Two independent labs test Windows antiviruses month after month: AV-TEST in Germany and AV-Comparatives in Austria. Their recent verdict on Defender surprises people who remember the old days - and their fine print surprises people who only read headlines.
If you want to judge an antivirus engine fairly, skip opinions and go to the labs. AV-TEST scores protection, performance and usability separately, out of 6 each. AV-Comparatives runs large real-world and malware-protection tests and tracks false alarms as seriously as detections. This page reads Defender's recent results in both - the strong headline, the honest footnotes, and the three things no lab score can tell you about your own PC.
In recent AV-TEST rounds for Windows 11 home users, Microsoft Defender Antivirus has taken 6 out of 6 for protection and the lab's Top Product award, round after round - consistency matters more than one lucky month, and Defender's archive shows the same high protection level repeated. In AV-Comparatives' recent real-world protection test - hundreds of live malicious cases run on fully updated Windows systems - Defender blocked roughly 99 percent and was grouped with the top cluster of products, which included the biggest paid names, with very few false alarms. A few cases' difference between products in that cluster is within test noise; the labs themselves group them rather than crown one winner.
Defender's protection is heavily cloud-assisted: suspicious files are checked against Microsoft's enormous reputation database. Online, that is a strength - the cloud learns from billions of PCs. Offline, it is a measurable weakness: in AV-Comparatives' malware-protection testing, Defender's offline detection rate has trailed the best rivals, while its online rate closes most of the gap. Practical meaning: a laptop that syncs malware while offline and runs it before reconnecting is Defender's weakest scenario. It is a footnote, not a scandal - every engine drops offline - but Defender drops a little further than the best.
Protection wins headlines; performance is where Defender sometimes gives back half a point in AV-TEST scoring, and lands mid-field in AV-Comparatives' performance test - system impact when copying files, installing programs and launching apps. On a modern PC this is rarely noticeable. On an old, slow hard-disk machine it can be. Honest grading: top-tier protection, ordinary performance, excellent usability (very few false alarms means it rarely blocks your legitimate programs - a quiet virtue people undervalue until a rival quarantines their office software).
Three things decide real-world outcomes and appear in no score. Your settings: labs test default configurations, but your protection depends on whether Tamper Protection is on, whether you added careless folder exclusions, and whether Controlled Folder Access was ever enabled. Your behaviour: no lab can score the user who clicks through a warning to run a cracked program - that user defeats any engine equally. Your other layers: labs test the engine, not your backups, your patching or your passwords. A 6-out-of-6 engine on an unpatched PC with no backup is a strong lock on a house with the windows open.
Use lab results to reject genuinely weak engines - and to reject scare marketing. When an advertisement implies Defender is a toy that misses everything, the labs say otherwise, in public, every round. When a review implies a paid product is twice as safe because it scored a case or two higher in one round, the labs say that is within the same top group. Check the current reports yourself at av-test.org and av-comparatives.org before any purchase - they are free to read, and they are the same sources every honest reviewer uses.
See the full argument on screen - what Defender covers, what it does not, and what to add around it.
▶️ Watch Full VideoIn recent AV-TEST rounds for Windows home users, Microsoft Defender Antivirus has scored the maximum 6 out of 6 for protection and received the lab's Top Product award, with its weaker showing, when it appears, in the performance category rather than protection. Check av-test.org for the latest round, as scores are republished regularly.
For protection, the labs place them in the same top group: in AV-Comparatives' recent real-world test Defender blocked roughly 99 percent of cases, within a few cases of the leaders, which the lab treats as the same protection cluster. Differences show up more in performance impact, extra features and offline detection than in headline protection.
Its offline detection. Defender leans heavily on cloud reputation checks, so in AV-Comparatives' malware-protection testing its detection rate without an internet connection has trailed the best rivals, even though online results are close. It is a real but narrow weakness - most PCs are online when new files arrive.