A ransomware test against Windows 11 is really a test of four separate layers, not one antivirus. Here is what each layer does, in plain words, and which setting on your PC decides whether it works.
When someone tests a modern Windows 11 PC against real ransomware, the interesting question is never just did the antivirus catch it. Windows 11 25H2 defends in layers: SmartScreen judges the file at the download moment, reputation checks ask whether the file is known and trusted, Microsoft Defender scans and watches behaviour, and Controlled Folder Access stands guard over your documents even if everything else is fooled. Each layer has a different job, a different blind spot, and - most importantly - a setting that decides whether it is even switched on. Tests of this kind are run by professionals on isolated lab machines that are destroyed afterwards. Never try anything like this on a real PC. Your job as a reader is much simpler: understand the layers, and turn on the ones your PC has left off.
Most ransomware does not arrive by magic. It arrives as a download, an email attachment or a file copied from a USB drive - and it usually pretends to be something else: an invoice, a resume, a software crack, a bill. SmartScreen is the checkpoint at that door. When you run a file that came from the internet, Windows checks its reputation. A file that millions of PCs have run safely passes quietly. A brand-new or unknown file triggers the blue warning screen that so many people click through without reading.
That warning is not decoration. It is the layer working exactly as designed - telling you this file has no track record. The honest limit: SmartScreen judges reputation, not intentions. A file that is new but harmless gets warned about, and a file that has spread widely before anyone reported it may pass. It is a strong first filter, not a verdict.
Defender does not rely only on the signature database stored on your PC. With cloud-delivered protection on, a suspicious file is also checked against Microsoft's constantly updated cloud intelligence, and automatic sample submission can send a doubtful file for deeper analysis. This is how a threat that appeared somewhere in the world an hour ago can be recognised on your PC today, instead of after the next database update.
These two toggles live at Windows Security > Virus & threat protection > Virus & threat protection settings > Manage settings. On many PCs they are on by default - but on PCs where someone once "optimised" Windows or disabled Defender features, they are quietly off. That single difference explains why the same test can end differently on two seemingly identical machines.
The classic antivirus job is matching files against known-bad signatures. Ransomware defeats that job easily because every campaign can use freshly packed files nobody has seen before. So Defender also watches behaviour: a program that suddenly starts opening and rewriting hundreds of documents, photos and spreadsheets in seconds is behaving like ransomware whatever its file name says, and behaviour monitoring plus real-time protection exist to interrupt exactly that pattern.
Behaviour watching is powerful but not perfect. It needs a few files' worth of activity before the pattern is undeniable, and a fast encryptor on a fast SSD is quick. This is the honest reason no honest expert promises that antivirus alone makes you safe - and why the next layer exists.
Controlled Folder Access changes the question. Instead of asking "is this program bad?", it asks "is this program on the allowed list for touching your important folders?" Documents, Pictures, Videos, Music and Desktop are protected by default, and you can add your work folders. Any program that is not trusted and tries to change files in those folders is blocked - including a brand-new encryptor that layers 1 to 3 have never seen.
Here is the catch that decides most real-world outcomes: Controlled Folder Access is OFF by default on a normal Windows install, because an over-strict guard can also block a legitimate program once in a while. The fix is not to fear it - it is to switch it on, then allow your genuine programs through the one prompt when needed. Our companion guide walks through that setup step by step. Of all the settings in this article, this is the one most home PCs are missing.
Every layer above tries to stop the attack. The backup layer assumes the attack succeeded - and makes it not matter. Ransomware cannot encrypt a copy it cannot reach, so one backup copy must live somewhere the infected PC cannot write to: an external drive that is unplugged after the backup, or cloud storage with proper version history. A drive that stays connected 24x7 is just another folder waiting to be encrypted.
Notice what this means for tests and for real life alike: the machines that "survive" ransomware are rarely the ones with the cleverest antivirus. They are the ones where the guard was on and the backup was offline. Both of those are settings and habits, not purchases.
A lab test shows how these layers behave against the samples chosen, on that day, with those settings. It does not crown a winner forever. Attackers change packing and tricks constantly, and Microsoft updates intelligence constantly, so the honest takeaway from any such test is a checklist, not a score: SmartScreen respected, cloud protection on, Tamper Protection guarding the settings, Controlled Folder Access enabled, and one backup copy offline. Get those five right and you have reproduced the strongest part of any test result on your own PC.
See the test setup and the defences in action on the Technical Anshu channel, then come back and apply the settings on your own PC.
Watch Full VideoDefender is a strong layer, especially with cloud-delivered protection on, but no single layer is enough on its own. The setup that holds up in tests and in real incidents is layers together: SmartScreen respected, Defender cloud checks on, Controlled Folder Access enabled, and one backup copy kept offline.
Because it can occasionally block a legitimate but unknown program from saving into protected folders, Microsoft ships it off to avoid confusing new users. Turning it on and allowing your real programs once, when prompted, takes a few minutes and removes most of that friction.
25H2 continues the same layered model rather than replacing it - the practical difference for most users is up-to-date intelligence and defaults, not a brand-new shield. The settings that decide your outcome are the same five: SmartScreen, cloud protection, Tamper Protection, Controlled Folder Access and an offline backup copy.