Microsoft Defender Antivirus

Microsoft Defender Antivirus is the antivirus built into Windows 10 and 11, part of the Windows Security app. It comes with Windows at no extra cost, turns on by itself when no other antivirus is installed, and is made by Microsoft, a company in Redmond, Washington. It runs only on Windows; Microsoft’s app with antivirus for Mac and Android is a separate product that needs a Microsoft 365 subscription.

In 2026 tests it scored the full 6 out of 6 for protection at AV-TEST and blocked 99.0% of real-world attacks and 99.89% of malware samples in two AV-Comparatives tests, though it raised many false alarms in one of them. Its checks send file details and some files to Microsoft by default, and a Defender health report is part of the Windows data that home editions cannot switch off.

How the protection built into Windows compares with what macOS, Android and iPhone ship with is covered in Do You Need an Antivirus?

Lab Results

AV-TEST has tested Defender on Windows every two months since 2013. In May–June and July–August 2026 it blocked 100% of 0-day attacks and 100% of the reference set of widespread malware, against an industry average of 99.9% for 0-day attacks, and it scored 6.0 for protection in every round from October 2024 to August 2026. The July–August round had no false warnings or false detections.

AV-Comparatives has included Microsoft in its main test series since 2007. In the real-world test from February to May 2026, which uses malicious websites and downloads, Defender blocked 396 of 400 attacks, a 99.0% protection rate in the top group, with no false positives, and received the top ADVANCED+ award. In the September 2026 malware test it blocked 9,989 of 10,000 samples, a 99.89% protection rate, also in the top group, but it had 28 false alarms, which the lab calls “very many”, and its award was STANDARD, the third of four levels. Without a connection to Microsoft’s cloud it detected 82.2% of the samples in that test, against 95.5% online.

These lab results cover Windows, the only system this antivirus runs on.

What the Software Sends to Microsoft

Defender checks files on the computer first. When it cannot decide about a file, cloud-delivered protection, which is on by default, sends the file’s details to Microsoft: hashes of the file, its name and size, who signed it, the process that opened it, the address and IP it was downloaded from, a hashed file path, and the computer’s Windows version, locale and geographical location. Microsoft’s documentation says this metadata contains no personal data and that file names are hashed. If the details are not enough, Microsoft can ask for the file itself: by default Defender sends program files such as .exe and .dll automatically and asks you first when a file is likely to contain personal information. This cloud scanning can upload files.

In Windows Security, under the virus and threat protection settings, you can switch off automatic sample submission or cloud-delivered protection. Microsoft’s documentation says the metadata of detections is still sent when sample submission is off, and that switching off sample submission also stops a check that holds new files until the cloud returns a verdict. Microsoft’s privacy statement adds that Defender sends reports about suspected malware while it runs, and that you can disable that reporting.

Windows also sends telemetry, which it calls diagnostic data, stored with identifiers that can recognise a user on a device. Its required level includes a Defender health event with the app and engine versions, the state of real-time protection and a Defender machine ID. On Windows Home and Pro you can choose not to send optional diagnostic data, but the required level cannot be switched off; only Enterprise, Education and Server editions have that option.

Data Use and Jurisdiction

Microsoft’s privacy statement says it uses required diagnostic data to keep Windows secure and up to date and to improve Windows. If you turn on the Windows setting Personalized offers, Microsoft also combines diagnostic data with your account information to show tips, ads and recommendations. The statement says the SmartScreen checks that Windows Security runs on websites and downloads are used for security purposes only, but it says nothing similar about Defender’s own malware reports, so Defender’s data use is not stated to be limited to protection.

Microsoft Corporation in Redmond, Washington, is the data controller, so U.S. law applies; for Europe, the UK and Switzerland it is Microsoft Ireland Operations Limited in Dublin. The statement says Microsoft discloses personal data to comply with valid legal process, including requests from law enforcement and government agencies. Microsoft is a public company. Its antivirus began in 2009 as Microsoft Security Essentials and was renamed Microsoft Defender Antivirus in 2020.

Audits and Vulnerabilities

There is no published independent security audit of Defender’s consumer antivirus. Microsoft’s dedicated Defender bug bounty covers only its business services, but its Windows bounty program pays for flaws in components shipped with Windows and lists the Defender sandbox among eligible targets.

Microsoft publishes flaws in Defender’s scanning engine as CVEs, and several appeared in 2026. One of them, CVE-2026-41091, lets an attacker who already has access to the computer gain higher privileges; it was published on 20 May 2026 and the U.S. Cybersecurity and Infrastructure Security Agency listed it the same day as exploited in attacks. It is fixed in engine version 1.1.26040.8. Another privilege flaw, which Microsoft’s record says was publicly referred to as “RoguePlanet”, was published on 16 June 2026 and is fixed in version 1.1.26060.3008.

What Is Included

The Windows Security app combines Defender’s real-time and scheduled scans, an offline scan that runs before Windows starts, Controlled folder access against ransomware, tamper protection, SmartScreen checks of websites and downloads, and the Windows Firewall. There is no VPN, password manager or identity monitoring, so it is not a bundled security suite.

Prices

Defender is included in Windows and is not sold separately, so on Windows it is a full free tier with nothing held back for a paid plan. The Microsoft Defender app for Mac, Android and iPhone requires a Microsoft 365 subscription: Personal costs $99.99 a year, Family $129.99 and Premium $199.99. On a Windows PC that app adds identity monitoring and leaves the antivirus to Windows Security.

Pros and Cons

• Full 6.0 AV-TEST protection score on Windows in every round from October 2024 to August 2026
• 99.0% protection rate with no false positives and an ADVANCED+ award in AV-Comparatives' February to May 2026 real-world test
• Built into Windows at no extra cost and turns on by itself when no other antivirus is installed
• Microsoft documents which file details the cloud check sends, and lets you switch off sample submission

• Windows diagnostic data that includes a Defender health report cannot be switched off on Home and Pro
• File details and program files go to Microsoft by default
• 28 false alarms and a STANDARD award in AV-Comparatives' September 2026 malware test
• No independent audit of the product, and an engine flaw that CISA lists as exploited in attacks, fixed in May 2026
• Runs only on Windows; Mac and phone protection needs a paid Microsoft 365 plan

Our Rating

Defender suits Windows users who want lab-tested protection without paying or installing anything, and who accept that Windows sends Microsoft diagnostic data they cannot fully switch off. It does not suit people who want an antivirus that keeps file checks on the device by default, or who need protection for a Mac or phone without a Microsoft 365 subscription.

• Protection Quality9.0/10

  AV-TEST gave Defender the full 6.0 for protection in every Windows round from October 2024 to August 2026, with 100% against 0-day attacks in May to August 2026. AV-Comparatives measured 99.0% in its February to May 2026 real-world test, in the top group with an ADVANCED+ award, and 99.89% in its September 2026 malware test, also in the top group. In the malware test it had 28 false alarms, and its award there was STANDARD, the third of four levels.

• Privacy & Data Practices4.5/10

  Cloud-delivered protection and automatic sample submission are on by default, so file metadata, download addresses and executable files go to Microsoft, with a prompt only for files likely to hold personal data. A Defender health event with a machine ID is part of the Windows diagnostic data that Home and Pro editions cannot switch off. Microsoft uses that data to improve Windows and, if you turn on Personalized offers, for ads and recommendations. Microsoft is in the United States and answers legal requests from government agencies. No case of the antivirus's data being sold or leaked has been documented.

• Usability & System Impact7.0/10

  Defender is already running on Windows and turns itself off when another antivirus is installed. AV-TEST gave 5.5 for performance in its two latest rounds and 6.0 for usability. AV-Comparatives' September 2026 performance test put its system impact eleventh of 20 products. It had no false positives in that lab's real-world test but 28 false alarms in its malware test. There is no version of this antivirus for Mac or phones.

• Transparency & Verifiability5.5/10

  There is no published independent audit of the product. Microsoft documents which metadata fields the cloud check sends and lists the Defender events in Windows diagnostic data. Bugs in Defender count in the Windows bug bounty program, and Microsoft publishes engine vulnerabilities as CVEs, including one that CISA lists as exploited in attacks and that was fixed in May 2026.

• Price & Value9.0/10

  Defender costs nothing beyond Windows itself and has no paid tier on Windows. Protection for a Mac or phone needs the separate Microsoft Defender app, which comes only with a Microsoft 365 subscription from $99.99 a year.

Overall7.0/10

Protection Quality 30% · Privacy & Data Practices 25% · Usability & System Impact 20% · Transparency & Verifiability 15% · Price & Value 10%

See our rating methodology →