Microsoft Defender Review 2026: Is Windows Defender Enough?

Microsoft Defender at a glance

Windows Defender is now called Microsoft Defender Antivirus. It is the antivirus built into Windows 11 and Windows 10, and you manage it in the Windows Security app ^[1]. It is free, it is on by default, and it updates through Windows Update ^[1].

There is also a second, separate product with almost the same name: the Microsoft Defender app. That app comes with a paid Microsoft 365 Personal, Family or Premium subscription and covers Windows, macOS, Android and iOS from one dashboard ^[3]. This review covers both, and explains which one you actually need.

In short: the built-in antivirus is good enough for most home users in 2026. It scored 6 out of 6 for protection in every AV-TEST home user test since October 2024 ^[5], and it earned the top ADVANCED+ award in AV-Comparatives' main consumer tests in 2026 ^[6][7]. What it lacks are the extras that paid suites bundle, and it slows some everyday tasks a little more than the lightest products.

• Best for: Windows 11 and Windows 10 users who want solid, free protection without extra software.
• Maker: Microsoft. The antivirus is part of Windows; the cross device app is part of Microsoft 365 ^[1][3].
• Price: the antivirus is free. The Defender app needs Microsoft 365 Personal ($99.99 a year in the US), Family ($129.99) or Premium ($199.99) ^[3].
• Lab results: AV-TEST Top Product in August 2026 with 6 for protection, 5.5 for performance and 6 for usability ^[5].
• Our score: 8.7 out of 10.

How we reviewed it and how we earn money

Our first Windows Defender review covered the old anti-spyware tool for Windows XP and Vista. Its screenshots, shown later on this page, date from 2006. That page was republished in 2021 with little change, so most of its verdict no longer fit the product.

For this October 2026 rewrite we checked every feature against Microsoft Support pages and the Microsoft 365 product page. For detection we used the published results of the two largest independent labs, AV-TEST and AV-Comparatives. Each source is listed at the bottom with the date we read it.

We have no deal with Microsoft and earn nothing from this review. 2-spyware earns a commission only from partner products that we name as partners on this page. That does not change the score below.

What is Microsoft Defender in 2026?

The name covers several products, which is the main source of confusion. For a home user, two of them matter.

Microsoft Defender Antivirus (the old Windows Defender)

This is the antivirus engine inside Windows 11 and Windows 10. It scans files and programs as you open or run them, checks downloads, and runs scheduled scans ^[1]. You see it as the Virus & threat protection page of the Windows Security app. Microsoft notes that Windows Security was formerly known as Windows Defender Security Center ^[3].

You do not download or buy it. It comes with Windows and turns itself off on its own if you install a compatible antivirus from another company ^[1].

The Microsoft Defender app for Microsoft 365

This is a separate app that Microsoft launched in 2022 for Microsoft 365 Personal and Family subscribers. Today it also works with Microsoft 365 Premium ^[3]. It gives you one dashboard for the security of your phones and computers, and in the US it adds identity theft and credit monitoring ^[3].

On Windows, the app does not bring its own antivirus. Microsoft says plainly that on Windows the antivirus and anti-phishing protection is provided by Windows Security, while the app adds identity theft monitoring ^[3]. On a Mac and on Android, the app does include antivirus ^[3].

What changed in 2025

Microsoft removed the privacy protection VPN from the Defender app on February 28, 2025 ^[4]. Microsoft says the app still provides device protection, identity theft and credit monitoring in the US, and threat alerts ^[4]. If you used the Defender VPN on Android, you have to remove its VPN profile yourself ^[4].

You may still see a VPN entry from Defender on some devices. Microsoft explains that this is a local loop back VPN used for web protection, not the removed privacy feature ^[4].

Protection features of Microsoft Defender Antivirus

Most of what you need is in two places in the Windows Security app: Virus & threat protection, and App & browser control. Here is what each feature does and where you find it.

Real-time protection

Real-time protection scans files and programs as they are accessed or run, and stops threats before they can cause harm ^[1]. You find the switch under Virus & threat protection, then Manage settings ^[1].

You can turn it off for a short time, but Windows turns it back on automatically after a while ^[1]. If you only need to skip one file or folder, Microsoft recommends an exclusion instead, since that is safer than turning protection off ^[1].

Cloud-delivered protection and sample submission

Cloud-delivered protection lets Defender get constant updates from Microsoft while you are online, which Microsoft says gives more accurate detection ^[1]. Automatic sample submission sends suspicious files to Microsoft for a check ^[1].

The cloud part matters a lot. In AV-Comparatives' March 2026 malware test, Defender detected 89.2% of samples offline and 98.1% online ^[7]. Leave cloud-delivered protection on unless you have a strong reason to turn it off.

Tamper protection

Tamper protection stops malicious apps from changing key Defender settings, such as real-time and cloud-delivered protection ^[1]. You can still change those settings yourself in the Windows Security app if you are an administrator ^[1]. To turn real-time protection off, you first have to turn tamper protection off ^[1].

This matters because many malware families try to switch the antivirus off before they do anything else. Keep tamper protection on.

Controlled folder access (ransomware protection)

Controlled folder access blocks unknown or untrusted apps from changing files in protected folders ^[1]. By default it protects Documents, Pictures, Videos, Music and Desktop, and you can add more folders ^[1]. It is off by default on most home PCs, so you have to switch it on under Virus & threat protection, then Manage ransomware protection ^[1].

The trade off is false blocks. A legitimate app that saves files into a protected folder may be stopped, and you then allow it under Allow an app through Controlled folder access ^[1]. The same page links to OneDrive for ransomware data recovery, so you can restore files from a cloud copy ^[1].

SmartScreen and potentially unwanted app blocking

Under App & browser control, Reputation-based protection holds Microsoft Defender SmartScreen ^[2]. Check apps and files rates the reputation of programs and files you download ^[2]. SmartScreen for Microsoft Edge warns you about known phishing sites, tech support scams and suspicious downloads ^[2].

Potentially unwanted app blocking stops apps that are not malware but show ads, mine cryptocurrency or do other things you do not want ^[2]. Bundled installers, toolbars and fake system optimizers fall in this group. Our article on potentially unwanted apps being blocked explains how Microsoft changed this setting over the years.

On Windows 11 you also get phishing protection for the password you use to sign in to Windows ^[2]. It warns you if you type that password into a malicious site or app, reuse it elsewhere, or type it into Notepad or Word ^[2]. This feature is not available on Windows 10 ^[2].

Smart App Control and exploit protection

Smart App Control blocks apps that are malicious or untrusted, using cloud intelligence to predict whether an app is safe ^[2]. It only works on new Windows 11 installs. If you got it through an update on an existing PC, you cannot turn it on without a reset or reinstall ^[2]. It first runs in evaluation mode, during which it blocks nothing ^[2].

Exploit protection applies system wide mitigations that make software bugs harder to abuse ^[2]. It is already on with settings that suit most people, and few home users need to change it ^[2].

Microsoft Defender Offline scan

Some malware hides while Windows is running. The offline scan restarts the PC and scans it in the Windows Recovery Environment, without loading Windows, so persistent malware has a harder time hiding ^[1]. The PC restarts again when the scan ends, and you see the results under Protection history ^[1].

You start it from Virus & threat protection, then Scan options, then Microsoft Defender Antivirus (offline scan) ^[1]. Save your open files first. Our step by step guide shows how to run a Microsoft Defender Offline scan.

Scans, exclusions and Dev Drive

Besides the offline scan you get the usual three manual scans: Quick, Full and Custom ^[1]. A quick scan checks the places malware usually sits; a full scan checks every file and program; a custom scan checks the files and folders you choose ^[1].

Exclusions can cover a file, a folder, a file type or a process ^[1]. They apply only to real-time scanning, so scheduled scans may still check those items ^[1]. On Windows 11, developers can also use Dev Drive protection, which scans a Dev Drive asynchronously to cut delays ^[1].

Lab results: AV-TEST and AV-Comparatives

The old version of this review said Defender often fails to detect Trojans, backdoors and worms. That was fair for the early anti-spyware tool and for Microsoft's weak years. It is not true of the product you get today.

AV-TEST

AV-TEST tests home antivirus products every two months on Windows. In August 2026, Microsoft Defender Antivirus 4.18 scored 6 out of 6 for protection, 5.5 for performance and 6 for usability on Windows 11, and received the Top Product award ^[5]. June 2026 had the same scores, and April and February 2026 were a perfect 6, 6 and 6 ^[5].

The long view is more telling. From 2013 to mid 2015, Microsoft's free antivirus scored between 0 and 2 points for protection, the weakest in the field ^[5]. It reached 6 points for the first time in December 2017 and has stayed at 5.5 or 6 since then ^[5]. It has scored 6 in every test since October 2024 ^[5].

AV-Comparatives

In AV-Comparatives' Real-World Protection Test for February to May 2026, Microsoft blocked 396 of 400 live attacks, a protection rate of 99.0% ^[6]. The top product reached 99.8% ^[6]. Microsoft had zero false positives, the lowest of all 20 products, and received the top ADVANCED+ award ^[6].

In the Malware Protection Test of March 2026, Defender reached an online protection rate of 99.93% against about 10,000 samples, with 7 samples compromising the system ^[7]. It had 3 false alarms, the second lowest in the test, and again received ADVANCED+ ^[7].

What this means for you: Defender's detection is now on par with paid antivirus products. The gap between it and the top scorer is a fraction of a percent. Its very low false positive count also means fewer legitimate programs get blocked by mistake.

Performance: does Defender slow down your PC?

A little, in some tasks. AV-TEST gave Defender 6 out of 6 for performance in most of its 2025 and early 2026 tests, and 5.5 in June and August 2026 ^[5]. A 5.5 still sits in the good range, but some paid products score a full 6 in the same test.

In AV-Comparatives' separate performance tests in recent years, Defender has usually placed in the lower half of the field. The usual causes are slower file copying and slower installation of new programs while real-time scanning runs. On a modern PC with an SSD you are unlikely to notice this in daily use.

Full scans are where you feel it most. A full scan checks every file on the disk ^[1], which can take an hour or more on a large drive and keeps the disk busy. Our 2006 tests timed a quick scan at under three minutes and a full scan at almost an hour on hardware of that era.

If Defender slows a specific folder you trust, such as a game library or a build folder, add a folder exclusion rather than turning protection off ^[1]. Developers on Windows 11 can put code on a Dev Drive with performance mode instead ^[1].

Privacy: what Defender sends to Microsoft

Like every modern antivirus, Defender relies on the cloud, and that means some data leaves your PC. Here is what Microsoft documents.

• Cloud-delivered protection sends information about suspicious files and behaviour to Microsoft so it can rate them ^[1].
• Automatic sample submission sends the suspicious files themselves. Microsoft says it will alert you if a requested file contains personal information, so you can decide whether to send it ^[1].
• Phishing protection on Windows 11 can collect information such as displayed content, sounds and app memory from a site or app it finds suspicious, when you type your Microsoft account password there ^[2].
• Identity theft and credit monitoring in the Defender app uses data stored by Experian. Microsoft says it does not store this personal information, and that it is not sold or shared with third parties ^[3].

You control the first two under Virus & threat protection, then Manage settings ^[1]. Turning off sample submission is a reasonable choice if you handle sensitive files and still want cloud lookups. Turning off cloud-delivered protection costs detection, as the offline test results above show ^[7].

For most people the trade is fair. Defender is already part of Windows, so you add no new company to the list of those who see your data. A third party antivirus adds its own cloud service and its own privacy policy.

Price: what is free and what you pay for

Microsoft Defender Antivirus is free. It needs no account, no licence key and no subscription, and there is nothing to cancel ^[1].

The Microsoft Defender app is not sold on its own. You get it with a Microsoft 365 Personal, Family or Premium subscription, which also includes the Office apps, cloud storage and Copilot features ^[3]. If you are not a subscriber, the app asks you to buy a plan when you sign in ^[3]. US prices on Microsoft's page in October 2026 were:

The subscriptions renew automatically unless you cancel in your Microsoft account ^[3]. Microsoft offers a free trial, and the identity theft and credit monitoring features work only in the United States and US territories ^[3]. Prices and availability differ in other countries.

Is the app worth paying for? Only if you want the other parts of Microsoft 365 anyway, or if you want antivirus for a Mac or Android phone in the same dashboard. Nobody should buy Microsoft 365 just to get better protection on a Windows PC, because the Windows protection is the same either way ^[3].

Installation, setup and removal

Microsoft Defender Antivirus

There is nothing to install on Windows 11 or Windows 10. To check that it runs, open Start, type Windows Security, and open the app. The Virus & threat protection page should show no actions needed ^[1]. To update it by hand, go to Virus & threat protection, then Protection updates, then Check for updates ^[1].

You cannot uninstall Defender Antivirus, since it is part of Windows. When you install a compatible antivirus from another company, Defender turns itself off automatically and the other product takes over ^[1]. If you later remove that product, Windows turns Defender back on.

Five settings are worth checking once:

1. Real-time protection: on (Virus & threat protection, then Manage settings) ^[1].
2. Cloud-delivered protection: on ^[1].
3. Tamper protection: on ^[1].
4. Potentially unwanted app blocking: on, with both Block apps and Block downloads ticked (App & browser control, then Reputation-based protection settings) ^[2].
5. Controlled folder access: on if you keep important files on this PC and can handle an occasional blocked app (Manage ransomware protection) ^[1].

Microsoft Defender app

The app needs Windows 10 version 19041 or later, macOS 11 or later, iOS 14 or later, or Android 8.0 or later ^[3]. You download it from Microsoft's Defender page or your device's app store and sign in with the personal Microsoft account that holds your Microsoft 365 subscription ^[3].

On Windows you remove it like any other app, under Settings, then Apps, then Installed apps. Removing the app does not remove or weaken Defender Antivirus, which stays part of Windows.

The history: from 2006 anti-spyware to full antivirus

The product our old review tested was a different program. Windows Defender started as a free anti-spyware tool for Windows XP and came built into Windows Vista. It looked for spyware, adware and browser hijackers, not for viruses in general. The screenshots below come from our 2006 test of that version.

That early tool showed a scan report with alert levels, such as High and Severe, and an action for each item. It caught common adware of the time, like SurfSideKick and Look2Me. It did not protect you against viruses, which is why our old review said you needed a separate antivirus next to it.

The old review also praised a tool called Software Explorer, which listed startup programs, running apps and network connections. That tool was removed in later versions of Windows. Today you find startup apps in Task Manager and in Settings, under Apps, then Startup.

In Windows 8, Windows Defender became a full antivirus, taking the role of Microsoft Security Essentials. Its protection was weak for several years, as the AV-TEST chart above shows ^[5]. The control panel was renamed Windows Defender Security Center and later Windows Security ^[3], and the antivirus became Microsoft Defender Antivirus. From late 2017 the lab scores reached the top group and stayed there ^[5].

So two claims from the old page are out of date. You no longer need a genuine Windows check to install it, because it comes built in. And it no longer misses widespread Trojans and worms; it blocks them at the same rate as leading paid products ^[6][7].

When you need something extra

Defender covers the core job well. Still, there are situations where a second tool or a different product makes sense.

• A second opinion scan. If you suspect Defender missed something, a portable scanner with no conflict works well. Microsoft's own Microsoft Safety Scanner uses the same detection data, so a different engine such as SpyHunter gives a more independent look.
• Damage repair. Removing malware does not restore broken Windows settings, damaged system files or a slow PC. A repair tool such as Fortect, our partner, handles that kind of clean up; see our Fortect review.
• Web protection in other browsers. SmartScreen warnings for websites are built into Microsoft Edge ^[2]. In Chrome or Firefox you rely on the browser's own safe browsing checks.
• Mac and phone protection. Defender Antivirus is Windows only. For a Mac, the Defender app or a Mac product such as Intego or Combo Cleaner fills the gap.
• Extras. Defender has no VPN since February 2025 ^[4], no password manager and no parental controls inside the antivirus. Paid suites bundle those features.

If you suspect an infection, start with a full scan and then an offline scan in Windows Security ^[1]. If problems stay, our Windows help forum is free, and you can check a suspicious link with our link check before you open it.

Pros and cons

Pros

• Free and built into Windows 11 and Windows 10, with no account or ads ^[1].
• Top protection in 2026: 6 of 6 at AV-TEST and ADVANCED+ at AV-Comparatives ^[5][6][7].
• Very few false positives: zero in the Real-World test of February to May 2026 ^[6].
• Tamper protection, ransomware protection and an offline boot scan included ^[1].
• PUA blocking, SmartScreen and Smart App Control in the same app ^[2].
• Updates through Windows Update with no upsell inside the product ^[1].

Cons

• Slightly heavier on everyday tasks than the lightest antivirus products ^[5].
• Detection drops clearly without internet: 89.2% offline against 98.1% online ^[7].
• Controlled folder access is off by default and can block legitimate apps ^[1].
• Website warnings work best in Microsoft Edge ^[2].
• No VPN, password manager or parental controls inside the antivirus ^[4].
• Confusing naming: the paid Defender app does not add antivirus on Windows ^[3].

Verdict: is Microsoft Defender good enough?

Yes, for most home users. The Microsoft Defender Antivirus in Windows 11 and Windows 10 is a real antivirus with lab results that match paid products ^[5][6][7]. It costs nothing, nags you about nothing, and protects you from the day you set up Windows.

Turn on PUA blocking and consider Controlled folder access, keep cloud protection and tamper protection on, and you have a strong base ^[1][2]. Add a second opinion scanner when something seems wrong, and a repair tool if malware left Windows damaged.

The Microsoft Defender app is a different decision. It makes sense if you already pay for Microsoft 365 and want one view of your family's Windows PCs, Macs and phones, or US identity monitoring ^[3]. It does not make your Windows PC safer than the free antivirus already does ^[3].

We give Microsoft Defender 8.7 out of 10. It loses points for the small performance cost, its reliance on the cloud and the lack of extras, not for protection.