I have seen Defender fail to detect a virus in a downloaded file once. Things have improved a lot since Windows has added APIs for antimalware products to hook into, but it was an eye opener when Symantec complained improved Windows security was anticompetitive because it broke their dodgy hacks while their competitors products just kept working. Threat intelligence: Generated by Microsoft hunters, security teams, and augmented by threat intelligence provided by partners, this enables Microsoft Defender ATP to identify attacker tools, techniques, and procedures, and generate alerts when these are observed in collected sensor data.I like the fact that it does not have much performance impact and does not break things.ģrd party has often broken developer tools, VMware, etc, for me.įor example, a mainstream 3rd party antivirus I tried broke Windows Update inside all my virtual machines a few years back (presumably by man-in-the-middle network traffic filtering leading to Windows Update certificate mismatches).Įven further back, another one broke my Web and database development environment, but their tech support was 'we only test our product for ordinary users who just browse the Web and fetch email, not software developers'. It uses the followng combination of technology built into Windows 10 and Microsoft's cloud service:Įndpoint behavioral sensors: These collect and process behavioral signals from the operating system and sends this sensor data to your private, isolated, cloud instance of Microsoft Defender For Endpoint.Ĭloud security analytics: Leveraging big-data, machine-learning, and unique Microsoft optics across the Windows ecosystem and online assets, behavioral signals are translated into insights, detections, and recommended responses to advanced threats. Microsoft Defender For Endpoint helps enterprise networks prevent, detect, investigate, and respond to advanced threats.

Windows defender review