Is Windows Defender enough for a business?

What Microsoft Defender Antivirus is

Microsoft Defender Antivirus (once called Windows Defender) is the antivirus built into Windows 10, Windows 11 and Windows Server 2016 and later. It is not a cut-down trial: it provides real-time protection, cloud-delivered protection and regular security intelligence updates, and it can be configured through Microsoft Intune, Group Policy or Configuration Manager.

So the honest answer to "is Windows Defender enough?" starts with: for protecting a single Windows PC from common malware, it is a credible product. The question for a business is different. It is whether you can manage, prove and extend that protection across all your devices.

Where the gaps are for a business

Defender Antivirus on its own leaves several things that businesses usually need:

None of this is a criticism of Microsoft. It is simply that the free, built-in component is the antivirus engine, while the business management and response features are sold as separate products.

Microsoft's own upgrade: Defender for Business and Defender for Endpoint

Microsoft sells two business products built on Defender Antivirus:

• Microsoft Defender for Business is designed for organisations of up to 300 users. Microsoft lists centralised management, endpoint detection and response, automated investigation and remediation, core vulnerability management and apps for Mac, iOS and Android. It is included in Microsoft 365 Business Premium and available standalone. Windows and Linux servers need extra licences.
• Microsoft Defender for Endpoint is the enterprise product, in Plan 1 and Plan 2, extending protection to macOS, Linux, Android and iOS.

If you already pay for Microsoft 365 Business Premium, you already have Defender for Business. Turning it on and onboarding your devices may be the quickest improvement available to you.

Running another antivirus alongside Defender

If you choose a third-party product, Windows handles it for you. Microsoft documents that on Windows 10 and 11, when a non-Microsoft antivirus becomes the primary product on a device not onboarded to Defender for Endpoint, Defender Antivirus switches to disabled mode automatically, and can re-enable itself if the other product expires or is removed. Passive mode, where Defender keeps scanning and reporting without blocking, needs the device to be onboarded to Defender for Endpoint.

Windows Server behaves differently: Defender Antivirus is not disabled automatically when you install another product. Microsoft says to disable or uninstall it manually to avoid conflicts, or, if the server is onboarded to Defender for Endpoint, to set it to passive mode. We can plan this as part of a server deployment. See server antivirus for Windows Server.

If you keep Defender: making the most of it

If you decide Microsoft's protection is right for you, a few steps make a real difference:

• Manage it centrally. Use Microsoft Intune or Group Policy so settings are consistent and users cannot change them.
• Keep the protective features on. Microsoft documents real-time protection, cloud-delivered protection, network protection, attack surface reduction rules, controlled folder access and tamper protection; check which are enabled in your policy rather than assuming the defaults.
• Onboard to Defender for Business if you have it. Microsoft 365 Business Premium includes it, and onboarding brings devices into the Defender portal with EDR and automated investigation.
• Cover the gaps separately. Macs, Linux servers and mobiles need their own protection, whether Microsoft's or another vendor's.
• Decide who reads the alerts. A console nobody checks offers little more than no console.

We can help you review your Microsoft licences and policies, or compare them with a third-party product, before you spend anything.

When a third-party product makes sense

Many organisations protect Windows devices perfectly well with Microsoft's products. A third-party endpoint protection product is worth comparing when:

• You run a mixed estate of Windows, Mac and Linux and want one agent and console for all of them.
• You do not have Microsoft 365 Business Premium or E5 licences and would be buying protection either way.
• Your IT provider or team already uses another vendor's console across other organisations.
• You want a vendor-run managed service, such as those offered by CrowdStrike, Sophos or ThreatDown, on the same agent.
• You want a specific capability, such as Sophos CryptoGuard rollback or SentinelOne's on-device rollback.

For a direct comparison with one alternative, see Sophos vs Microsoft Defender. Our endpoint protection vendors page compares the full range we supply, and the Cloud Security site compares CrowdStrike vs SentinelOne vs Defender.

What about Cyber Essentials?

The Cyber Essentials malware protection control asks for anti-malware on in-scope Windows and macOS devices that is kept up to date, stops malware and malicious code running and blocks connections to malicious websites. Built-in Defender Antivirus can be part of meeting that on Windows when it is switched on and updating; check how web protection is provided, and remember the Macs.

Talk it through with us

Forever Systems can help you decide whether to make more of the Microsoft protection you already have or add a third-party product, and supply and deploy either route. Contact us and tell us which Microsoft 365 plan and devices you have.