IT Myths Debunked, Part 3. Some myths refuse to die…this one comes pre-installed on every computer in the building.
The antivirus built into Windows is good. In AV-Comparatives’ latest business test, Microsoft Defender Antivirus blocked 98.8% of real-world attacks with zero false alarms. So when a client asks why they pay for endpoint protection on top of it, the question is fair. The answer is that the test measured one job, and current attacks are built to get around it.
The Myth: “We Have Windows Defender, So We Are Covered”
“Antivirus” sounds like “security software.” It actually means one task: look at a file and decide if it is malicious. AV-Comparatives says so in its own fine print, noting that the test does not cover detection and response at all. Everything an attacker does that is not a file falls outside it.
What Happened
Part 2’s ChatGPT incident is the whole argument in one case:
- The user was told to paste a command into Windows Terminal to “verify” their account
- There was no file to scan; the command was PowerShell, a legitimate Windows tool, fetching something from a remote server
- Endpoint detection and response killed the process, twice, because it watched the behavior, not the file
Antivirus asks whether a file is bad. Detection and response asks whether a behavior is bad, which is a different question with a completely different answer.
Which Defender You Actually Have
Microsoft sells several things called Defender, and the Start menu does not say which one you have:
- Microsoft Defender Antivirus is built into every Windows machine. It is the product in the 98.8% test, and it scans files only.
- Microsoft Defender for Business is for companies under 300 employees. It adds endpoint detection and response, automatic attack disruption, and vulnerability management, costs $3 per user per month standalone, and is included in Microsoft 365 Business Premium.
- Microsoft Defender for Endpoint is the enterprise version of the same idea.
Plenty of small businesses already pay for Defender for Business inside Business Premium and have never turned it on. Which one is running is among the first things a GiaSpace IT audit checks.
Why It Matters More Than It Used To
Microsoft’s Digital Defense Report, published two weeks ago, describes an attacker who does not bring malware through the front door:
- Phishing accounted for 23% of observed intrusions, up from 7% the year before
- More than half of intrusions that began with a valid login led to further credential theft
- Early detection is hard, in Microsoft’s words, because the activity mimics legitimate work
Attackers now use real accounts, real tools, and real commands, so a file scanner has nothing to scan. Detection without a person watching it is just a log (the equivalent of a smoke detector in an empty building).
The Question to Ask Instead
There is no short answer to “is Windows Defender enough?” because it depends on which Defender you have, whether it was set up, and whether anyone is watching it. There is a better question, and it does have a short answer:
When a machine in our office starts doing something it should not, who finds out, and how fast?
If the answer is “the user, when the screen goes black,” you have antivirus. If it is a name and a number of minutes, you have detection and response. Two things get you there:
- Confirm which Defender is on every machine, and if Business Premium is already paid for, turn on the one that is included
- Decide who owns the alerts, in writing, before the first one fires
Where GiaSpace Fits
We configure Defender for Business or a comparable endpoint platform for every client, and we are the name and the number of minutes. When something starts running that should not, our team sees it and acts on it.
→ Schedule a Security Review with Rob Giannini, our CEO & Founder
