust the length or character sets used.

Aura doesn’t have the detailed security report that you get with LastPass, Keeper Password Manager, and some others, but it does mark any passwords it considers weak, any duplicates, and any that have been breached. For certain supported websites, Aura can automate the process of changing passwords. Clicking the circled arrow icon that identifies these sites initiates the process.

(Credit: Aura/PCMag)

We at PCMag don’t recommend promiscuously sharing your account passwords, but sometimes you really need to share. Aura’s password now includes a sharing ability, but it’s limited. You can only share with the other adult family members who already share your Aura account. It’s a reasonable limitation.

You can now use Aura to manage temporary email addresses, which are called email aliases. The popup that appears when you select a username or password field (whether or not you’ve saved credentials already) includes a link to create an email alias. If you choose to do so, Aura generates a random alias like [email protected] and creates a new password entry for that alias. You don’t get options like creating custom aliases or reviewing alias communications online, and Aura’s password list doesn’t flag aliased items in any way. But you can delete an alias that you no longer need or just suppress forwarding.

(Credit: Aura/PCMag)

New since my last review, Aura supports multi-factor authentication. Enabling it requires that you enter a code texted to your phone and another code sent to your account email. Thereafter, logging in requires a text code, with the option to choose an emailed code as a backup. This isn’t as secure as using Google Authenticator or another authenticator app, but it’s way better than relying solely on a password.

What Is Two-Factor Authentication?

A modern password manager needs to work across all your devices. It’s especially nice when you can set up your lengthy passwords on a desktop computer and then easily use them on your phone. Aura’s browser extensions for Chrome, Edge, Firefox, and Safari let you use it on Windows or macOS. You can make Aura your password autofill default app on Android and iOS.

Aura can now automatically fill web forms for you based on personal information stored in your vault. When you click on a data entry field, it pops up to offer any available data. It’s a little awkward; I couldn’t find any way to choose among multiple entries for addresses, for example. But it’s a start.

Aura has overcome many of the limitations seen in my previous review. Its password capture is more reliable, and it now handles password replay. You can protect your password stash with multi-factor authentication and securely share passwords within your family. And it even offers simple email aliases. You can still get more from a top free password manager, but Aura’s password component is now a reasonable choice.

New Parental Control Features

Not every security customer has kids, and not every parent wants to use parental control software. For parents who do, Aura now offers some parental control features. Note that PCMag no longer reviews or recommends parental control apps, suggesting instead that readers look at the related features built into modern operating systems.

Mobile-Only Parental Control

The first thing to understand about Aura’s parental control is that it’s strictly for mobile devices. If you want to monitor and control what your child does with a user account on a macOS or Windows box, look elsewhere. You can’t even perform parental configuration tasks from the Aura web dashboard—you must use the parental app on your mobile device.

Once I understood that limitation, I had no trouble installing the app in child mode on a Pixel 6 and in parental mode on an iPad. To use parental control at all, I first had to add my imaginary child to my main Aura account. Note that you can add a total of five adults besides yourself, but there’s no limit on children.

Blocking Apps and Categories

Tapping the Content Filtering panel opened a page divided into three tabs: Apps, Websites, and Categories. Apps such as Discord, Facebook, and Instagram were blocked by default, while apps such as Disney, Minecraft, and Roblox were allowed. Of the 28 content categories, 12 were blocked by default, things like Explicit Content, Mature, and VPNs & Proxies. That last one is important because a clever child could use a secure anonymizing proxy to totally evade the content filter.

(Credit: Aura/PCMag)

The defaults I saw were for the Child profile, selected because of the birth date I gave Aura. Switching to the Teen profile unblocked all apps and left just five categories blocked. I flipped back to Child for testing. Of course, parents can fine-tune these settings. The profiles are just there to help get started.

Time Limits

Out of the box, Aura doesn’t impose screen time limits, leaving you to set a schedule. I found the scheduling system confusing. You see icons for the days of the week across the top and a spinner to select a limit from 15 minutes to 24 hours and 45 minutes. The choice you make affects the days you’ve highlighted. If you accidentally include a day that already has a schedule, Aura offers to disable the previous schedule. And that’s literal; the previous schedule remains in place, but it’s disabled. This could be so much simpler.

In addition to the scheduled time limits, parents can pause the child’s access with a single click. Another click awards the child extra screen time.

Hands On With Parental Control

With the configuration handled on the iPad, I turned to the Pixel and started misbehaving. I visited a dozen sites in the Explicit Content and VPNs & Proxies categories, interspersed with innocent sites. I expected to see warnings from Aura about the inappropriate sites, but all I got was a Chrome error message: ERR_CONNECTION_REFUSED. That is, except when the content filter totally whiffed, allowing access to the naughty site. My Aura contact confirmed that Aura is not meant to display a warning message and that the error message is expected behavior.

I also tried launching Facebook and Instagram, with confusing results. Facebook loaded initially but then hung up to the point where I had to terminate the app. On restarting, it wouldn’t log in. The same thing happened with Instagram. Clearly, something happened. Once again, my company contact confirmed that this is how app blocking works.

(Credit: Aura/PCMag)

Back in the parental app, I checked Aura’s activity report. The summary stats about sites visited and blocked didn’t account for nearly as many sites as I tried. Digging in for details, I did find most of what I expected. I even found the missed naughty sites, categorized as Business or Home & Family.

Note, too, that Aura’s control is fragile at best. Nothing prevents your child from simply deleting the app.

What’s Not Here

Filtering inappropriate content and setting screen time limits are the two prime features of a parental control system. Aura handles those but not much more. The most glaring omission in this system is the monitoring of children’s user accounts on PCs and Macs. The best competing parental systems extend their reach to all popular platforms.

Do you know where your kids are right now? Have you enjoined them to stay away from the bodega down the block? Many parental systems offer geofencing, a feature that warns you if your child strays into (or out of) parent-defined locations. Locategy, Mobicip, and Qustodio are examples. Though Aura is mobile-centric, it doesn’t offer geofencing.

Norton Family, Qustodio, Bark, and others offer directed monitoring of children’s social media accounts. Norton provides detailed tracking of the YouTube videos watched by your child. Qustodio monitors YouTube, too, and can also track your child’s texts and phone calls. The lack of these and other advanced features makes Aura a poor choice for parental control. Fortunately, that’s not its primary purpose.

Safe Gaming for Windows

But wait! Windows users aren’t entirely cut out of the parental monitoring world. Strictly on Windows, Aura offers a feature called Safe Gaming. This is a licensed version of the ProtectMe system from Kidas. ProtectMe costs $6 per month or $60 per year as a standalone, so if you need it, getting it with Aura is a nice savings.

The Kidas website lists 900 games covered by ProtectMe. It tracks screen time for all 900 of the games and listens in on voice messages for almost 200 of those. For about 140 games it monitors in-game text messages. If ProtectMe detects cyberbullying or other inappropriate behavior such as sharing personal details, it notifies parents.

(Credit: Kidas/PCMag)

My test virtual machines are equipped with exactly zero games, and I’m no longer a big gamer myself. I don’t have any good way to put this feature to the test. I do observe that the standalone ProtectMe offers a 14-day free trial, so its makers are confident that parents will find it useful.

Some Performance Impact

In days of yore, some security suites gained a well-deserved reputation as resource hogs, to the point where users would turn off security to regain performance. Those days are gone, fortunately. Most modern suites have little or even no effect on performance. I still run some simple hands-on tests to make sure the bad old days don’t return.

Installing a security suite means you’re adding protective processes that need to launch at startup, which could slow the boot process. To check this, I run a set of scripts that launch at boot and check CPU usage once per second. When 10 seconds elapse with no more than 5% CPU usage, I declare the system is ready for use. Subtracting the timestamp from when the boot process began yields the boot time. Averaging numerous tests before and after installing the suite lets me measure its impact on boot time.

Aura slowed the boot process by 21%, quite a bit more than most. On the other hand, that 21% represents just a few seconds difference. Even so, fully half of recent security suites had zero impact, or even speeded up the boot time (which I count as zero slowdown).

Another test measures the time required to move and copy a large set of varied files between drives, and the final test repeatedly zips and unzips that same file collection. The move and copy test ran 15% longer under Aura’s monitoring, but the zip and unzip test ran 6% longer. Aura’s average impact of 14% probably isn’t something you’d notice, but it’s twice the impact I measured during Aura’s previous review.

Others have totally aced this test. Avira and Webroot Internet Security Complete are the no-impact winners here, while F-Secure Total and G Data averaged just 1% impact..

Improved macOS Antivirus

Installed on a Mac, Aura looks almost the same as on Windows. It has the same welcome message occupying most of the window, with panels for Antivirus and Online Security below. There’s a menu at left, though it lacks the Safe Gaming and Preferences choices. But overall, the Mac antivirus is extremely similar to its Windows cousin.

(Credit: Aura/PCMag)

Antivirus Protection on the Mac

When they’re available, I report on independent lab test results for macOS antivirus apps—two of the four labs I follow extend their testing to the Mac platform. As with the Windows edition, there are no lab test results for Aura on macOS. Avast, AVG, Kaspersky, and Trend Micro hold perfect scores in the latest macOS-centric reports from both AV-Test Institute and AV-Comparatives.

The Mac edition still doesn’t offer real-time protection, which is called Auto-scan in the Windows version. However, it now offers a full system scan in addition to quick and custom scans. Aura took 37 minutes to complete a full scan; the current average is 26 minutes. Given there’s no real-time protection, you’ll want to run a scan regularly. Most Mac antivirus utilities, among them Avast One Basic for Mac, Norton 360 Deluxe for Mac, and Trend Micro Antivirus for Mac, build in the ability to schedule a regular scan. Alas, Aura does not.

My antivirus expertise and my collection of testing programs are all focused on Windows. I don’t have the skills to duplicate that environment under macOS. However, most Mac antivirus tools attempt to wipe out any Windows malware they encounter so as not to somehow serve as a carrier. That’s something I can test. To do so, I copied my Windows malware collection to a USB drive and mounted it on my test Mac. Aura didn’t react when I opened the folder containing the samples, so I launched a custom scan of the drive.

The results were impressive. Aura detected every single one of the Windows malware samples. Its 100% score is the best among current products, trailed by Avast One Basic for Mac and G Data Antivirus for Mac, with 97% and 96%, respectively.

Phishing Protection Equally Dismal on macOS

Both the Windows and macOS editions rely on Online Security to handle dangerous and fraudulent websites. You’d expect they would come up with the same results in testing, but the last time I put them through my phishing protection test, Aura scored 80% on Windows and 38% on Mac.

Scoring the phishing protection provided by the VPN component is difficult because, frequently, the result of its action appears to be nothing but a browser error. For clarity, I used the Safe Browsing provided by Aura’s browser extension on both platforms. Both scored precisely the same.

(Credit: Aura/PCMag)

Aura’s shared score of 5% detection is the lowest of any Mac security tool that offers phishing protection. It’s a strange contrast with its top score in my Windows malware detection test. If you do choose Aura, be sure to leave the phishing protection in your browser turned on.

Simple macOS Online Security

Just as in the Windows edition, Aura’s VPN doesn’t describe itself as a VPN. Rather, it’s called Online Security. You don’t choose the VPN protocol, or the VPN server to use. All you do is turn it on or off. I did notice one minor oddity. With Online Security off, Aura on Windows reported, “You’re connected to a secure network.” The Mac edition, using the same connection, called it an “unsecured network.”

(Credit: Aura/PCMag)

When you enable Online Security, you get the benefit of an encrypted connection. Websites can’t geolocate you because the IP address received belongs to Aura. You don’t get a chance to view location-locked content by picking a foreign server—Aura only picks servers in the US. But you also don’t have to think about any VPN settings or even about the concept of a VPN. Aura’s simple style may be a good fit for less-techie users.

Aura’s macOS app has improved since my last review. The bugs and problems I encountered didn’t make a reappearance, and it now includes some features that were blatantly missing. It doesn’t come close to the best dedicated Mac antivirus apps, but it’s no longer the hot mess it used to be.

Mobile Protection

Installed on an Android device, Aura looks very much like it does on the web, just arranged to fit the tall and skinny window. You see icons for your family members at the top, with the latest alerts below. Scrolling down, you’ll find that it encourages you to enable all protective features, including the identity features I’ll discuss below, the password manager, the VPN-powered Shield, and (if appropriate) parental control.

(Credit: Aura/PCMag)

The mobile-specific Call Protection feature aims to filter out spam calls and texts. During setup, you choose your mobile carrier (AT&T, T-Mobile, Verizon, or Tracfone), confirm your phone number, and supply a verification code texted to that number. Letting it view your contacts ensures they won’t be blocked. Completing the process does require that you let Aura receive and filter your calls. Since my test Pixel isn’t configured with a cellular connection, I couldn’t fully complete the activation.

As you keep scrolling, you’ll come to a list of recent activities and a selection of educational videos. What you won’t find is an antivirus scan or an anti-theft system. The idea is that Online security’s Shield mode should prevent your Android from connecting to any dangerous sites. If you’re using your phone for banking or other sensitive transactions, you can switch Online security to VPN mode. As with the Windows and macOS versions, you don’t choose your VPN server or configure any VPN settings. It’s just on or off. And Aura suggests you keep it off when not needed to avoid draining the battery.

(Credit: Aura/PCMag)

With most cross-platform security suites, iOS gets short shrift. The same powerful built-in security protections that make malware attacks difficult also make creating an antivirus for iOS well-nigh impossible. However, Aura doesn’t offer mobile antivirus, and the iOS app looks and works almost exactly like the Android edition.

(Credit: Aura/PCMag)

As on Android, you can view and adjust all of Aura’s features in the app, from identity protection to password management to data broker removals. Online security works just as on Android, with a choice of the simple Shield mode or VPN mode when you’re doing something sensitive online. The biggest visible difference is that you don’t get Call Protection on iOS.

Identity and Privacy Protection

Antivirus, VPN, and phishing protection are local security issues, protecting what you do on your devices. Aura has another side, just as important, that’s reached either online or on your mobile devices. The My Aura Dashboard features recommendations, alerts, a summary of activities, links to important features, and even a collection of informative security videos. The layout depends on the size of the window you’re using, and it supports anything from a super-wide browser window to a skinny mobile app view.

(Credit: Aura/PCMag)

A menu offers the choices Home, Me, My Family, and Vault. Home brings you back to the dashboard, while My Family lets you select or add other family members. Clicking Me gets five choices: Credit, Transactions, Online Security, Antivirus, and Call Protection. Call Protection only applies to Android devices, while choosing Antivirus or Online Security lets you check on the devices where those features are installed. I’ll discuss the Credit and Transactions features below.

Clicking Vault also gets five menu choices: Personal Data, Home and Property, Passwords, My Documents, and Data Broker Removal. I’ve discussed passwords above. As you’d expect, Opening Personal Data lets you view and add personal information for protection. Home and Property specifically includes addresses and car info. As for My Documents, this is simply encrypted cloud storage for important documents. You can access these documents through the Aura dashboard on any of your devices.

If you’ve opted for the Family edition, you manage family members here. Along the left or near the top, depending on window size, you’ll find icons for your family members and a plus-sign icon to add a member. Adult family members, up to five additional, get a full account, with protection for 10 devices and their own credit and identity management—the same protection you get for yourself. If you add a child, you remain in charge of the account, and you receive any alerts. There’s no limit on child members.

Managing Your Credit

These days, it’s tough to function without using credit. Trying to buy a plane ticket without a credit card may get you pulled aside for questioning. If your credit isn’t good, that card will cost you more in interest and fees, as will things like auto loans. Aura checks your credit with Experian every month and displays your current score prominently, along with a button to quickly invoke Experian CreditLock. Activating CreditLock locks down access to your Experian credit file. It also provides links to freeze your reports from Equifax and Transunion. If you suspect misuse of your information, freezing your reports can head off problems.

(Credit: Aura/PCMag)

Opening the Credit panel brings up a big display of your credit score along with a color-coded legend (from Very Poor to Excellent) and a graph of your score over time. Want to improve that score? The report summarizes factors that drive your score down (or up), with the option to dig in for details and advice on improving your overall score.

You don’t need help to request your credit report from the big three agencies, but Aura certainly makes it easy. Click a button, verify your intention, and you’re done. Note that by doing so, you authorize Aura to get that information on a recurring basis.

Monitoring Your Transactions

These days, banks and credit card companies do a decent job of detecting anomalous transactions and checking them with you, but that’s not their primary task. Aura’s transaction monitoring actively tracks the banks and credit cards that you connect, warns you of any oddities it detects, and lets you see all your accounts in one place.

(Credit: Aura/PCMag)

Aura uses a service called Plaid to connect with your accounts. I was already a bit nervous about giving Aura access to my data for this review. Adding a third party to the mix didn’t calm my nerves at all. But I soldiered on. To connect with my bank, I had to supply my online banking username and password, as well as a security code sent to my phone.

You can set Aura to alert you to transactions greater than a certain threshold and configure thresholds separately for bank accounts, credit cards, loans, and investments. Before you dig into adding accounts, fire up your password manager and make sure you have the correct login credentials for each institution’s online presence.

Protecting Your Identity

As part of the onboarding process, you give Aura your name, address, phone number, birth date, and SSN. It immediately starts watching out for misuse of that information. I noticed that, with no effort on my part, it found my previous address based on public property ownership records.

Aura does prompt you to dig in and manually add more info for tracking. You can monitor one entry each for Address, Birth date, Name, National health ID, and SSN. It’s possible to add more than one, but Aura warns that personal data items beyond the maximum won’t be monitored.

For other categories, Aura monitors up to 10 entries. These include Driver’s license, Email address, Gamer tag, Health Insurance, IP address, Loyalty card, Passport, and Phone number. Here, too, if you add more than 10 items, Aura will store them without monitoring.

Then we come to the unlimited items. Aura will monitor any number of the following: Brokerage account, Checking account, Credit card, Retirement account, and Savings account. IDShield also allows unlimited entries in quite a few categories but just one entry for those that aren’t unlimited. As for Webroot Premium, it just tracks four data types (Email, Credit card, Driver’s license, and Login credentials), but you can register as many as you want of those types.

(Credit: Aura/PCMag)

Note that the accounts you added earlier for transaction monitoring don’t show up automatically in this list; you must enter them here as well. The list of personal items for tracking is much like what you get with Norton’s Dark Web monitoring (which is available even without LifeLock). McAfee and IDX Privacy are among others that offer similar services.

Aura scrapes the Dark Web for any evidence that your personal information has been leaked. It also looks for new accounts opened using your details, a common crime by identity thieves. And it warns if your information turns up in public records of criminal activity.

Personal Data Removal

Aura automates the process of officially ordering data broker websites to remove your data from their collections. Abine DeleteMe was a pioneer in this space, offering data broker removal since 2011, but modern personal data removal services have outstripped DeleteMe.

Some of these services offer other privacy-related features. IDX Complete, for example, gives you a full suite of privacy services including dark web monitoring, a VPN, and identity theft prevention remediation. Privacy Bee comes with a browser extension that actively blocks ad trackers and other trackers.

(Credit: Aura/PCMag)

Aura manages to opt you out of 24 data brokers, about half of them well-known enough that several of the other services I track cover them. But 24 isn’t very many. Cloaked looks for your info on nearly 200 sites, Optery tracks more than 300, and PrivacyBee scans over 440 sites for your data. Optery and Privacy Bee have the added virtue that finding your captured data is free—you only pay if you want the service to manage opt-outs for you.

You may be surprised to find that before you’ve even looked at this feature, Aura is already busily removing your data from its list of brokers. It doesn’t need your permission or interaction. Rescuing your personal data from a couple of dozen brokers is a useful feature, but it doesn’t compare with the best dedicated removal services.

White Glove Fraud Resolution

Aura will notify you if your data turns up on the Dark Web, or if someone makes a big charge on your credit card. Alerting you of these and other threats to your identity is great, but what do you do about it? Like Norton, Bitdefender Ultimate Security, McAfee+, and others, Aura’s service includes remediation of any fallout from identity theft. And as with the others, I can’t really test that service, just report on it.

Aura’s website calls the company’s identity theft agents White Glove Fraud Resolution Specialists. It states that your assigned specialist will “walk you through the recovery steps and even facilitate three-way calls with your bank or government agencies.”

(Credit: Aura/PCMag)

But hand-holding isn’t all you get. Aura’s documentation does promise serious financial support for identity theft remediation, too. The company will spend up to a million dollars (which seems to be standard) on legal fees, notary fees, replacement identity cards, and the like. That’s a million per adult, so the cap is $2 million for a Couple account or $5 million if you’ve opted for a Family account.

Your case manager will guide you to make use of Aura’s protective features such as establishing a credit freeze. Like Norton and McAfee, the company promises help dealing with the fallout of a lost wallet. It sounds like it’ll do the job.

Verdict: Big, Not Best

Aura is a sprawling collection of security components and services to protect your devices, your privacy, and your identity. It’s relatively new to the scene, though, and the elements of the suite that can be tested don’t all impress. Norton 360 With LifeLock, on the other hand, combines thorough, mature identity protection with award-winning device-level security, including VPN, password management, and more. Bitdefender Ultimate Security likewise shines both in device security and identity protection. These two are our Editors’ Choice services in the realm of security suites with identity protection.