In this guide · 7 sections
- 01Quick answer: free Defender vs Defender for Business vs third-party
- 02What the free Microsoft Defender Antivirus does
- 03What Defender for Business adds (EDR and central management)
- 04Price per user and when you already have it
- 05Management, not the product, is usually the gap
- 06Do it yourself or get help?
- 07Frequently asked questions
Short answer
Built-in Defender Antivirus is a good engine, but on its own it gives you no central view, no alerts and no response tools. For a business, Defender for Business (US$3 per user per month, or included in Business Premium) adds EDR, a central console and automatic investigation. Someone still needs to watch it.
Quick answer: free Defender vs Defender for Business vs third-party
The three options are not really competitors at the engine level. The difference is what you can see and do across all your devices.
Defender Antivirus (built in)
Free with Windows
- Real-time and cloud-based malware protection
- Managed one PC at a time
- No company-wide alerts or reports
- No investigation or response tools
Best for: A sole proprietor with one PC.
Defender for Business
Most small officesUS$3/user/mo
- Same engine, managed from one console
- EDR: detects and investigates attacks
- Automatic investigation and remediation
- Windows, Mac, iOS and Android
Best for: Teams on Microsoft 365, especially Business Premium.
Third-party (Bitdefender, ESET and others)
Vendor pricing
- Own cloud console
- EDR in higher tiers
- Useful if you are not on Microsoft 365
- One more vendor and bill
Best for: Google Workspace offices or mixed fleets.
Prices are approximate, as of October 2026, from Microsoft's Defender for Business page for Singapore, in US dollars excluding GST on an annual plan.
What the free Microsoft Defender Antivirus does
According to Microsoft Learn, Defender Antivirus is built into Windows 10, Windows 11 and Windows Server. It uses machine learning and cloud-delivered protection, and can block threats based on behaviour, including fileless malware. It is the same engine used in Microsoft's paid business products.
What it does not give you is a business view. Each PC is managed on its own, through the Windows Security app. If a staff member switches protection off, misses updates for months or gets an alert, nobody else finds out. There is no record you can show an auditor or insurer, and no way to isolate an infected laptop remotely.
What Defender for Business adds (EDR and central management)
Microsoft's Defender for Business overview describes it as an endpoint security product for businesses with up to 300 users, based on Defender for Endpoint. Compared with the built-in antivirus it adds:
- Endpoint detection and response (EDR): records activity on each device so attacks that get past antivirus can be spotted and traced.
- Automated investigation and remediation: looks into alerts and can fix common problems without someone doing it by hand.
- Automatic attack disruption: can contain an attack in progress, for example by isolating a device.
- Vulnerability management: lists missing updates and risky software across devices.
- One console and monthly security reports covering Windows, Mac, iOS and Android.
According to Microsoft's Defender for Business FAQ, each user licence covers up to five client devices. Windows or Linux servers need a separate Defender for Business servers licence, listed at US$3 per server.
Price per user and when you already have it
| Your Microsoft plan | Defender for Business? | Extra cost |
|---|---|---|
| No Microsoft 365 (e.g. Google Workspace) | Can buy standalone | US$3 per user per month |
| Business Basic (US$7) | Not included | US$3 per user per month |
| Business Standard (US$14) | Not included | US$3 per user per month |
| Business Premium (US$22) | Included | None |
If you already pay for Business Premium, you own Defender for Business. Check the Microsoft Defender portal: if your devices are not listed there, they are not onboarded, and you are paying for protection you are not using. Our guide on whether Business Premium is worth it compares the full bundle with Standard plus add-ons.
Management, not the product, is usually the gap
Choosing between good antivirus brands matters less than the basics around them. Typical weak spots are a laptop that was never onboarded, alerts going to a mailbox nobody reads, or updates months behind. Our ransomware first-response guide covers what happens next if that occurs.
Endpoint protection basics for a small office
Note on round-the-clock monitoring: in Singapore, managed security operations centre monitoring is a licensable service under the Cybersecurity Act. A small business normally gets alerts to its own email and a provider who helps when you forward one, rather than a 24/7 security centre. Our BYOD and MDM guide covers the device-management side.
Do it yourself or get help?
If you are on Business Premium, start in the Microsoft Defender portal's setup wizard: onboard devices, apply the default policies and set who receives alerts. If you are on Basic or Standard, add Defender for Business licences first. Test on one PC before rolling out.
If you want it done for you, our Antivirus & Endpoint Protection Rollout (S$390) sets up Defender for Business, Bitdefender or ESET in your own account and installs it on up to 10 devices, with alerts going to your email. To keep it maintained, Protect Standard (S$19 per user per month, minimum 3 users) checks protection, encryption and updates every month and helps when you forward an alert. Licence fees are paid by you to the vendor.
Frequently asked questions
The built-in antivirus engine is good, but on its own it is managed one PC at a time, with no central view, alerts or response tools. For a business with several devices or customer data, add central management through Defender for Business, which uses the same engine, or a third-party business antivirus with a console.
As of October 2026, Microsoft's Singapore page lists Defender for Business at US$3 per user per month on an annual plan, excluding GST. Each user licence covers up to five devices. It is included at no extra cost in Microsoft 365 Business Premium. Servers need a separate licence.
EDR, endpoint detection and response, records what happens on each device so suspicious behaviour can be detected, investigated and stopped, even when malware gets past antivirus. Small businesses benefit because ransomware attacks often use legitimate tools that plain antivirus misses. It only helps if alerts reach someone who acts on them.
Yes, but only one should be the active antivirus. When another product is installed, Windows normally steps Defender Antivirus aside. Microsoft notes that Defender can run in passive mode alongside another product only on devices onboarded to Defender for Endpoint. Running two active antivirus products causes conflicts.
Yes. Microsoft says Defender for Business supports Windows, Mac, Android, iOS and iPadOS devices, managed from the same Microsoft Defender portal. Each user licence covers up to five devices, so a laptop, a phone and a tablet per person fit within one licence.