I Tested Windows 11 25H2 Against Real Ransomware – Here's What Happened

How the Test Was Set Up

A ransomware test against Windows 11 is really a test of four separate layers, not one antivirus. In the video, the test runs on Windows 11 25H2 inside a fully isolated lab, on a disposable machine that is wiped afterwards - the only safe way such a test can ever be done. The question being answered is not simply "did the antivirus catch it?", but how each built-in layer behaves, in order, when a real encryptor is let loose.

Layer 1 - SmartScreen Judges the File at the Door

Most ransomware does not arrive by magic. It arrives as a download, an email attachment or a file copied from a USB drive - and it usually pretends to be something else: an invoice, a resume, a software crack, a bill. SmartScreen is the checkpoint at that door. When you run a file that came from the internet, Windows checks its reputation. A file that millions of PCs have run safely passes quietly; a brand-new or unknown file triggers the blue warning screen that so many people click through without reading.

That warning is not decoration - it is the layer working exactly as designed, telling you this file has no track record. The honest limit: SmartScreen judges reputation, not intentions. A file that is new but harmless gets warned about, and a file that has spread widely before anyone reported it may pass. It is a strong first filter, not a verdict.

Layer 2 - Reputation and Cloud Checks Behind the Scenes

Defender does not rely only on the signature database stored on your PC. With cloud-delivered protection on, a suspicious file is also checked against Microsoft's constantly updated cloud intelligence, and automatic sample submission can send a doubtful file for deeper analysis. This is how a threat that appeared somewhere in the world an hour ago can be recognised on your PC today, instead of after the next database update.

These two toggles live at Windows Security > Virus & threat protection > Virus & threat protection settings > Manage settings. On many PCs they are on by default - but on PCs where someone once "optimised" Windows or disabled Defender features, they are quietly off. That single difference explains why the same test can end differently on two seemingly identical machines.

Layer 3 - Defender Watches Behaviour, Not Just Files

The classic antivirus job is matching files against known-bad signatures. Ransomware defeats that job easily, because every campaign can use freshly packed files nobody has seen before. So Defender also watches behaviour: a program that suddenly starts opening and rewriting hundreds of documents, photos and spreadsheets in seconds is behaving like ransomware whatever its file name says - and behaviour monitoring plus real-time protection exist to interrupt exactly that pattern.

Behaviour watching is powerful but not perfect. It needs a few files' worth of activity before the pattern is undeniable, and a fast encryptor on a fast SSD is quick. This is the honest reason no honest expert promises that antivirus alone makes you safe - and why the next layer exists.

Layer 4 - Controlled Folder Access Guards the Files Themselves

Controlled Folder Access changes the question. Instead of asking "is this program bad?", it asks "is this program on the allowed list for touching your important folders?" Documents, Pictures, Videos, Music and Desktop are protected by default, and you can add your own work folders. Any program that is not trusted and tries to change files in those folders is blocked - including a brand-new encryptor that layers 1 to 3 have never seen.

Here is the catch that decides most real-world outcomes: Controlled Folder Access is OFF by default on a normal Windows install, because an over-strict guard can occasionally block a legitimate program. You switch it on at Windows Security > Virus & threat protection > Ransomware protection > Manage ransomware protection. Of all the settings in this guide, this is the one most home PCs are missing.

Tamper Protection - the Guard on the Guards

Every layer above depends on its settings staying on. Modern malware knows this, and one of its first moves is often to quietly switch Defender off. Tamper Protection exists to stop exactly that: while it is on, Defender's key settings cannot be changed by apps or scripts - only by you, in the Windows Security app. It sits on the same Manage settings page as the cloud toggles in Step 3.

In a test - and in a real incident - this is the difference between defences that fight back and defences that were silently removed before the fight started. Check that it is on; it takes ten seconds.

The Layer Outside Windows - Your Offline Backup

Every layer above tries to stop the attack. The backup layer assumes the attack succeeded - and makes it not matter. Ransomware cannot encrypt a copy it cannot reach, so one backup copy must live somewhere the infected PC cannot write to: an external drive that is unplugged after the backup, or cloud storage with proper version history.

The Verdict - a Checklist, Not a Score

A lab test shows how these layers behave against the samples chosen, on that day, with those settings. It does not crown a winner forever: attackers change packing and tricks constantly, and Microsoft updates intelligence constantly. Windows 11 25H2 continues the same layered model rather than replacing it - the practical difference for most users is up-to-date intelligence and defaults, not a brand-new shield.

So the honest takeaway from the test is a checklist, not a score. Get these five right and you have reproduced the strongest part of any test result on your own PC: (1) respect the SmartScreen warning, (2) cloud-delivered protection on, (3) Tamper Protection on, (4) Controlled Folder Access enabled, (5) one backup copy kept offline. Watch the full video above to see the test itself, then apply the settings.