EDR (Endpoint Detection and Response) watches what processes are doing on your devices in real time, rather than only checking which files exist. It catches attacks that don't use recognisable malicious files, which is most modern attacks.

What is Attack Surface Reduction?

A set of rules that disable specific Windows features attackers commonly exploit - like Office macros running scripts or executable files launching from email attachments. Fewer open doors means fewer ways in.

Why Antivirus Isn't Enough - And What Microsoft Defender for Business Actually Does

Why the old model fails

Traditional antivirus works by comparing files against a database of known threats. It scans files as they arrive and blocks the ones it recognises.

The problem: modern attacks don't use files your antivirus has seen before. The attacks actually being used against small businesses in Israel and across Europe in 2026:

Phishing links that redirect to fake login pages - no malicious file involved

Hijacked legitimate Windows processes - Windows' own tools run malicious commands

Valid stolen credentials - an attacker logs in normally; antivirus sees nothing suspicious

Time-delayed links - a URL in an email appears safe when delivered, redirects to malware 12 hours later

None of these involve a recognisable malicious file. None of them trigger traditional antivirus. All of them are routine in 2026.

What Microsoft Defender for Business actually does

Defender for Business - included in Microsoft 365 Business Premium - is a different category of tool. It does not scan files against a database. It monitors the behaviour of every process on every managed device, correlates signals across your entire environment, and responds automatically when something looks wrong.

Capability	What it does	What it stops
Endpoint Detection & Response (EDR)	Monitors process behaviour on every device in real time	Fileless malware, lateral movement, living-off-the-land attacks
Safe Links	Re-checks every URL at the moment of click	Time-delayed phishing links that change after email delivery
Safe Attachments	Opens file attachments in a sandboxed environment first	Malicious Office files and PDFs
Attack Surface Reduction	Blocks Windows features that attackers commonly exploit	Office macro exploits, script-based attacks
Automated Investigation	Follows a threat across multiple devices automatically	Limits breach scope before a human can respond

The practical difference for a small business

Without EDR: You find out about a breach when something stops working - files are encrypted, an invoice was redirected, or a client calls to say they received a suspicious email from you. By then, the attacker has had hours or days inside your systems.

With Defender active: You see the attack at the reconnaissance stage - an unusual login from an unexpected location, a process accessing more files than it should, a device attempting to connect to a known malicious IP. The difference between catching a threat at stage 1 vs stage 5 is typically €10,000-€50,000 in recovery costs.

When Defender detects a compromised device, it automatically:

Isolates the device from the network while keeping it manageable via Intune

Kills the malicious process and quarantines affected files

Investigates which other devices the threat may have reached

Generates a full incident report for insurance and regulatory purposes

For a 10-person business with no dedicated security staff, this is the equivalent of having a security analyst watching your systems continuously.

What "included in M365 Business Premium" means in practice

Defender for Business is included in Microsoft 365 Business Premium at approximately €22/user/month. For a 10-person team, that is €220/month for email, Teams, Office apps, Intune device management, and enterprise-grade EDR.

Standalone EDR tools from dedicated security vendors typically cost €15-30 per device per month on top of your productivity suite. Getting the same capability bundled into M365 Business Premium is one of the clearest cost advantages of that tier.

The configuration gap most businesses miss

Defender at default settings leaves roughly 40-60% of its protection capability disabled. A business that "has Defender" but has not configured it properly gets a fraction of the actual protection. The configuration that matters:

Attack surface reduction rules enabled - blocks Windows features most commonly exploited in SMB attacks

Cloud-delivered protection set to maximum - enables real-time sharing with Microsoft's global threat intelligence network

Automated investigation and remediation set to Full - allows Defender to respond without waiting for human approval

Tamper protection enabled - prevents malware from disabling Defender itself

Microsoft Secure Score baseline applied - brings all settings to Microsoft's recommended minimums for business use

Cookie Privacy