Microsoft Defender Review 2026: Is Free Enough?

Editorial Team

UpdatedJune 8, 2026

Our Rating: 9.0/10 — How we got here (May 12, 2026)

Dimension	Score	Weight	Contribution
Independent lab data AV-TEST 18/18 + AV-Comparatives 2025 Bronze RWP	9.0/10	40%	3.6
Price-to-features Free, built into Windows 11/10	10.0/10	20%	2.0
Community sentiment No Trustpilot listing; well-regarded as default	7.0/10	15%	1.1
Hands-on experience Zero install footprint, OS-integrated	9.0/10	15%	1.3
Corporate transparency Microsoft, fully transparent SDLC	9.0/10	10%	0.9
Sum (rounded to half-point per methodology)			8.90 → 9.0

Weights: Lab 40% / Price 20% / Community 15% / Hands-on 15% / Corp 10%. See our methodology for full weighting rationale.

Reading time: 10 minutes

Microsoft Defender at a Glance

What it is: Microsoft Defender Antivirus (officially renamed from “Windows Defender” in 2023, though most users and forums still call it that) is built into every Windows 10, Windows 11, and Windows Server install. Free. No subscription, no upsell modals, no ads. Enabled by default, automatically deactivates the moment you install a third-party antivirus, then re-enables itself if that subscription lapses. As of May 12, 2026 it scores 18/18 at AV-TEST February 2026 alongside Bitdefender, Norton, Kaspersky, McAfee, Avast, F-Secure, G Data, and TotalAV — one of only nine consumer engines hitting perfect lab scores in the cycle. The product Microsoft now ships is structurally different from the “Defender is just a placeholder” product of 2018-2020: cloud-delivered protection, behavioural ML, SmartScreen, Controlled Folder Access for ransomware, Exploit Guard, and Core Isolation memory integrity all run by default with no user configuration.

What you get for $0: real-time antivirus, cloud-delivered protection, behavioral detection, SmartScreen web and download filtering, Controlled Folder Access (ransomware protection), Exploit Guard, Windows Firewall, Core Isolation memory integrity, and automatic definition updates through Windows Update. All managed inside the Windows Security app.

Short verdict: Microsoft Defender 4.18 earned a perfect 18/18 at AV-TEST February 2026, matching Bitdefender, Norton, Kaspersky, and McAfee. The detection conversation is over: Defender catches what paid products catch. The honest conversation in 2026 is about what Defender does not bundle — no VPN, no password manager, no dark-web monitoring, no cross-platform protection — and whether you care.

Lab Test Results — What the Numbers Actually Say

For roughly a decade, the answer to “is Windows Defender any good” was “add a real antivirus.” That stopped being true around 2021, and by the 2024 test cycles the lab gap had fully closed. AV-TEST February 2026 — Windows 11 Home User: Microsoft Defender 4.18 scored 18 / 18 (Protection 6/6, Performance 6/6, Usability 6/6) with Top Product designation. One of only nine engines hitting perfect 18/18 in the cycle — alongside Bitdefender, Norton, Kaspersky, McAfee, Avast, F-Secure, G Data, and TotalAV. AV-Comparatives Real-World Protection Test 2025: Advanced+ rating across all four cycle reports, with low false positives across the test corpus. Microsoft also publishes its own Defender XDR signal data, which is the largest endpoint telemetry pipeline of any consumer AV vendor — that scale shows up as fast cloud-signature deployment when new threats break in the wild.

AV-Comparatives 2025: Advanced+ awards in Real-World Protection and Malware Protection with detection rates above 99.6%. The historical weak spot — false positives — improved substantially after the 2022–2023 cloud-model updates.

What changed 2019 to 2026. Microsoft moved to a cloud-first detection model in 2020 (files fingerprinted against Microsoft's cloud in under a second). Behavioral monitoring replaced signature-only scanning around 2022. And Defender's telemetry surface — every Windows install on the planet — gives Microsoft threat-data volume no competitor can match.

The caveat AV-TEST does not measure: Defender is Windows-only. No consumer Defender on iPhone, Android, or Mac (the paid Microsoft Defender for Individual partially addresses this — see pricing).

Why PCMag scores Defender lower than AV-TEST. A reasonable question: AV-TEST gives Defender 18/18, but PCMag historically rates it 3.5/5 or lower. The discrepancy comes from different test methodologies. AV-TEST and AV-Comparatives use large standardized sample sets across the entire industry — Defender lab-scores there match every other top-tier engine. PCMag uses their own proprietary in-house malware sample set with different mix and difficulty calibration; their tests historically expose engines on edge-case samples where Defender lags slightly behind dedicated commercial products. Both data points are valid; neither is the full picture. The pragmatic read: on the standardized industry tests Defender matches the paid suites; on the harder edge-case proprietary tests it occasionally trails. For a typical home user, the standardized scores are the more useful signal.

What Microsoft Defender Costs (It's Free, With Caveats)

Prices verified by our team on April 22, 2026 directly with vendor websites (US pricing in USD). Renewal prices reflect default vendor renewal terms; actual MSRP at renewal may differ by promo.

The Windows-built-in Defender is genuinely, fully free. No trial, no paywalled feature, no nag screen, no ads.

Several Microsoft products carry the "Defender" name — this confuses people. Here is what matters for a home user.

For a single Windows 11 PC, the free built-in Defender is enough. You do not need to buy anything from Microsoft.

If you already pay for Microsoft 365 Personal ($9.99/month) for Word, Excel, and 1 TB of OneDrive, Microsoft Defender for Individual is included — useful for households with iPhones and a MacBook mixed with Windows machines. Buying Microsoft 365 solely for Defender is not worth it: Bitdefender Total Security ($19.99 first year, 5 devices, full cross-platform) is cheaper and better.

Microsoft 365 Is Microsoft's Defender Upsell Path

Built-in Defender Antivirus is unconditionally free for every Windows 10/11 user — no subscription required, ever. What Microsoft monetizes around it is Microsoft 365. The 365 Personal subscription ($9.99/month or $69.99/year as of May 2026) and Family ($12.99/month or $99.99/year, up to 6 people) bundle the personal Microsoft Defender mobile app, OneDrive 1 TB, Office apps (Word/Excel/PowerPoint), and Copilot Pro features. The "Get more security" prompts inside Windows Security app point here.

The honest framing: 365 Personal/Family is not required for Defender Antivirus protection on your Windows PC. If you want OneDrive backup, Office apps, or the cross-device Defender dashboard for your phone, the 365 subscription is reasonable. If you only want antivirus on a single Windows PC, the built-in engine is complete on its own.

Features Worth Knowing About

Microsoft has quietly built a full endpoint-security stack into Windows Security over the past five years; most users never turn the settings on because they are buried and rarely promoted.

Controlled Folder Access. Defender's ransomware protection. Unrecognized apps cannot modify Documents, Desktop, or Pictures. Off by default — turn it on at Windows Security → Virus & threat protection → Ransomware protection. Paid suites charge for equivalent features; most users do not know Defender includes it.

SmartScreen. Filters phishing URLs and malicious downloads. Covers URLs on Edge; downloads-only on Chrome and Firefox (Google Safe Browsing handles URLs there).

Tamper Protection. The most important Defender feature most users never check. Default-on since Windows 10 19H1 (May 2019), Tamper Protection blocks external changes to Defender's registry keys, services, and security policies — preventing malware (or careless software) from disabling the antivirus from underneath you. Verify it's on at Windows Security → Virus & threat protection → Virus & threat protection settings → Manage settings → Tamper Protection. The "grayed out" edge case affects domain-joined machines managed by Intune or Group Policy — that's intentional, not a bug. Reference: Microsoft Learn — Tamper Protection.

Smart App Control (SAC). Windows 11's reputation-and-AI-model app vetting layer, expanded in 24H2 (October 2024). SAC blocks unsigned or low-reputation executables at the kernel level before they run — distinct from legacy SmartScreen, which warns at the UI layer after the file is on disk. Three-state lifecycle: evaluation (Windows monitors your apps for ~10 days to decide if SAC will work without breaking your software), on, or off. Critical caveat: once turned off, SAC cannot be re-enabled without a clean Windows reinstall — Microsoft's stated design to prevent malware from re-enabling it after a tainted session. SAC requires a clean install of Windows 11; users who upgraded from Win 10 or earlier Win 11 get SAC stuck in evaluation mode indefinitely. Coverage: only unsigned/low-reputation apps. Does NOT replace signature-based scanning or behavior monitoring — it is one layer of several. Reference: Microsoft Support — Smart App Control.

Exploit Guard. Blocks memory-corruption exploits, DLL injection, and similar techniques aimed at unpatched Office, PDF readers, and browsers.

Application Guard for Edge (deprecated in Windows 11 24H2). Previously sandboxed untrusted sites in a Hyper-V container on Windows 11 Pro and Enterprise. Microsoft deprecated this feature in Windows 11 24H2 (October 2024); replacement is Edge's built-in sandbox plus Virtualization-based Security improvements. If you upgraded to 24H2 and used App Guard, the feature is no longer available — Edge's default sandbox is now the protective layer. Microsoft Tech Community deprecation announcement.

Core Isolation / Memory Integrity. Hardware-virtualization protection for the Windows kernel. On by default on supported hardware.

Cloud-delivered protection. Files are fingerprinted against Microsoft's cloud within a second; automatic sample submission uploads novel samples for analysis. This is the biggest single reason Defender closed the detection gap.

What Defender does not include: no VPN, no password manager, no dark-web monitoring, no identity-theft protection, no parental controls (those are in Microsoft Family Safety — a separate free app), no webcam protection, no secure banking browser, no bundled cloud backup beyond OneDrive, and no consumer product on macOS, iOS, or Android.

Periodic Scanning — What Happens to Defender When You Install Norton or Bitdefender

This is the most misunderstood Defender behavior in 2026. Read it before deciding whether to install a paid AV alongside Defender.

The default behavior: when any third-party antivirus (Norton, Bitdefender, Malwarebytes Premium, Kaspersky, McAfee, etc.) registers itself with Windows Security Center as the active security provider, Defender Antivirus automatically enters passive mode. Real-time protection is suspended; scheduled scans stop; Defender does not interfere with the third-party product. Windows is correct in only running one real-time engine at a time — running two simultaneously causes kernel-driver conflicts and false positives. Our dedicated guide on running two antivirus together covers what specifically breaks if you try.

Limited Periodic Scanning (LPS). A separately configurable option (Windows Security → Virus & threat protection → Microsoft Defender Antivirus options → Periodic scanning) that lets Defender run periodic on-demand scans even while a third-party AV is the active engine. Microsoft's own documentation is explicit about its limits: LPS scans on a limited schedule and does not detect all threats a full real-time Defender instance would catch. From the Microsoft Defender Antivirus compatibility page: "Periodic scanning detects most malware, but does not protect against all threats — it provides limited protection against specific threats." Read that as: LPS is a backup, not a substitute.

The practical answer to "should I keep Defender on with my paid AV?": Defender is automatically off in real-time mode when your paid AV is active. You do not need to disable Defender manually — Windows handles it. LPS is optional and adds minimal marginal value if your paid AV is functioning normally. Turn LPS on only if you want a periodic second-opinion scan with a different signature set; turn it off if you don't need that extra check. Reference: Microsoft Learn — Defender Antivirus compatibility.

The honest takeaway. Installing a paid antivirus turns Defender into a passive backup. You're not getting "Defender plus paid AV detection" — you're getting paid AV detection with Defender as a quiet failsafe. If the paid AV's renewal price doesn't justify the bundle (VPN, password manager, identity monitoring), reverting to Defender alone gives you the same 18/18 AV-TEST score with zero subscription overhead. Our deeper "is Windows Defender good enough" analysis walks through the decision in detail.

Real-World Performance (Hands-On Testing)

We ran Defender 4.18 as the sole security product on a mid-range Windows 11 laptop (Intel i5-12450H, 16 GB DDR5, NVMe SSD) for a 7-day evaluation.

Idle footprint: MsMpEng.exe plus SecurityHealthService.exe used 95–180 MB RAM combined. CPU between scans essentially zero. Lighter than Norton (180–220 MB).

Full system scan: 21 minutes on 280 GB of data. CPU peaked at 28–38% — lighter than Norton 360 Deluxe (35–45%), close to Bitdefender (20–35%). Ran Chrome with 12 tabs, a Zoom call, and Spotify concurrently without stutter.

The MsMpEng.exe CPU-spike complaint. The most-cited Defender complaint on r/techsupport has been MsMpEng.exe burning 25–40% CPU. Still happens in May 2026 when Defender indexes a fresh developer toolchain, a large Steam install, or a multi-GB OneDrive sync. Fix: exclude known-safe developer folders (node_modules, .venv, Docker volumes, Steam Library) under Manage settings → Exclusions. Two minutes, hours saved later.

SmartScreen: flagged one unsigned open-source installer in the test week. "More info → Run anyway" is two clicks. No false positives on mainstream software.

Boot and gaming: 1–2 second boot delta vs Defender-disabled (Defender is part of Windows startup, not a separate service). Windows 11 focus-assist automatically defers scheduled scans during full-screen apps — no stutter across a week of gameplay testing.

AV-Comparatives’ April 2026 Performance Test runs Microsoft Defender as the no-third-party baseline rather than an awarded product, so there is no comparable impact figure to quote — but it still posts 18/18 (6/6 Performance) at AV-TEST February 2026.

Microsoft Defender on Mobile — Different Product, Same Brand

The "Microsoft Defender" branding covers two distinct products that confuse buyers. Here's the actual disambiguation:

What the personal mobile app actually is. A privacy and identity-monitoring tool with a Defender-branded UI. On Android it scans installed apps for known malicious patterns and provides Wi-Fi safety alerts — useful but functionally narrower than dedicated Android AV apps from Bitdefender or Norton. On iOS it can do even less because Apple sandboxing prevents file-system scanning; the iOS app provides Privacy Audit (review app permissions) and web protection. On macOS and Windows it's primarily a dashboard surface for the same security data Windows Security already shows.

The honest framing. If you ask "does Microsoft Defender protect my phone?" — the answer is "only with a paid Microsoft 365 subscription, and the protection is identity-monitoring-flavored rather than antivirus-flavored." For dedicated mobile antivirus, see our Android antivirus guide or iPhone antivirus guide. The Microsoft Defender personal app is a worthwhile add-on if you're already paying for 365 — it is not a reason to subscribe to 365 if you're not.

User Sentiment and Common Complaints

User sentiment in this section is paraphrased consensus from public sources between February and May 2026: Reddit (r/antivirus, r/techsupport, r/Windows10), Microsoft Q&A (learn.microsoft.com/answers), and the Microsoft Tech Community Defender forum. Specific named-user quotes are avoided; we surface complaints recurring across at least three independent sources.

Community sentiment on Defender has shifted more dramatically than on any other antivirus product since 2019. Being honest about that shift matters.

The 2019 consensus. On r/antivirus and r/techsupport in 2018–2019, the dominant advice was "Defender is better than nothing, install a real AV." Bitdefender and Kaspersky were the paid picks; Avast or Avira the free picks. Defender's AV-TEST scores were 16.5–17/18 with visible zero-day gaps.

The 2026 consensus. Flipped. The pinned answer in r/antivirus recommendation threads now reads, approximately: "For a single Windows 11 machine, Defender plus Malwarebytes Free plus good browsing habits is enough." Paid antivirus is now recommended for feature bundles (VPN, identity monitoring, parental controls) — not for detection gaps.

Why it shifted. Three factors. AV-TEST and AV-Comparatives results showing Defender catching up and matching paid products across 2022–2025. The "antivirus bloat" reputation dying — Defender is now one of the lightest options because it is part of Windows. And the Avast / AVG / Norton consolidation under Gen Digital, plus the Avast Jumpshot data-sale incident, pushing privacy-conscious users toward Bitdefender, ESET, or Defender.

The Defender + Malwarebytes pattern. Tech-support consensus: run Defender as real-time protection, add Malwarebytes Free for manual second-opinion scans. Malwarebytes Premium ($44.99/year) adds a real-time layer that coexists with Defender. See our Malwarebytes review for the breakdown.

Dissenting voices. Security pros on LinkedIn and X note that Defender's consumer UI gives minimal visibility into what is being caught, and logging controls outside Group Policy are limited. For users who want a clear activity log, Bitdefender or ESET are still better fits.

What nobody disputes in 2026. Paying for antivirus solely for "better detection than Defender" is no longer defensible. If you buy a paid suite, buy it for the bundle — not the engine.

Testing Limitations — What We Could and Couldn't Verify

Editorial transparency: this review draws on three categories of evidence and each has limits.

• Lab-test results we cite (AV-TEST February 2026, AV-Comparatives Real-World Protection Test 2025-2026) are reproduced from the labs' published reports. We did not run these scans ourselves — independent labs use sample sets and methodologies we do not replicate. We trust the numbers because they're peer-reviewed across the industry, but we don't claim independent verification.
• Hands-on numbers we report (CPU 28-38% during scans, MsMpEng.exe spike on dev folders, Tamper Protection enable path verification, SAC evaluation-mode confirmation on a Win 11 24H2 clean install) reflect our test rig (Intel i5-12450H, 16 GB DDR5, NVMe SSD, Win 11 Pro 24H2). Mileage varies by hardware, OS version, drivers, OEM-installed software.
• User sentiment is paraphrased consensus across multiple public threads in the last 90 days, not direct quotes from named individuals. We don't fabricate user quotes. When complaints appear sporadically (one or two threads), we don't elevate them to "common".

What we explicitly did NOT test: ransomware-rollback against in-the-wild encryptors (we don't intentionally execute ransomware on test hardware); the Microsoft Defender for Individuals personal mobile app feature set on iOS or Android (requires Microsoft 365 Personal subscription we don't carry); enterprise Group Policy admin behavior across domain configurations; Application Guard prior to its 24H2 sunset (deprecated, no current testing value); behavioral detection against zero-days from the most recent 14 days (signature databases need time to catch up — meaningful test window is older threats).

Who Should Stick With Defender — and Who Should Look Elsewhere

Stick with Defender if you are:

• A single-user Windows 11 household with one or two PCs, no identity-theft concerns, no need for a bundled VPN.
• Technically comfortable enough to turn on Controlled Folder Access, set exclusions for developer folders, and check Windows Security occasionally.
• Running Defender alongside Malwarebytes Free — the default community recommendation for free protection in 2026.
• Cost-sensitive. Free is unbeatable, and detection legitimately matches paid suites.
• Privacy-conscious about third-party telemetry. You already send telemetry to Microsoft by running Windows; adding Norton or Bitdefender adds a second vendor's stream.

Look elsewhere if you are:

• Multi-device with iPhones, Macs, or Android. Defender is Windows-only for consumers. Bitdefender Total Security or Norton 360 Deluxe cover all four platforms.
• Worried about U.S. identity theft. No dark-web monitoring, no SSN alerts, no restoration specialists. Norton 360 with LifeLock is the right product — see our Norton 360 review.
• A family with children online. Microsoft Family Safety exists but is less feature-rich than Norton or Bitdefender's parental suites.
• A non-technical user who wants one "green checkmark" dashboard across antivirus, VPN, password manager, backup, and identity. Defender requires you to assemble that yourself.
• Running Windows 7 or 8.1. Microsoft ended Defender definition updates on those platforms in 2023.

Which Defender Configuration Is Right for You?

Four configurations, four user types. Pick the one that matches your reality.

• Path A — Defender alone. Suitable for a Windows 11 user with sensible browsing habits, a patched OS, and no piracy/warez. AV-TEST February 2026 confirms 18/18 protection — same score as Bitdefender, Norton, Kaspersky. Action: enable Tamper Protection, turn on Controlled Folder Access for Documents/Desktop/Pictures, leave Smart App Control in evaluation mode. Free, complete, no subscription.
• Path B — Defender + Malwarebytes Free (on-demand only). Defender stays as primary real-time engine; Malwarebytes Free runs manual second-opinion scans for PUPs, adware, and tracking tools that Defender occasionally underemphasizes. No conflict (Malwarebytes Free has no real-time engine). Free combination. Recommended if you download installers from varied sources (forums, file-sharing, unsigned dev tools). See our safe-pairings guide for the technical detail.
• Path C — Defender + paid AV (Defender enters Periodic Scanning). Once you install Norton, Bitdefender, Kaspersky, or Malwarebytes Premium, Defender automatically drops to passive mode. The paid AV's real-time engine becomes primary. LPS (Limited Periodic Scanning) can be optionally re-enabled but adds limited marginal value — see the Periodic Scanning section above. Choose this path if you specifically want the paid AV's VPN, password manager, identity monitoring, or cross-platform coverage (Mac, iOS, Android) — not because Defender is inadequate.
• Path D — Paid suite only, Defender fully disabled (rare). Valid for enterprise managed environments or power users who prefer total separation. Requires Group Policy or registry change to fully disable Defender (Tamper Protection blocks casual disabling — that's by design). Not recommended for typical home users; risk of accidentally leaving both inactive after software changes.

Default recommendation for most users: Path A or Path B. Both are free, both cover the threat surface adequately for a single-user Windows 11 PC with normal browsing, and both leave money in your pocket for tools you actually need.

Microsoft Defender vs Bitdefender vs Malwarebytes

See full head-to-head: Defender vs Bitdefender  ·  Defender vs Malwarebytes (lab scores, pricing, features, performance, FAQ).

Three products at three price points — all defensible picks for different users.

The honest one-line picks: Defender alone if you want free protection on one Windows machine. Defender plus Malwarebytes if you want two engines looking at your PC at no cost (or $44.99 for Malwarebytes Premium real-time). Bitdefender Total Security if you want the full bundle, cross-platform coverage, and a single-dashboard experience — see our Bitdefender review for details.

Known Issues and Complaints

These are the friction points that come up consistently on r/techsupport, r/antivirus, and Microsoft's Answers forum in 2025–2026.

No bundled VPN. Norton 360, Bitdefender Premium Security, and McAfee+ all include unlimited VPN at top tiers. Defender does not include any VPN product.

No password manager. Microsoft Authenticator handles autofill but is Edge-only on desktop and far less feature-rich than 1Password or Bitwarden.

Group Policy required for real tuning. Attack-surface-reduction rules, scan-scheduling granularity, and exclusion inheritance live in Group Policy Editor (gpedit.msc) — only present on Windows Pro, Enterprise, and Education, not Home. Home users can use PowerShell Set-MpPreference cmdlets for most of the same controls, but only if they know those exist. The power is there; it is just hidden.

No consumer Defender on macOS, iOS, or Android. Microsoft Defender for Individual requires a Microsoft 365 subscription. If your household is mixed-OS, this matters.

Limited user-facing activity log. Windows Security shows recent threats and scan history but does not expose a detailed blocked-activity feed the way Norton or Bitdefender do. "Why did my PC block this at 3:42 p.m." often requires Event Viewer.

SmartScreen friction for unsigned indie software. Open-source installers, indie games from itch.io, and developer utilities routinely trigger "Windows protected your PC." Two clicks to override; annoying when you install niche software often.

OneDrive-only cloud backup. No dedicated antivirus-bundled backup. Norton's 50 GB cloud backup has no Defender equivalent.

Customer Support — What's Available

Microsoft does not offer phone or live chat support for the built-in Defender Antivirus on consumer Windows. This is the single biggest support gap vs paid suites — Norton and Bitdefender both staff 24/7 chat lines for billing or product questions; Defender doesn't have an equivalent. What's available instead:

• Microsoft Q&A — learn.microsoft.com/answers/tags/windows-defender — an indexed forum where Microsoft staff respond, often within 24 hours for routine questions. Best first stop for technical issues.
• Microsoft Tech Community — Microsoft Defender — techcommunity.microsoft.com/t5/microsoft-defender — product blog and discussion threads, includes deeper technical content from Microsoft engineers.
• In-product Get Help app — on Windows 11 type "Get Help" in Start, then search for "Windows Security". Routes to a chatbot that handles common questions; escalates to a human Microsoft support representative for Microsoft 365 subscribers.
• learn.microsoft.com primary documentation — the canonical reference for Tamper Protection, Smart App Control, compatibility with third-party AV, and Defender for Endpoint enterprise features. Outranks most third-party sites for feature-specific queries.
• Microsoft 365 subscribers get phone and chat through their subscription support channel — but that's subscription support, not Defender support specifically.

The honest framing: if you need real-time human support for your antivirus, paid suites (Norton, Bitdefender) staff phone lines that Defender doesn't. If you're comfortable with self-serve documentation and forum responses, Defender's support model is functional. For most home users it's adequate; for users who panic-call helpdesks, it's a real gap.

Frequently Asked Questions About Microsoft Defender

Is Defender enough alone in 2026?

For a typical single-user Windows 11 PC with sensible browsing habits, yes. Defender scored 18/18 at AV-TEST February 2026 — the same score Bitdefender, Norton, Kaspersky, and McAfee received. Community consensus on r/antivirus and r/techsupport shifted from "install a real AV" (2019) to "Defender is fine, optionally add Malwarebytes Free" somewhere around 2023, and has stayed there.

Is Microsoft Defender the same as Windows Security?

Not quite. "Windows Security" is the dashboard app where you manage security settings. "Microsoft Defender Antivirus" is the antivirus engine running behind that dashboard. The dashboard also surfaces firewall, account protection, and family safety — not all of those are Defender itself.

Should I add Malwarebytes on top of Defender?

Yes — specifically Malwarebytes Free as an on-demand second-opinion scanner. It does not run in real time (no conflict with Defender) but catches PUPs, adware, and tracking tools that Defender sometimes underemphasizes. For the deeper question of what breaks if you DO try to run two real-time engines together, see our guide on running two antivirus programs at once. Malwarebytes Premium ($44.99/year) adds a real-time layer designed to coexist with Defender. This layered approach is the default tech-support recommendation for free-or-cheap protection in 2026.

Does Defender protect against ransomware?

Yes, with a setting you turn on. Defender's Controlled Folder Access blocks unrecognized apps from modifying Documents, Desktop, and Pictures. Off by default (it can break legitimate apps that write to those folders). Enable: Windows Security → Virus & threat protection → Ransomware protection. Defender also includes cloud-based behavioral detection that catches ransomware patterns regardless of this setting.

Why does MsMpEng.exe use so much CPU?

MsMpEng.exe spikes when scanning a large, recently-changed folder — a freshly-cloned Git repo, a new Steam install, a OneDrive sync, or a node_modules directory. Fix: add exclusions for known-safe development paths under Manage settings → Exclusions. Never exclude Downloads or system directories.

Does Defender work on Windows 7 or 8.1?

No. Microsoft ended Defender definition updates for Windows 7 and 8.1 in January 2023. On legacy Windows you need a third-party antivirus that still supports the platform (ESET and Bitdefender do, in some tiers).

Is Microsoft Defender better than Norton?

Both scored 18/18 at AV-TEST February 2026 — tied on detection. On features Norton wins (LifeLock, unlimited VPN, 50 GB backup, password manager, parental controls). On price Defender wins (free vs $49.99). Pick Defender if you only need antivirus; Norton for the full bundle, especially in the U.S. for LifeLock.

Does turning off Defender help gaming performance?

Rarely worth it. Background CPU between scans is effectively zero on modern hardware, and Windows 11 focus mode defers scans during full-screen apps. Occasional MsMpEng.exe spikes are folder-specific and solved with exclusions. Disabling Defender entirely without a replacement leaves the machine unprotected.

Best-of guides where this product appears: Best Free Antivirus  ·  Best Antivirus for Windows 11 / 10.

What is Tamper Protection in Defender?

Tamper Protection is Defender's anti-uninstall security layer. Default-on since Windows 10 19H1 (May 2019), it blocks external changes to Defender's registry keys, services, and security policies — preventing malware (or careless software) from disabling the antivirus from underneath you. Verify it's on at Windows Security → Virus & threat protection → Manage settings → Tamper Protection. The "grayed out" state is intentional on domain-joined machines managed by Group Policy or Intune.

Does Windows 11 have Smart App Control?

Yes, Smart App Control (SAC) ships in Windows 11 22H2 and later, with significant improvements in Windows 11 24H2 (October 2024). SAC blocks unsigned or low-reputation executables at the kernel level. Important caveat: SAC requires a clean Windows 11 install — users who upgraded from Windows 10 or earlier Win 11 versions get SAC stuck in evaluation mode. Once turned off, SAC can only be re-enabled by reinstalling Windows.

What happens to Defender when I install Norton or Bitdefender?

Defender automatically drops to passive mode and stops real-time scanning. The paid AV's engine becomes the active security provider. This is correct behavior: running two real-time AV engines simultaneously causes conflicts. Limited Periodic Scanning (LPS) is a separately configurable option that runs Defender on a periodic schedule even in passive mode, but Microsoft's own documentation notes LPS misses most threats compared to full real-time Defender. See the Periodic Scanning section for the full breakdown.

Final Verdict — Is Microsoft Defender Enough

Yes, for most single-user Windows 11 households. Microsoft Defender's 18/18 at AV-TEST February 2026 matches every paid product in the top tier on detection. If all you need from antivirus is antivirus — scan files, block threats, update automatically, no second-engine conflict, no upsell modals — Defender does that at zero cost. Anyone still saying Defender is “not real antivirus” in 2026 is working from 2019 information. The trade-offs are real and worth naming up front: no cross-platform coverage (Windows-only, no Mac / iOS / Android in the same license), no bundled VPN or password manager, no identity monitoring, and no ransomware rollback. The free-or-cheap layered recommendation in 2026 is Defender + Malwarebytes Free for on-demand second-opinion scans + sensible browsing habits — the r/antivirus and r/techsupport default for the past three years — and it genuinely suffices for typical home use.

The free-or-cheap layered recommendation in 2026: Defender + Malwarebytes Free (manual on-demand) + sensible browsing habits. That is the r/antivirus / r/techsupport default and it genuinely suffices for typical home use. Malwarebytes Premium ($44.99/year) adds a real-time layer that coexists with Defender.

When to pay for a full suite instead. Four situations: (1) multi-OS household needing cross-platform coverage, (2) identity-theft restoration service like LifeLock, (3) bundled VPN and password manager in one subscription, (4) family with parental-control needs across multiple child devices. In all four, Bitdefender Total Security or Norton 360 Deluxe fit better than assembling the stack around Defender.

For May 2026, Microsoft Defender is our top free pick and the baseline every paid product has to justify its price against. Turn on Controlled Folder Access, add Malwarebytes Free, and for most people that is the entire security stack — at no cost.