Why the old model fails
Traditional antivirus works by comparing files against a database of known threats. It scans files as they arrive and blocks the ones it recognises.
The problem: modern attacks don't use files your antivirus has seen before. The attacks actually being used against small businesses in Israel and across Europe in 2026:
- Phishing links that redirect to fake login pages - no malicious file involved
- Hijacked legitimate Windows processes - Windows' own tools run malicious commands
- Valid stolen credentials - an attacker logs in normally; antivirus sees nothing suspicious
- Time-delayed links - a URL in an email appears safe when delivered, redirects to malware 12 hours later
None of these involve a recognisable malicious file. None of them trigger traditional antivirus. All of them are routine in 2026.
Signature-based antivirus vs EDR, in neutral terms
This distinction matters regardless of which vendor you end up buying from:
- Signature-based antivirus (the old model) compares each file against a list of known-bad fingerprints. If the file is not on the list, it is allowed. It is a file-centric, list-driven control.
- EDR - Endpoint Detection and Response (the modern model) records what processes actually do on the device - what they launch, what they read, where they connect - and flags or reverses behaviour that matches known attacker techniques, whether or not a file is involved. It also keeps a timeline so you can answer "what else did this touch?" after the fact.
The techniques EDR is built to catch are catalogued publicly in the MITRE ATT&CK framework - credential dumping, living-off-the-land use of built-in Windows tools, lateral movement[1]. Almost none of them require the attacker to drop a file that a signature engine would recognise.
And this is not a "trust Microsoft" argument. Independent labs test endpoint products against live malware every month and publish the raw results: AV-TEST's certification rounds[2] and AV-Comparatives' Real-World Protection tests[3] both consistently place Microsoft Defender in the top tier for protection rate. Check the current round yourself before you buy anything - including this.
It is worth being specific about how incidents actually begin, because it decides where the money goes. In Sophos's 2026 ransomware survey, malicious email and phishing together accounted for half of all incidents.
That is the case for treating endpoint protection and email protection as one decision rather than two purchases.
What Microsoft Defender for Business actually does
Defender for Business - included in Microsoft 365 Business Premium for up to 300 users[4] - is a different category of tool. It does not scan files against a database. It monitors the behaviour of every process on every managed device, correlates signals across your entire environment, and responds automatically when something looks wrong.
The practical difference for a small business
Without EDR: You find out about a breach when something stops working - files are encrypted, an invoice was redirected, or a client calls to say they received a suspicious email from you. By then, the attacker has had hours or days inside your systems.
With Defender active: You see the attack at the reconnaissance stage - an unusual login from an unexpected location, a process accessing more files than it should, a device attempting to connect to a known malicious IP. The difference between catching a threat at stage 1 vs stage 5 is typically €10,000-€50,000 in recovery costs.
When Defender detects a compromised device, it automatically:
- Isolates the device from the network while keeping it manageable via Intune
- Kills the malicious process and quarantines affected files
- Investigates which other devices the threat may have reached
- Generates a full incident report for insurance and regulatory purposes
For a 10-person business with no dedicated security staff, this is the equivalent of having a security analyst watching your systems continuously.
What "included in M365 Business Premium" means in practice
Defender for Business is included in Microsoft 365 Business Premium at approximately €22/user/month. For a 10-person team, that is €220/month for email, Teams, Office apps, Intune device management, and enterprise-grade EDR.
Standalone EDR tools from dedicated security vendors typically cost €15-30 per device per month on top of your productivity suite. Getting the same capability bundled into M365 Business Premium is one of the clearest cost advantages of that tier.
The configuration gap most businesses miss
Defender at default settings blocks known malware, but several of the controls that stop real attacks ship switched off - most attack surface reduction rules are opt-in until you enable them[5], and automated remediation needs configuring[6]. A business that "has Defender" but has not configured it gets materially less than it is paying for. The configuration that matters:
- Attack surface reduction rules enabled - blocks Windows features most commonly exploited in SMB attacks
- Cloud-delivered protection set to maximum - enables real-time sharing with Microsoft's global threat intelligence network
- Automated investigation and remediation set to Full - allows Defender to respond without waiting for human approval
- Tamper protection enabled - prevents malware from disabling Defender itself
- Microsoft Secure Score baseline applied - brings all settings to Microsoft's recommended minimums for business use
