July 22, 2026
Microsoft Defender for Endpoint - Simply Explained
Cyberattacks are evolving faster than ever, and traditional antivirus software is no longer enough to keep businesses protected. Modern attackers use ransomware, fileless malware, credential theft, and sophisticated attack techniques that can bypass signature-based detection in seconds. That's where Microsoft Defender for Endpoint comes in. In this episode of Microsoft Knowledge Nuggets, we break down Microsoft's enterprise endpoint protection platform in plain English and explain why it has become a critical part of every modern Microsoft 365 security strategy.
WHY TRADITIONAL ANTIVIRUS IS NO LONGER ENOUGH
Many people still think endpoint protection simply means installing antivirus software on every device. While traditional antivirus scans files for known malware signatures, today's cyber threats constantly evolve and often use completely new attack techniques that have never been seen before. Defender for Endpoint goes far beyond antivirus by using cloud intelligence, artificial intelligence, behavioral analysis, and real-time threat detection to identify suspicious activity before attackers can cause serious damage.
WHAT MICROSOFT DEFENDER FOR ENDPOINT ACTUALLY DOES
Microsoft Defender for Endpoint is Microsoft's enterprise endpoint detection and response (EDR) platform that protects Windows, macOS, Linux, Android, and iOS devices. Instead of relying on a single security layer, it combines prevention, detection, investigation, automated response, vulnerability management, and threat intelligence into one integrated security solution. Whether employees work from the office, from home, or while traveling, Defender continuously monitors every endpoint and helps security teams identify threats across the entire organization.
ENDPOINT DETECTION AND RESPONSE MADE SIMPLE
One of Defender for Endpoint's most powerful capabilities is Endpoint Detection and Response (EDR). Every protected device continuously sends security telemetry to Microsoft's cloud where advanced analytics and AI identify suspicious patterns that traditional antivirus would completely miss. Security teams can investigate attacks that happened weeks or even months earlier, trace attacker activity across multiple devices, and automatically correlate hundreds of individual alerts into a single incident timeline. This dramatically reduces investigation time while improving threat visibility across the organization.
AUTOMATED INVESTIGATION, ATTACK DISRUPTION, AND AI SECURITY
When Defender detects malicious activity, it doesn't simply generate an alert and wait for an administrator. Automated Investigation and Response (AIR) evaluates the threat, isolates compromised devices, blocks malicious processes, removes malware, and helps prevent attackers from moving laterally through the network. Microsoft also introduces Automatic Attack Disruption, using AI to predict attacker behavior and stop ransomware campaigns within minutes before they can spread throughout the environment.
VULNERABILITY MANAGEMENT AND MICROSOFT DEFENDER XDR
Defender for Endpoint doesn't just react to attacks—it continuously identifies vulnerabilities before attackers exploit them. The platform discovers missing patches, insecure configurations, outdated software, and risky attack paths while prioritizing the vulnerabilities most likely to be exploited. It also integrates seamlessly with Microsoft Defender XDR, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Sentinel, Microsoft Intune, and the broader Microsoft 365 security ecosystem, giving security teams a unified view across endpoints, identities, email, cloud applications, and data.
HOW TO GET STARTED WITH MICROSOFT DEFENDER FOR ENDPOINT
Getting started is often easier than many organizations realize. Businesses using Microsoft 365 E5—or in many cases Microsoft 365 Business Premium—already have access to Defender for Endpoint capabilities. After enabling the service, onboarding devices, connecting Microsoft Intune, applying Microsoft's recommended security baselines, and configuring monitoring policies, organizations can begin protecting every endpoint with enterprise-grade security. While the platform offers powerful automation, organizations should also establish monitoring processes or work with a Managed Detection and Response (MDR) provider to maximize protection.
Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.
🚀 Want to be part of m365.fm?
Then stop just listening… and start showing up.
👉 Connect with me on LinkedIn and let’s make something happen:
- 🎙️ Be a podcast guest and share your story
- 🎧 Host your own episode (yes, seriously)
- 💡 Pitch topics the community actually wants to hear
- 🌍 Build your personal brand in the Microsoft 365 space
This isn’t just a podcast — it’s a platform for people who take action.
🔥 Most people wait. The best ones don’t.
👉 Connect with me on LinkedIn and send me a message:
"I want in"
Let’s build something awesome 👊
1
00:00:00,000 --> 00:00:02,440
Antivirus used to be enough, but it isn't anymore.
2
00:00:02,440 --> 00:00:03,800
You probably remember the old days.
3
00:00:03,800 --> 00:00:07,120
In Stolar program, it scans your files and you're protected.
4
00:00:07,120 --> 00:00:08,360
Simple, that world is gone.
5
00:00:08,360 --> 00:00:11,240
Today, Ranzwer encounters are up 275%,
6
00:00:11,240 --> 00:00:14,720
and 68% of all cyber attacks now target the devices
7
00:00:14,720 --> 00:00:17,440
sitting on your desk, in your bag, or on your kitchen table.
8
00:00:17,440 --> 00:00:19,440
So what is Microsoft Defender for Endpoint?
9
00:00:19,440 --> 00:00:21,360
And why is every business talking about it?
10
00:00:21,360 --> 00:00:22,880
By the end of this episode, you'll understand
11
00:00:22,880 --> 00:00:24,440
what Endpoint security actually means.
12
00:00:24,440 --> 00:00:25,960
How Defender for Endpoint is different
13
00:00:25,960 --> 00:00:28,600
from basic antivirus and why it matters for your company.
14
00:00:28,600 --> 00:00:31,160
We'll break it down into building blocks, what it protects,
15
00:00:31,160 --> 00:00:33,760
how it protects it, and how it all fits together.
16
00:00:33,760 --> 00:00:35,560
So let's start with the basics.
17
00:00:35,560 --> 00:00:37,320
What is Endpoint security?
18
00:00:37,320 --> 00:00:38,680
First, what is an endpoint?
19
00:00:38,680 --> 00:00:41,000
It's any device that connects to your company's network,
20
00:00:41,000 --> 00:00:43,720
laptops, desktops, phones, tablets, servers,
21
00:00:43,720 --> 00:00:45,320
anything with an internet connection.
22
00:00:45,320 --> 00:00:48,800
In the office building analogy, if Microsoft 365 is your building,
23
00:00:48,800 --> 00:00:50,320
endpoints are the doors and windows.
24
00:00:50,320 --> 00:00:52,080
Every single one is a potential way in.
25
00:00:52,080 --> 00:00:54,720
Now, the old way of protecting these devices was simple.
26
00:00:54,720 --> 00:00:56,560
You installed antivirus on each machine
27
00:00:56,560 --> 00:00:57,680
and it ran on its own.
28
00:00:57,680 --> 00:00:59,880
It checked files against a list of known threats.
29
00:00:59,880 --> 00:01:01,720
And if something matched, it blocked it.
30
00:01:01,720 --> 00:01:02,640
That worked for a while.
31
00:01:02,640 --> 00:01:04,880
But attackers don't break in through the front door anymore.
32
00:01:04,880 --> 00:01:07,120
They don't use the same tools twice, they evolve.
33
00:01:07,120 --> 00:01:09,160
So Endpoint security today means something different.
34
00:01:09,160 --> 00:01:10,960
It's about protecting every device,
35
00:01:10,960 --> 00:01:12,880
not just the ones you think are important.
36
00:01:12,880 --> 00:01:15,880
You need to watch for behavior, not just look for known bad files.
37
00:01:15,880 --> 00:01:18,240
And you need to build a security system around every device,
38
00:01:18,240 --> 00:01:20,000
not just install one piece of software.
39
00:01:20,000 --> 00:01:22,000
Here's the thing though, most people still think
40
00:01:22,000 --> 00:01:24,000
of endpoint security as antivirus.
41
00:01:24,000 --> 00:01:25,760
And that's where the problem starts.
42
00:01:25,760 --> 00:01:27,760
Why traditional antivirus isn't enough?
43
00:01:27,760 --> 00:01:30,200
Let's talk about what traditional antivirus actually does.
44
00:01:30,200 --> 00:01:33,080
It scans files, checks them against a list of known threats,
45
00:01:33,080 --> 00:01:35,920
signatures they're called, and blocks anything that matches.
46
00:01:35,920 --> 00:01:38,840
It's like having a security guard who only checks a wanted poster.
47
00:01:38,840 --> 00:01:41,200
If the thief isn't on the poster, they walk right past.
48
00:01:41,200 --> 00:01:42,680
And that's the core limitation.
49
00:01:42,680 --> 00:01:45,880
Signature-based detection only catches what's already been seen.
50
00:01:45,880 --> 00:01:47,720
Modern attacks are adaptive, targeted,
51
00:01:47,720 --> 00:01:50,040
and often use brand new or custom malware.
52
00:01:50,040 --> 00:01:51,960
Attackers don't use the same tools twice.
53
00:01:51,960 --> 00:01:52,560
They evolve.
54
00:01:52,560 --> 00:01:54,240
Traditional antivirus can't keep up.
55
00:01:54,240 --> 00:01:55,560
The numbers back this up.
56
00:01:55,560 --> 00:01:57,400
AI-powered endpoint protection now achieves
57
00:01:57,400 --> 00:01:59,600
an 89% automatic detection rate.
58
00:01:59,600 --> 00:02:00,640
Traditional antivirus?
59
00:02:00,640 --> 00:02:01,880
Just 42%.
60
00:02:01,880 --> 00:02:02,960
That's a massive gap.
61
00:02:02,960 --> 00:02:05,360
And it's not just about missing the initial attack.
62
00:02:05,360 --> 00:02:07,160
Traditional antivirus has no visibility
63
00:02:07,160 --> 00:02:08,920
into what happens after a breach starts.
64
00:02:08,920 --> 00:02:11,160
An attacker might already be inside your network,
65
00:02:11,160 --> 00:02:12,720
moving from machine to machine.
66
00:02:12,720 --> 00:02:14,240
And traditional AV wouldn't know.
67
00:02:14,240 --> 00:02:15,520
It has no eyes on behavior.
68
00:02:15,520 --> 00:02:17,920
So you need something that watches for unusual behavior,
69
00:02:17,920 --> 00:02:19,680
not just known bad files.
70
00:02:19,680 --> 00:02:22,040
You need something that can see the attacker moving,
71
00:02:22,040 --> 00:02:24,600
even if the file they're using has never been seen before.
72
00:02:24,600 --> 00:02:26,720
That's where Defender for Endpoint comes in.
73
00:02:26,720 --> 00:02:28,320
What is Defender for Endpoint?
74
00:02:28,320 --> 00:02:30,840
So what does Defender for Endpoint actually do?
75
00:02:30,840 --> 00:02:31,680
Let's look at it.
76
00:02:31,680 --> 00:02:33,800
Microsoft Defender for Endpoint is a cloud-powered
77
00:02:33,800 --> 00:02:35,360
endpoint security platform.
78
00:02:35,360 --> 00:02:36,800
That's the official definition.
79
00:02:36,800 --> 00:02:38,720
But here's what that means in plain English.
80
00:02:38,720 --> 00:02:39,960
It's not a single product.
81
00:02:39,960 --> 00:02:41,360
It's a collection of capabilities
82
00:02:41,360 --> 00:02:43,520
that work together to protect your devices.
83
00:02:43,520 --> 00:02:46,160
Think of it as three main pillars, prevention, detection,
84
00:02:46,160 --> 00:02:46,960
and response.
85
00:02:46,960 --> 00:02:48,960
Prevention stops attacks before they happen.
86
00:02:48,960 --> 00:02:51,080
Detection finds the ones that get through anyway.
87
00:02:51,080 --> 00:02:52,680
And response automatically contains
88
00:02:52,680 --> 00:02:53,760
and investigates them.
89
00:02:53,760 --> 00:02:56,000
Traditional antivirus is a lock on the door.
90
00:02:56,000 --> 00:02:57,880
Defender for Endpoint is a security system
91
00:02:57,880 --> 00:03:00,560
with cameras, motion sensors, and a team watching the monitors.
92
00:03:00,560 --> 00:03:02,600
Now one thing that trips people up is the naming.
93
00:03:02,600 --> 00:03:04,480
Defender for Endpoint isn't just for Windows.
94
00:03:04,480 --> 00:03:07,600
It protects devices across Windows, Mac OS, Linux, Android,
95
00:03:07,600 --> 00:03:08,720
and iOS.
96
00:03:08,720 --> 00:03:10,480
Whether your team is in the office at home
97
00:03:10,480 --> 00:03:13,240
or working from a coffee shop, the same protection follows them.
98
00:03:13,240 --> 00:03:14,400
There are two plans.
99
00:03:14,400 --> 00:03:16,680
Plan one gives you basic protection.
100
00:03:16,680 --> 00:03:19,400
Next, Gen Antivirus, attack surface reduction,
101
00:03:19,400 --> 00:03:20,880
and some basic detection.
102
00:03:20,880 --> 00:03:22,880
Plan two is where the real power lives.
103
00:03:22,880 --> 00:03:25,400
That's the full EDR suite with advanced hunting,
104
00:03:25,400 --> 00:03:28,640
automated investigation, and six months of telemetry retention.
105
00:03:28,640 --> 00:03:30,320
And here's the part most people miss.
106
00:03:30,320 --> 00:03:33,200
Plan two is included in Microsoft 365 E5.
107
00:03:33,200 --> 00:03:35,160
If you already have E5, you already have this.
108
00:03:35,160 --> 00:03:36,200
You just need to turn it on.
109
00:03:36,200 --> 00:03:37,560
The key differentiator is this.
110
00:03:37,560 --> 00:03:38,640
It's not just antivirus.
111
00:03:38,640 --> 00:03:41,240
It's an Endpoint detection and response platform.
112
00:03:41,240 --> 00:03:43,880
And that changes everything about how you think about security.
113
00:03:43,880 --> 00:03:45,560
Let's break down what that actually means,
114
00:03:45,560 --> 00:03:47,440
starting with the first layer.
115
00:03:47,440 --> 00:03:48,960
Next, Generation Protection.
116
00:03:48,960 --> 00:03:50,320
This is the prevention layer.
117
00:03:50,320 --> 00:03:52,560
It's what most people think of as antivirus.
118
00:03:52,560 --> 00:03:54,040
But it's actually much smarter than that
119
00:03:54,040 --> 00:03:56,240
because it uses machine learning and behavior analysis
120
00:03:56,240 --> 00:03:58,280
instead of just looking for known viruses.
121
00:03:58,280 --> 00:04:00,560
Next, Generation Protection uses machine learning,
122
00:04:00,560 --> 00:04:03,320
behavior analysis, and cloud-based threat intelligence
123
00:04:03,320 --> 00:04:04,880
to detect suspicious behavior,
124
00:04:04,880 --> 00:04:07,240
rather than just flagging known bad files.
125
00:04:07,240 --> 00:04:09,680
So if a script tries to modify system files,
126
00:04:09,680 --> 00:04:11,840
even if it's not a known virus, the system catches it
127
00:04:11,840 --> 00:04:13,280
because the behavior is unusual.
128
00:04:13,280 --> 00:04:15,800
It's like a security guard who notices someone acting nervous
129
00:04:15,800 --> 00:04:17,680
even if they're not on the wanted list.
130
00:04:17,680 --> 00:04:20,440
The guard doesn't need to recognize the person just the behavior.
131
00:04:20,440 --> 00:04:22,720
Part of this is attack surface reduction.
132
00:04:22,720 --> 00:04:25,160
Tiny rules that block common attack techniques.
133
00:04:25,160 --> 00:04:27,080
For example, blocking macros from office files
134
00:04:27,080 --> 00:04:28,400
downloaded from the internet
135
00:04:28,400 --> 00:04:30,920
or preventing USB drives from running scripts.
136
00:04:30,920 --> 00:04:32,640
These are small things, but they shut down
137
00:04:32,640 --> 00:04:34,280
the method attackers use most.
138
00:04:34,280 --> 00:04:36,760
In the 2024 Miterat tank evaluation,
139
00:04:36,760 --> 00:04:39,480
Defender for Endpoint delivered 100% protection.
140
00:04:39,480 --> 00:04:41,160
That's not a marketing claim.
141
00:04:41,160 --> 00:04:44,160
It's an independent test against real world attack scenarios.
142
00:04:44,160 --> 00:04:46,120
This layer runs automatically.
143
00:04:46,120 --> 00:04:47,280
You don't have to think about it.
144
00:04:47,280 --> 00:04:49,640
No manual scanning, no scheduled updates.
145
00:04:49,640 --> 00:04:51,040
It just works in the background,
146
00:04:51,040 --> 00:04:52,480
but prevention isn't perfect.
147
00:04:52,480 --> 00:04:54,080
No system catches everything.
148
00:04:54,080 --> 00:04:56,080
That's where the next layer comes in.
149
00:04:56,080 --> 00:04:58,560
Endpoint detection and response, EDR.
150
00:04:58,560 --> 00:05:01,480
So prevention catches a lot, but it doesn't catch everything.
151
00:05:01,480 --> 00:05:02,640
That's where EDR comes in.
152
00:05:02,640 --> 00:05:05,160
EDR stands for endpoint detection and response
153
00:05:05,160 --> 00:05:07,320
and it's what happens after an attack gets through.
154
00:05:07,320 --> 00:05:08,160
Think of it this way.
155
00:05:08,160 --> 00:05:10,040
Prevention is the lock on your front door.
156
00:05:10,040 --> 00:05:12,040
And EDR is the motion sensor in your hallway
157
00:05:12,040 --> 00:05:14,520
that alerts you when someone's already inside.
158
00:05:14,520 --> 00:05:16,240
Every device running Defender for Endpoint
159
00:05:16,240 --> 00:05:18,640
sends telemetry data to the cloud constantly.
160
00:05:18,640 --> 00:05:21,040
File changes, process launches, network connections,
161
00:05:21,040 --> 00:05:22,280
registry edits.
162
00:05:22,280 --> 00:05:23,960
The sensors are always watching.
163
00:05:23,960 --> 00:05:25,840
And this data gets analyzed by AI
164
00:05:25,840 --> 00:05:27,280
to detect suspicious patterns.
165
00:05:27,280 --> 00:05:29,000
It's like having cameras in every room
166
00:05:29,000 --> 00:05:31,080
with an AI that watches all the feeds at once
167
00:05:31,080 --> 00:05:32,600
and flags anything unusual.
168
00:05:32,600 --> 00:05:34,200
Security teams can actually search
169
00:05:34,200 --> 00:05:36,560
across all their devices for signs of compromise.
170
00:05:36,560 --> 00:05:37,920
This is called threat hunting.
171
00:05:37,920 --> 00:05:39,800
You can ask a question like, has anyone run
172
00:05:39,800 --> 00:05:41,120
the suspicious command?
173
00:05:41,120 --> 00:05:43,440
And get answers in seconds, not hours.
174
00:05:43,440 --> 00:05:45,680
And because telemetry is stored for up to six months
175
00:05:45,680 --> 00:05:47,440
with Plan 2, you can investigate attacks
176
00:05:47,440 --> 00:05:48,480
that happen months ago.
177
00:05:48,480 --> 00:05:51,080
An attack that came in through a fishing email back in January,
178
00:05:51,080 --> 00:05:52,560
you can still trace it in June.
179
00:05:52,560 --> 00:05:54,960
That lets you map out exactly how an attacker got in
180
00:05:54,960 --> 00:05:56,160
and what they touched.
181
00:05:56,160 --> 00:05:59,280
A user clicks a fishing link, but nothing happens immediately.
182
00:05:59,280 --> 00:06:01,760
No malware drops, no files getting crypted.
183
00:06:01,760 --> 00:06:03,480
Everything looks normal.
184
00:06:03,480 --> 00:06:05,520
Weeks later, the attacker tries to move
185
00:06:05,520 --> 00:06:06,840
literally across the network.
186
00:06:06,840 --> 00:06:08,560
That's when EDR catches it.
187
00:06:08,560 --> 00:06:10,120
The initial infection wasn't obvious,
188
00:06:10,120 --> 00:06:12,480
but the behavior after the attacker trying to hop
189
00:06:12,480 --> 00:06:14,960
from one machine to another is what EDR finds.
190
00:06:14,960 --> 00:06:16,600
Instead of getting 50 separate alerts,
191
00:06:16,600 --> 00:06:17,760
you get one incident view.
192
00:06:17,760 --> 00:06:19,640
All the alerts from multiple devices
193
00:06:19,640 --> 00:06:21,840
get grouped together into a single story.
194
00:06:21,840 --> 00:06:24,960
The attacker's whole journey mapped out from start to finish.
195
00:06:24,960 --> 00:06:27,240
Instead of 50 puzzle pieces scattered across your screen,
196
00:06:27,240 --> 00:06:28,560
you get the full picture.
197
00:06:28,560 --> 00:06:31,240
But finding an attack is only half the battle.
198
00:06:31,240 --> 00:06:32,920
You also need to understand your weaknesses
199
00:06:32,920 --> 00:06:35,680
before an attacker finds them.
200
00:06:35,680 --> 00:06:38,080
Vulnerability, management, and threat analytics.
201
00:06:38,080 --> 00:06:40,160
So we've talked about prevention and detection,
202
00:06:40,160 --> 00:06:42,160
but there's another layer that traditional antivirus
203
00:06:42,160 --> 00:06:43,080
never touched.
204
00:06:43,080 --> 00:06:44,800
This is the Know Your Weaknesses layer.
205
00:06:44,800 --> 00:06:45,640
And it's a big deal.
206
00:06:45,640 --> 00:06:46,960
Defender for endpoint constantly
207
00:06:46,960 --> 00:06:49,120
scans your devices for missing patches,
208
00:06:49,120 --> 00:06:51,200
weak configurations, and exposed settings.
209
00:06:51,200 --> 00:06:52,200
It doesn't wait for an attack.
210
00:06:52,200 --> 00:06:54,040
It tells you upfront, hey, these 50 devices
211
00:06:54,040 --> 00:06:55,840
are missing a critical Windows update.
212
00:06:55,840 --> 00:06:56,880
Fix them first.
213
00:06:56,880 --> 00:06:57,760
That's proactive.
214
00:06:57,760 --> 00:06:59,760
Old-school antivirus would just sit there.
215
00:06:59,760 --> 00:07:00,640
But here's the thing.
216
00:07:00,640 --> 00:07:03,000
Not all vulnerabilities are created equal.
217
00:07:03,000 --> 00:07:04,720
Some are critical, some are minor.
218
00:07:04,720 --> 00:07:07,880
And some are actively being exploited by attackers right now
219
00:07:07,880 --> 00:07:08,840
out in the wild.
220
00:07:08,840 --> 00:07:11,640
Defender uses something called exploit prediction data,
221
00:07:11,640 --> 00:07:14,520
EPSS for short, to figure out what's most likely to be hit.
222
00:07:14,520 --> 00:07:15,880
You don't have to fix everything.
223
00:07:15,880 --> 00:07:17,920
You fix the things that actually matter.
224
00:07:17,920 --> 00:07:19,120
That's the smart approach.
225
00:07:19,120 --> 00:07:21,920
The system also does something called attack path modeling.
226
00:07:21,920 --> 00:07:23,440
Imagine a map of your office building
227
00:07:23,440 --> 00:07:25,840
showing every possible route a burglar could take.
228
00:07:25,840 --> 00:07:27,800
Maybe one device has an outdated browser.
229
00:07:27,800 --> 00:07:29,200
Another has a weak password.
230
00:07:29,200 --> 00:07:30,600
Separately, those are minor issues.
231
00:07:30,600 --> 00:07:32,880
But chain together, they become a clear path
232
00:07:32,880 --> 00:07:34,320
to your most sensitive files.
233
00:07:34,320 --> 00:07:35,440
That's exactly what this does.
234
00:07:35,440 --> 00:07:36,960
It shows how an attacker could connect
235
00:07:36,960 --> 00:07:39,280
the dots from one vulnerability to the next.
236
00:07:39,280 --> 00:07:40,920
So instead of guessing what to patch next,
237
00:07:40,920 --> 00:07:43,440
your security team gets a clear prioritized list.
238
00:07:43,440 --> 00:07:44,720
No guesswork, no panic.
239
00:07:44,720 --> 00:07:47,000
Just a road map, you know exactly what to fix first.
240
00:07:47,000 --> 00:07:49,320
But what happens when an attack is already in progress?
241
00:07:49,320 --> 00:07:51,080
That's where automation kicks in.
242
00:07:51,080 --> 00:07:53,320
Automated investigation and attack disruption.
243
00:07:53,320 --> 00:07:54,800
So prevention blocks what it can.
244
00:07:54,800 --> 00:07:56,240
Detection finds what gets through.
245
00:07:56,240 --> 00:07:58,400
But what about when an attack is happening right now?
246
00:07:58,400 --> 00:08:00,560
In real time, that's the response layer.
247
00:08:00,560 --> 00:08:02,600
And honestly, this might be the most impressive part
248
00:08:02,600 --> 00:08:03,440
of the whole system.
249
00:08:03,440 --> 00:08:05,280
When Defender for Endpoint detects a threat,
250
00:08:05,280 --> 00:08:06,800
it doesn't just fire off an alert
251
00:08:06,800 --> 00:08:08,040
and hope someone sees it.
252
00:08:08,040 --> 00:08:08,840
It acts.
253
00:08:08,840 --> 00:08:10,480
The system runs automated playbooks
254
00:08:10,480 --> 00:08:12,240
to figure out if the alert is real.
255
00:08:12,240 --> 00:08:15,360
It asks questions like, is this file actually malicious?
256
00:08:15,360 --> 00:08:16,440
Is it on other devices?
257
00:08:16,440 --> 00:08:18,320
Has it connected to known bad servers?
258
00:08:18,320 --> 00:08:20,680
It does all of this in seconds, not hours.
259
00:08:20,680 --> 00:08:22,840
Think about how long it would take a human to do that.
260
00:08:22,840 --> 00:08:25,480
If the threat is confirmed, the system takes action.
261
00:08:25,480 --> 00:08:27,280
It isolates the device from the network.
262
00:08:27,280 --> 00:08:29,000
Blocks the file, removes the threat.
263
00:08:29,000 --> 00:08:30,680
The machine gets cut off before the attacker
264
00:08:30,680 --> 00:08:32,000
can spread to anything else.
265
00:08:32,000 --> 00:08:33,400
No human has to click a button.
266
00:08:33,400 --> 00:08:35,800
The system just does it automatically.
267
00:08:35,800 --> 00:08:37,400
But there's an even more advanced version
268
00:08:37,400 --> 00:08:39,480
called automatic attack disruption.
269
00:08:39,480 --> 00:08:41,200
And this is where things get really interesting.
270
00:08:41,200 --> 00:08:44,320
Attack disruption uses AI to predict what the attacker will do
271
00:08:44,320 --> 00:08:46,400
next and blocks it before they can try.
272
00:08:46,400 --> 00:08:48,080
It's not reacting to what already happened.
273
00:08:48,080 --> 00:08:49,560
It's anticipating the next move.
274
00:08:49,560 --> 00:08:51,200
That's a whole different level.
275
00:08:51,200 --> 00:08:53,720
Here's a real example from Microsoft's own research.
276
00:08:53,720 --> 00:08:56,360
Imagine an attacker gets access to your domain controller.
277
00:08:56,360 --> 00:08:58,600
That's the server that handles user authentication
278
00:08:58,600 --> 00:09:00,280
across your entire organization.
279
00:09:00,280 --> 00:09:02,000
In most security setups, you can't just
280
00:09:02,000 --> 00:09:03,400
shut down the domain controller.
281
00:09:03,400 --> 00:09:04,480
It's too critical.
282
00:09:04,480 --> 00:09:06,960
So other solutions would isolate the compromised machines
283
00:09:06,960 --> 00:09:09,960
around it, but leave the domain controller itself exposed.
284
00:09:09,960 --> 00:09:11,400
The attacker can still pivot.
285
00:09:11,400 --> 00:09:13,440
Defender for endpoint handles this differently.
286
00:09:13,440 --> 00:09:15,360
It detects that a specific IP address
287
00:09:15,360 --> 00:09:17,920
connected to the domain controller is malicious.
288
00:09:17,920 --> 00:09:19,160
So it blocks that IP.
289
00:09:19,160 --> 00:09:19,960
But here's the key.
290
00:09:19,960 --> 00:09:21,880
It doesn't shut down the domain controller.
291
00:09:21,880 --> 00:09:24,640
Legitimate users keep authenticating normally.
292
00:09:24,640 --> 00:09:27,000
The attacker is blocked, but your business keeps running.
293
00:09:27,000 --> 00:09:28,760
The system can distinguish malicious behavior
294
00:09:28,760 --> 00:09:29,640
from benign behavior.
295
00:09:29,640 --> 00:09:30,800
That's a huge deal.
296
00:09:30,800 --> 00:09:31,760
And speed matters.
297
00:09:31,760 --> 00:09:34,840
Microsoft says automatic attack disruption stops ransomware
298
00:09:34,840 --> 00:09:36,880
attacks in an average of just three minutes.
299
00:09:36,880 --> 00:09:37,760
Three minutes.
300
00:09:37,760 --> 00:09:39,920
The attacker doesn't have time to encrypt anything.
301
00:09:39,920 --> 00:09:41,720
The system moves faster than they do.
302
00:09:41,720 --> 00:09:43,920
And this isn't some theoretical capability.
303
00:09:43,920 --> 00:09:46,280
Microsoft disrupts about 16,000 such incidents
304
00:09:46,280 --> 00:09:47,240
every single month.
305
00:09:47,240 --> 00:09:48,520
That's happening right now.
306
00:09:48,520 --> 00:09:49,400
Think of it this way.
307
00:09:49,400 --> 00:09:51,440
Traditional antivirus is a lock on the door.
308
00:09:51,440 --> 00:09:53,600
Defender for endpoint is a security guard who
309
00:09:53,600 --> 00:09:55,320
sees someone trying to pick the lock and calls
310
00:09:55,320 --> 00:09:57,080
the police before they get inside.
311
00:09:57,080 --> 00:09:58,600
And then stays on watch to make sure they don't
312
00:09:58,600 --> 00:09:59,360
try a different door.
313
00:09:59,360 --> 00:10:00,520
That's the difference.
314
00:10:00,520 --> 00:10:03,440
But all of this works better because it's not standing alone.
315
00:10:03,440 --> 00:10:05,120
It's part of a bigger platform.
316
00:10:05,120 --> 00:10:07,920
How Defender for endpoint fits into Microsoft 365?
317
00:10:07,920 --> 00:10:10,120
Here's the thing that makes Defender for endpoint different
318
00:10:10,120 --> 00:10:11,680
from a standalone security product.
319
00:10:11,680 --> 00:10:13,240
It doesn't live in isolation.
320
00:10:13,240 --> 00:10:15,840
It's part of the Microsoft Defender XDR platform.
321
00:10:15,840 --> 00:10:18,960
And XDR stands for extended detection and response.
322
00:10:18,960 --> 00:10:21,080
What that means in plain English is that it pulls data
323
00:10:21,080 --> 00:10:23,440
from multiple sources, not just endpoints.
324
00:10:23,440 --> 00:10:25,520
So it's watching your devices, but it's also
325
00:10:25,520 --> 00:10:28,480
watching identities, email, cloud apps, and data.
326
00:10:28,480 --> 00:10:30,880
All those feeds come together into a single view.
327
00:10:30,880 --> 00:10:33,360
Let me give you a concrete example of why this matters.
328
00:10:33,360 --> 00:10:35,880
Imagine a phishing email arrives in someone's inbox.
329
00:10:35,880 --> 00:10:38,520
Defender for Office 365 flags it as suspicious,
330
00:10:38,520 --> 00:10:41,000
but the user clicks the link anyway.
331
00:10:41,000 --> 00:10:42,880
Defender for endpoint sees the malware
332
00:10:42,880 --> 00:10:44,320
trying to run on the device.
333
00:10:44,320 --> 00:10:46,880
Defender for identity watches for credential theft.
334
00:10:46,880 --> 00:10:48,600
Now, instead of three different alerts
335
00:10:48,600 --> 00:10:50,400
in three different portals, all of these
336
00:10:50,400 --> 00:10:52,240
get correlated into a single incident.
337
00:10:52,240 --> 00:10:53,240
You get one story.
338
00:10:53,240 --> 00:10:54,960
The attack is full journey from the email
339
00:10:54,960 --> 00:10:57,880
to the endpoint to the stolen credentials, all in one place.
340
00:10:57,880 --> 00:10:59,320
That's the power of XDR.
341
00:10:59,320 --> 00:11:00,840
Silent alerts from different products
342
00:11:00,840 --> 00:11:02,360
become one complete picture.
343
00:11:02,360 --> 00:11:04,840
You see the full story, not just fragments.
344
00:11:04,840 --> 00:11:06,160
And the integration goes deeper.
345
00:11:06,160 --> 00:11:08,520
If your organization uses Microsoft Sentinel,
346
00:11:08,520 --> 00:11:11,360
Defender for endpoint feeds directly into it.
347
00:11:11,360 --> 00:11:13,480
If you use Intune for device management,
348
00:11:13,480 --> 00:11:16,400
Defender enforces security policies through it.
349
00:11:16,400 --> 00:11:18,680
The same sensor handles endpoint protection, identity
350
00:11:18,680 --> 00:11:20,160
protection, and data loss prevention.
351
00:11:20,160 --> 00:11:22,880
One agent, one portal, one view of your security.
352
00:11:22,880 --> 00:11:24,880
If you're already using Microsoft 365,
353
00:11:24,880 --> 00:11:26,600
you're not starting from scratch.
354
00:11:26,600 --> 00:11:27,920
The pieces are already there.
355
00:11:27,920 --> 00:11:29,280
You just need to connect them.
356
00:11:29,280 --> 00:11:31,200
And here's the part that surprises most people.
357
00:11:31,200 --> 00:11:33,680
Defender for endpoint plan two is included
358
00:11:33,680 --> 00:11:35,400
in Microsoft 365 E5.
359
00:11:35,400 --> 00:11:37,560
If you have E5, this is already paid for,
360
00:11:37,560 --> 00:11:38,920
you're leaving protection on the table
361
00:11:38,920 --> 00:11:40,040
if you don't turn it on.
362
00:11:40,040 --> 00:11:41,360
So that's the system.
363
00:11:41,360 --> 00:11:43,360
Prevention, detection, response,
364
00:11:43,360 --> 00:11:45,720
all connected across the Microsoft ecosystem.
365
00:11:45,720 --> 00:11:47,680
But how do you actually get started?
366
00:11:47,680 --> 00:11:48,760
How to get started?
367
00:11:48,760 --> 00:11:51,000
You've heard the pitch and the technology sounds great.
368
00:11:51,000 --> 00:11:52,960
But how do you actually get this thing running?
369
00:11:52,960 --> 00:11:53,880
Let me walk you through it.
370
00:11:53,880 --> 00:11:55,720
First step, check your license.
371
00:11:55,720 --> 00:11:58,720
If you have Microsoft 365 E5 or business premium,
372
00:11:58,720 --> 00:12:00,800
you already have access to Defender for endpoint.
373
00:12:00,800 --> 00:12:01,720
It's already paid for.
374
00:12:01,720 --> 00:12:03,080
You just need to turn it on.
375
00:12:03,080 --> 00:12:06,000
That's the single biggest unlock most organizations miss.
376
00:12:06,000 --> 00:12:07,720
Second step, connect the portals.
377
00:12:07,720 --> 00:12:10,640
You need to enable the link between Intune and Defender
378
00:12:10,640 --> 00:12:11,960
so they can share data.
379
00:12:11,960 --> 00:12:13,160
Head over to security.
380
00:12:13,160 --> 00:12:16,480
Microsoft.com, navigate to settings, find the endpoint section,
381
00:12:16,480 --> 00:12:18,400
and look for the Microsoft Intune connection.
382
00:12:18,400 --> 00:12:19,360
Flip that switch on.
383
00:12:19,360 --> 00:12:22,680
Then go to Intune, Microsoft.com, find endpoint security,
384
00:12:22,680 --> 00:12:24,560
and enable the same connection on that side.
385
00:12:24,560 --> 00:12:25,640
It takes about two minutes.
386
00:12:25,640 --> 00:12:27,960
Microsoft says it could take up to 24 hours
387
00:12:27,960 --> 00:12:30,040
for the sync to complete, but in practice,
388
00:12:30,040 --> 00:12:31,360
it's usually much faster.
389
00:12:31,360 --> 00:12:33,760
Third step, onboard your devices.
390
00:12:33,760 --> 00:12:35,520
For Windows machines, the Defender sensor
391
00:12:35,520 --> 00:12:37,840
is already built into the operating system.
392
00:12:37,840 --> 00:12:38,880
You don't need to install anything.
393
00:12:38,880 --> 00:12:40,120
You just need to turn it on.
394
00:12:40,120 --> 00:12:41,880
For Mac OS Linux, Android, and iOS,
395
00:12:41,880 --> 00:12:44,240
you'll need to download and install the Defender agent.
396
00:12:44,240 --> 00:12:46,160
But once it's installed, the same policies
397
00:12:46,160 --> 00:12:47,680
apply across all platforms.
398
00:12:47,680 --> 00:12:50,080
Fourth step, create security policies.
399
00:12:50,080 --> 00:12:51,680
Microsoft provides security baselines
400
00:12:51,680 --> 00:12:53,520
that follow industry best practices.
401
00:12:53,520 --> 00:12:55,000
These are pre-configured settings
402
00:12:55,000 --> 00:12:56,800
that cover the most important protections.
403
00:12:56,800 --> 00:13:00,160
You can use them as is or customize them for your environment.
404
00:13:00,160 --> 00:13:02,920
If you're not sure where to start, just apply the baseline.
405
00:13:02,920 --> 00:13:05,040
It's better than leaving things at default.
406
00:13:05,040 --> 00:13:07,240
Fifth step, monitor and respond.
407
00:13:07,240 --> 00:13:09,080
The Defender portal gives you a single view
408
00:13:09,080 --> 00:13:11,560
of all your alerts, incidents, and device health.
409
00:13:11,560 --> 00:13:13,520
You can investigate suspicious activity,
410
00:13:13,520 --> 00:13:15,920
track your security posture, and respond to threats
411
00:13:15,920 --> 00:13:16,680
from one place.
412
00:13:16,680 --> 00:13:18,680
You don't need to jump between multiple tools.
413
00:13:18,680 --> 00:13:20,320
Now, an honest word of warning.
414
00:13:20,320 --> 00:13:22,680
If you're a small team without dedicated security staff,
415
00:13:22,680 --> 00:13:24,320
the technology alone isn't enough.
416
00:13:24,320 --> 00:13:25,600
The system generates alerts.
417
00:13:25,600 --> 00:13:26,680
Someone needs to watch them.
418
00:13:26,680 --> 00:13:28,200
Someone needs to tune the settings,
419
00:13:28,200 --> 00:13:30,360
and someone needs to respond when something happens.
420
00:13:30,360 --> 00:13:31,880
That's why many small organizations
421
00:13:31,880 --> 00:13:34,640
pay a Defender for endpoint with a managed detection
422
00:13:34,640 --> 00:13:36,280
and response service or MDR.
423
00:13:36,280 --> 00:13:37,600
It's like hiring a security guard
424
00:13:37,600 --> 00:13:39,400
to watch the cameras you just installed.
425
00:13:39,400 --> 00:13:41,840
The technology is powerful, but it still needs human eyes.
426
00:13:41,840 --> 00:13:43,400
You don't need to do all of this at once.
427
00:13:43,400 --> 00:13:44,560
Start with the basics.
428
00:13:44,560 --> 00:13:45,760
Turn on the connection.
429
00:13:45,760 --> 00:13:47,400
Onboard your devices.
430
00:13:47,400 --> 00:13:50,320
Apply the baseline and build from there.
431
00:13:50,320 --> 00:13:51,680
So that's Defender for endpoint.
432
00:13:51,680 --> 00:13:53,280
It's not just a better antivirus.
433
00:13:53,280 --> 00:13:55,600
It's a whole new way to protect your devices.
434
00:13:55,600 --> 00:13:57,120
Prevention blocks what it can.
435
00:13:57,120 --> 00:13:58,800
Detection finds what slips through
436
00:13:58,800 --> 00:14:01,680
and responds acts fast before any real damage happens.
437
00:14:01,680 --> 00:14:05,360
All three layers work together using the Microsoft 365 tools
438
00:14:05,360 --> 00:14:06,200
you already have.
439
00:14:06,200 --> 00:14:08,240
If you're not sure your current security is enough,
440
00:14:08,240 --> 00:14:10,000
drop a comment with your biggest worry.
441
00:14:10,000 --> 00:14:11,560
Subscribe to Microsoft Knowledge Nuggets
442
00:14:11,560 --> 00:14:13,240
for more plain English explanations.
443
00:14:13,240 --> 00:14:14,960
I'm Mirko Peters from M365.
444
00:14:14,960 --> 00:14:17,160
FM, thanks for listening.
00:00:00,000 --> 00:00:02,440
Antivirus used to be enough, but it isn't anymore.
2
00:00:02,440 --> 00:00:03,800
You probably remember the old days.
3
00:00:03,800 --> 00:00:07,120
In Stolar program, it scans your files and you're protected.
4
00:00:07,120 --> 00:00:08,360
Simple, that world is gone.
5
00:00:08,360 --> 00:00:11,240
Today, Ranzwer encounters are up 275%,
6
00:00:11,240 --> 00:00:14,720
and 68% of all cyber attacks now target the devices
7
00:00:14,720 --> 00:00:17,440
sitting on your desk, in your bag, or on your kitchen table.
8
00:00:17,440 --> 00:00:19,440
So what is Microsoft Defender for Endpoint?
9
00:00:19,440 --> 00:00:21,360
And why is every business talking about it?
10
00:00:21,360 --> 00:00:22,880
By the end of this episode, you'll understand
11
00:00:22,880 --> 00:00:24,440
what Endpoint security actually means.
12
00:00:24,440 --> 00:00:25,960
How Defender for Endpoint is different
13
00:00:25,960 --> 00:00:28,600
from basic antivirus and why it matters for your company.
14
00:00:28,600 --> 00:00:31,160
We'll break it down into building blocks, what it protects,
15
00:00:31,160 --> 00:00:33,760
how it protects it, and how it all fits together.
16
00:00:33,760 --> 00:00:35,560
So let's start with the basics.
17
00:00:35,560 --> 00:00:37,320
What is Endpoint security?
18
00:00:37,320 --> 00:00:38,680
First, what is an endpoint?
19
00:00:38,680 --> 00:00:41,000
It's any device that connects to your company's network,
20
00:00:41,000 --> 00:00:43,720
laptops, desktops, phones, tablets, servers,
21
00:00:43,720 --> 00:00:45,320
anything with an internet connection.
22
00:00:45,320 --> 00:00:48,800
In the office building analogy, if Microsoft 365 is your building,
23
00:00:48,800 --> 00:00:50,320
endpoints are the doors and windows.
24
00:00:50,320 --> 00:00:52,080
Every single one is a potential way in.
25
00:00:52,080 --> 00:00:54,720
Now, the old way of protecting these devices was simple.
26
00:00:54,720 --> 00:00:56,560
You installed antivirus on each machine
27
00:00:56,560 --> 00:00:57,680
and it ran on its own.
28
00:00:57,680 --> 00:00:59,880
It checked files against a list of known threats.
29
00:00:59,880 --> 00:01:01,720
And if something matched, it blocked it.
30
00:01:01,720 --> 00:01:02,640
That worked for a while.
31
00:01:02,640 --> 00:01:04,880
But attackers don't break in through the front door anymore.
32
00:01:04,880 --> 00:01:07,120
They don't use the same tools twice, they evolve.
33
00:01:07,120 --> 00:01:09,160
So Endpoint security today means something different.
34
00:01:09,160 --> 00:01:10,960
It's about protecting every device,
35
00:01:10,960 --> 00:01:12,880
not just the ones you think are important.
36
00:01:12,880 --> 00:01:15,880
You need to watch for behavior, not just look for known bad files.
37
00:01:15,880 --> 00:01:18,240
And you need to build a security system around every device,
38
00:01:18,240 --> 00:01:20,000
not just install one piece of software.
39
00:01:20,000 --> 00:01:22,000
Here's the thing though, most people still think
40
00:01:22,000 --> 00:01:24,000
of endpoint security as antivirus.
41
00:01:24,000 --> 00:01:25,760
And that's where the problem starts.
42
00:01:25,760 --> 00:01:27,760
Why traditional antivirus isn't enough?
43
00:01:27,760 --> 00:01:30,200
Let's talk about what traditional antivirus actually does.
44
00:01:30,200 --> 00:01:33,080
It scans files, checks them against a list of known threats,
45
00:01:33,080 --> 00:01:35,920
signatures they're called, and blocks anything that matches.
46
00:01:35,920 --> 00:01:38,840
It's like having a security guard who only checks a wanted poster.
47
00:01:38,840 --> 00:01:41,200
If the thief isn't on the poster, they walk right past.
48
00:01:41,200 --> 00:01:42,680
And that's the core limitation.
49
00:01:42,680 --> 00:01:45,880
Signature-based detection only catches what's already been seen.
50
00:01:45,880 --> 00:01:47,720
Modern attacks are adaptive, targeted,
51
00:01:47,720 --> 00:01:50,040
and often use brand new or custom malware.
52
00:01:50,040 --> 00:01:51,960
Attackers don't use the same tools twice.
53
00:01:51,960 --> 00:01:52,560
They evolve.
54
00:01:52,560 --> 00:01:54,240
Traditional antivirus can't keep up.
55
00:01:54,240 --> 00:01:55,560
The numbers back this up.
56
00:01:55,560 --> 00:01:57,400
AI-powered endpoint protection now achieves
57
00:01:57,400 --> 00:01:59,600
an 89% automatic detection rate.
58
00:01:59,600 --> 00:02:00,640
Traditional antivirus?
59
00:02:00,640 --> 00:02:01,880
Just 42%.
60
00:02:01,880 --> 00:02:02,960
That's a massive gap.
61
00:02:02,960 --> 00:02:05,360
And it's not just about missing the initial attack.
62
00:02:05,360 --> 00:02:07,160
Traditional antivirus has no visibility
63
00:02:07,160 --> 00:02:08,920
into what happens after a breach starts.
64
00:02:08,920 --> 00:02:11,160
An attacker might already be inside your network,
65
00:02:11,160 --> 00:02:12,720
moving from machine to machine.
66
00:02:12,720 --> 00:02:14,240
And traditional AV wouldn't know.
67
00:02:14,240 --> 00:02:15,520
It has no eyes on behavior.
68
00:02:15,520 --> 00:02:17,920
So you need something that watches for unusual behavior,
69
00:02:17,920 --> 00:02:19,680
not just known bad files.
70
00:02:19,680 --> 00:02:22,040
You need something that can see the attacker moving,
71
00:02:22,040 --> 00:02:24,600
even if the file they're using has never been seen before.
72
00:02:24,600 --> 00:02:26,720
That's where Defender for Endpoint comes in.
73
00:02:26,720 --> 00:02:28,320
What is Defender for Endpoint?
74
00:02:28,320 --> 00:02:30,840
So what does Defender for Endpoint actually do?
75
00:02:30,840 --> 00:02:31,680
Let's look at it.
76
00:02:31,680 --> 00:02:33,800
Microsoft Defender for Endpoint is a cloud-powered
77
00:02:33,800 --> 00:02:35,360
endpoint security platform.
78
00:02:35,360 --> 00:02:36,800
That's the official definition.
79
00:02:36,800 --> 00:02:38,720
But here's what that means in plain English.
80
00:02:38,720 --> 00:02:39,960
It's not a single product.
81
00:02:39,960 --> 00:02:41,360
It's a collection of capabilities
82
00:02:41,360 --> 00:02:43,520
that work together to protect your devices.
83
00:02:43,520 --> 00:02:46,160
Think of it as three main pillars, prevention, detection,
84
00:02:46,160 --> 00:02:46,960
and response.
85
00:02:46,960 --> 00:02:48,960
Prevention stops attacks before they happen.
86
00:02:48,960 --> 00:02:51,080
Detection finds the ones that get through anyway.
87
00:02:51,080 --> 00:02:52,680
And response automatically contains
88
00:02:52,680 --> 00:02:53,760
and investigates them.
89
00:02:53,760 --> 00:02:56,000
Traditional antivirus is a lock on the door.
90
00:02:56,000 --> 00:02:57,880
Defender for Endpoint is a security system
91
00:02:57,880 --> 00:03:00,560
with cameras, motion sensors, and a team watching the monitors.
92
00:03:00,560 --> 00:03:02,600
Now one thing that trips people up is the naming.
93
00:03:02,600 --> 00:03:04,480
Defender for Endpoint isn't just for Windows.
94
00:03:04,480 --> 00:03:07,600
It protects devices across Windows, Mac OS, Linux, Android,
95
00:03:07,600 --> 00:03:08,720
and iOS.
96
00:03:08,720 --> 00:03:10,480
Whether your team is in the office at home
97
00:03:10,480 --> 00:03:13,240
or working from a coffee shop, the same protection follows them.
98
00:03:13,240 --> 00:03:14,400
There are two plans.
99
00:03:14,400 --> 00:03:16,680
Plan one gives you basic protection.
100
00:03:16,680 --> 00:03:19,400
Next, Gen Antivirus, attack surface reduction,
101
00:03:19,400 --> 00:03:20,880
and some basic detection.
102
00:03:20,880 --> 00:03:22,880
Plan two is where the real power lives.
103
00:03:22,880 --> 00:03:25,400
That's the full EDR suite with advanced hunting,
104
00:03:25,400 --> 00:03:28,640
automated investigation, and six months of telemetry retention.
105
00:03:28,640 --> 00:03:30,320
And here's the part most people miss.
106
00:03:30,320 --> 00:03:33,200
Plan two is included in Microsoft 365 E5.
107
00:03:33,200 --> 00:03:35,160
If you already have E5, you already have this.
108
00:03:35,160 --> 00:03:36,200
You just need to turn it on.
109
00:03:36,200 --> 00:03:37,560
The key differentiator is this.
110
00:03:37,560 --> 00:03:38,640
It's not just antivirus.
111
00:03:38,640 --> 00:03:41,240
It's an Endpoint detection and response platform.
112
00:03:41,240 --> 00:03:43,880
And that changes everything about how you think about security.
113
00:03:43,880 --> 00:03:45,560
Let's break down what that actually means,
114
00:03:45,560 --> 00:03:47,440
starting with the first layer.
115
00:03:47,440 --> 00:03:48,960
Next, Generation Protection.
116
00:03:48,960 --> 00:03:50,320
This is the prevention layer.
117
00:03:50,320 --> 00:03:52,560
It's what most people think of as antivirus.
118
00:03:52,560 --> 00:03:54,040
But it's actually much smarter than that
119
00:03:54,040 --> 00:03:56,240
because it uses machine learning and behavior analysis
120
00:03:56,240 --> 00:03:58,280
instead of just looking for known viruses.
121
00:03:58,280 --> 00:04:00,560
Next, Generation Protection uses machine learning,
122
00:04:00,560 --> 00:04:03,320
behavior analysis, and cloud-based threat intelligence
123
00:04:03,320 --> 00:04:04,880
to detect suspicious behavior,
124
00:04:04,880 --> 00:04:07,240
rather than just flagging known bad files.
125
00:04:07,240 --> 00:04:09,680
So if a script tries to modify system files,
126
00:04:09,680 --> 00:04:11,840
even if it's not a known virus, the system catches it
127
00:04:11,840 --> 00:04:13,280
because the behavior is unusual.
128
00:04:13,280 --> 00:04:15,800
It's like a security guard who notices someone acting nervous
129
00:04:15,800 --> 00:04:17,680
even if they're not on the wanted list.
130
00:04:17,680 --> 00:04:20,440
The guard doesn't need to recognize the person just the behavior.
131
00:04:20,440 --> 00:04:22,720
Part of this is attack surface reduction.
132
00:04:22,720 --> 00:04:25,160
Tiny rules that block common attack techniques.
133
00:04:25,160 --> 00:04:27,080
For example, blocking macros from office files
134
00:04:27,080 --> 00:04:28,400
downloaded from the internet
135
00:04:28,400 --> 00:04:30,920
or preventing USB drives from running scripts.
136
00:04:30,920 --> 00:04:32,640
These are small things, but they shut down
137
00:04:32,640 --> 00:04:34,280
the method attackers use most.
138
00:04:34,280 --> 00:04:36,760
In the 2024 Miterat tank evaluation,
139
00:04:36,760 --> 00:04:39,480
Defender for Endpoint delivered 100% protection.
140
00:04:39,480 --> 00:04:41,160
That's not a marketing claim.
141
00:04:41,160 --> 00:04:44,160
It's an independent test against real world attack scenarios.
142
00:04:44,160 --> 00:04:46,120
This layer runs automatically.
143
00:04:46,120 --> 00:04:47,280
You don't have to think about it.
144
00:04:47,280 --> 00:04:49,640
No manual scanning, no scheduled updates.
145
00:04:49,640 --> 00:04:51,040
It just works in the background,
146
00:04:51,040 --> 00:04:52,480
but prevention isn't perfect.
147
00:04:52,480 --> 00:04:54,080
No system catches everything.
148
00:04:54,080 --> 00:04:56,080
That's where the next layer comes in.
149
00:04:56,080 --> 00:04:58,560
Endpoint detection and response, EDR.
150
00:04:58,560 --> 00:05:01,480
So prevention catches a lot, but it doesn't catch everything.
151
00:05:01,480 --> 00:05:02,640
That's where EDR comes in.
152
00:05:02,640 --> 00:05:05,160
EDR stands for endpoint detection and response
153
00:05:05,160 --> 00:05:07,320
and it's what happens after an attack gets through.
154
00:05:07,320 --> 00:05:08,160
Think of it this way.
155
00:05:08,160 --> 00:05:10,040
Prevention is the lock on your front door.
156
00:05:10,040 --> 00:05:12,040
And EDR is the motion sensor in your hallway
157
00:05:12,040 --> 00:05:14,520
that alerts you when someone's already inside.
158
00:05:14,520 --> 00:05:16,240
Every device running Defender for Endpoint
159
00:05:16,240 --> 00:05:18,640
sends telemetry data to the cloud constantly.
160
00:05:18,640 --> 00:05:21,040
File changes, process launches, network connections,
161
00:05:21,040 --> 00:05:22,280
registry edits.
162
00:05:22,280 --> 00:05:23,960
The sensors are always watching.
163
00:05:23,960 --> 00:05:25,840
And this data gets analyzed by AI
164
00:05:25,840 --> 00:05:27,280
to detect suspicious patterns.
165
00:05:27,280 --> 00:05:29,000
It's like having cameras in every room
166
00:05:29,000 --> 00:05:31,080
with an AI that watches all the feeds at once
167
00:05:31,080 --> 00:05:32,600
and flags anything unusual.
168
00:05:32,600 --> 00:05:34,200
Security teams can actually search
169
00:05:34,200 --> 00:05:36,560
across all their devices for signs of compromise.
170
00:05:36,560 --> 00:05:37,920
This is called threat hunting.
171
00:05:37,920 --> 00:05:39,800
You can ask a question like, has anyone run
172
00:05:39,800 --> 00:05:41,120
the suspicious command?
173
00:05:41,120 --> 00:05:43,440
And get answers in seconds, not hours.
174
00:05:43,440 --> 00:05:45,680
And because telemetry is stored for up to six months
175
00:05:45,680 --> 00:05:47,440
with Plan 2, you can investigate attacks
176
00:05:47,440 --> 00:05:48,480
that happen months ago.
177
00:05:48,480 --> 00:05:51,080
An attack that came in through a fishing email back in January,
178
00:05:51,080 --> 00:05:52,560
you can still trace it in June.
179
00:05:52,560 --> 00:05:54,960
That lets you map out exactly how an attacker got in
180
00:05:54,960 --> 00:05:56,160
and what they touched.
181
00:05:56,160 --> 00:05:59,280
A user clicks a fishing link, but nothing happens immediately.
182
00:05:59,280 --> 00:06:01,760
No malware drops, no files getting crypted.
183
00:06:01,760 --> 00:06:03,480
Everything looks normal.
184
00:06:03,480 --> 00:06:05,520
Weeks later, the attacker tries to move
185
00:06:05,520 --> 00:06:06,840
literally across the network.
186
00:06:06,840 --> 00:06:08,560
That's when EDR catches it.
187
00:06:08,560 --> 00:06:10,120
The initial infection wasn't obvious,
188
00:06:10,120 --> 00:06:12,480
but the behavior after the attacker trying to hop
189
00:06:12,480 --> 00:06:14,960
from one machine to another is what EDR finds.
190
00:06:14,960 --> 00:06:16,600
Instead of getting 50 separate alerts,
191
00:06:16,600 --> 00:06:17,760
you get one incident view.
192
00:06:17,760 --> 00:06:19,640
All the alerts from multiple devices
193
00:06:19,640 --> 00:06:21,840
get grouped together into a single story.
194
00:06:21,840 --> 00:06:24,960
The attacker's whole journey mapped out from start to finish.
195
00:06:24,960 --> 00:06:27,240
Instead of 50 puzzle pieces scattered across your screen,
196
00:06:27,240 --> 00:06:28,560
you get the full picture.
197
00:06:28,560 --> 00:06:31,240
But finding an attack is only half the battle.
198
00:06:31,240 --> 00:06:32,920
You also need to understand your weaknesses
199
00:06:32,920 --> 00:06:35,680
before an attacker finds them.
200
00:06:35,680 --> 00:06:38,080
Vulnerability, management, and threat analytics.
201
00:06:38,080 --> 00:06:40,160
So we've talked about prevention and detection,
202
00:06:40,160 --> 00:06:42,160
but there's another layer that traditional antivirus
203
00:06:42,160 --> 00:06:43,080
never touched.
204
00:06:43,080 --> 00:06:44,800
This is the Know Your Weaknesses layer.
205
00:06:44,800 --> 00:06:45,640
And it's a big deal.
206
00:06:45,640 --> 00:06:46,960
Defender for endpoint constantly
207
00:06:46,960 --> 00:06:49,120
scans your devices for missing patches,
208
00:06:49,120 --> 00:06:51,200
weak configurations, and exposed settings.
209
00:06:51,200 --> 00:06:52,200
It doesn't wait for an attack.
210
00:06:52,200 --> 00:06:54,040
It tells you upfront, hey, these 50 devices
211
00:06:54,040 --> 00:06:55,840
are missing a critical Windows update.
212
00:06:55,840 --> 00:06:56,880
Fix them first.
213
00:06:56,880 --> 00:06:57,760
That's proactive.
214
00:06:57,760 --> 00:06:59,760
Old-school antivirus would just sit there.
215
00:06:59,760 --> 00:07:00,640
But here's the thing.
216
00:07:00,640 --> 00:07:03,000
Not all vulnerabilities are created equal.
217
00:07:03,000 --> 00:07:04,720
Some are critical, some are minor.
218
00:07:04,720 --> 00:07:07,880
And some are actively being exploited by attackers right now
219
00:07:07,880 --> 00:07:08,840
out in the wild.
220
00:07:08,840 --> 00:07:11,640
Defender uses something called exploit prediction data,
221
00:07:11,640 --> 00:07:14,520
EPSS for short, to figure out what's most likely to be hit.
222
00:07:14,520 --> 00:07:15,880
You don't have to fix everything.
223
00:07:15,880 --> 00:07:17,920
You fix the things that actually matter.
224
00:07:17,920 --> 00:07:19,120
That's the smart approach.
225
00:07:19,120 --> 00:07:21,920
The system also does something called attack path modeling.
226
00:07:21,920 --> 00:07:23,440
Imagine a map of your office building
227
00:07:23,440 --> 00:07:25,840
showing every possible route a burglar could take.
228
00:07:25,840 --> 00:07:27,800
Maybe one device has an outdated browser.
229
00:07:27,800 --> 00:07:29,200
Another has a weak password.
230
00:07:29,200 --> 00:07:30,600
Separately, those are minor issues.
231
00:07:30,600 --> 00:07:32,880
But chain together, they become a clear path
232
00:07:32,880 --> 00:07:34,320
to your most sensitive files.
233
00:07:34,320 --> 00:07:35,440
That's exactly what this does.
234
00:07:35,440 --> 00:07:36,960
It shows how an attacker could connect
235
00:07:36,960 --> 00:07:39,280
the dots from one vulnerability to the next.
236
00:07:39,280 --> 00:07:40,920
So instead of guessing what to patch next,
237
00:07:40,920 --> 00:07:43,440
your security team gets a clear prioritized list.
238
00:07:43,440 --> 00:07:44,720
No guesswork, no panic.
239
00:07:44,720 --> 00:07:47,000
Just a road map, you know exactly what to fix first.
240
00:07:47,000 --> 00:07:49,320
But what happens when an attack is already in progress?
241
00:07:49,320 --> 00:07:51,080
That's where automation kicks in.
242
00:07:51,080 --> 00:07:53,320
Automated investigation and attack disruption.
243
00:07:53,320 --> 00:07:54,800
So prevention blocks what it can.
244
00:07:54,800 --> 00:07:56,240
Detection finds what gets through.
245
00:07:56,240 --> 00:07:58,400
But what about when an attack is happening right now?
246
00:07:58,400 --> 00:08:00,560
In real time, that's the response layer.
247
00:08:00,560 --> 00:08:02,600
And honestly, this might be the most impressive part
248
00:08:02,600 --> 00:08:03,440
of the whole system.
249
00:08:03,440 --> 00:08:05,280
When Defender for Endpoint detects a threat,
250
00:08:05,280 --> 00:08:06,800
it doesn't just fire off an alert
251
00:08:06,800 --> 00:08:08,040
and hope someone sees it.
252
00:08:08,040 --> 00:08:08,840
It acts.
253
00:08:08,840 --> 00:08:10,480
The system runs automated playbooks
254
00:08:10,480 --> 00:08:12,240
to figure out if the alert is real.
255
00:08:12,240 --> 00:08:15,360
It asks questions like, is this file actually malicious?
256
00:08:15,360 --> 00:08:16,440
Is it on other devices?
257
00:08:16,440 --> 00:08:18,320
Has it connected to known bad servers?
258
00:08:18,320 --> 00:08:20,680
It does all of this in seconds, not hours.
259
00:08:20,680 --> 00:08:22,840
Think about how long it would take a human to do that.
260
00:08:22,840 --> 00:08:25,480
If the threat is confirmed, the system takes action.
261
00:08:25,480 --> 00:08:27,280
It isolates the device from the network.
262
00:08:27,280 --> 00:08:29,000
Blocks the file, removes the threat.
263
00:08:29,000 --> 00:08:30,680
The machine gets cut off before the attacker
264
00:08:30,680 --> 00:08:32,000
can spread to anything else.
265
00:08:32,000 --> 00:08:33,400
No human has to click a button.
266
00:08:33,400 --> 00:08:35,800
The system just does it automatically.
267
00:08:35,800 --> 00:08:37,400
But there's an even more advanced version
268
00:08:37,400 --> 00:08:39,480
called automatic attack disruption.
269
00:08:39,480 --> 00:08:41,200
And this is where things get really interesting.
270
00:08:41,200 --> 00:08:44,320
Attack disruption uses AI to predict what the attacker will do
271
00:08:44,320 --> 00:08:46,400
next and blocks it before they can try.
272
00:08:46,400 --> 00:08:48,080
It's not reacting to what already happened.
273
00:08:48,080 --> 00:08:49,560
It's anticipating the next move.
274
00:08:49,560 --> 00:08:51,200
That's a whole different level.
275
00:08:51,200 --> 00:08:53,720
Here's a real example from Microsoft's own research.
276
00:08:53,720 --> 00:08:56,360
Imagine an attacker gets access to your domain controller.
277
00:08:56,360 --> 00:08:58,600
That's the server that handles user authentication
278
00:08:58,600 --> 00:09:00,280
across your entire organization.
279
00:09:00,280 --> 00:09:02,000
In most security setups, you can't just
280
00:09:02,000 --> 00:09:03,400
shut down the domain controller.
281
00:09:03,400 --> 00:09:04,480
It's too critical.
282
00:09:04,480 --> 00:09:06,960
So other solutions would isolate the compromised machines
283
00:09:06,960 --> 00:09:09,960
around it, but leave the domain controller itself exposed.
284
00:09:09,960 --> 00:09:11,400
The attacker can still pivot.
285
00:09:11,400 --> 00:09:13,440
Defender for endpoint handles this differently.
286
00:09:13,440 --> 00:09:15,360
It detects that a specific IP address
287
00:09:15,360 --> 00:09:17,920
connected to the domain controller is malicious.
288
00:09:17,920 --> 00:09:19,160
So it blocks that IP.
289
00:09:19,160 --> 00:09:19,960
But here's the key.
290
00:09:19,960 --> 00:09:21,880
It doesn't shut down the domain controller.
291
00:09:21,880 --> 00:09:24,640
Legitimate users keep authenticating normally.
292
00:09:24,640 --> 00:09:27,000
The attacker is blocked, but your business keeps running.
293
00:09:27,000 --> 00:09:28,760
The system can distinguish malicious behavior
294
00:09:28,760 --> 00:09:29,640
from benign behavior.
295
00:09:29,640 --> 00:09:30,800
That's a huge deal.
296
00:09:30,800 --> 00:09:31,760
And speed matters.
297
00:09:31,760 --> 00:09:34,840
Microsoft says automatic attack disruption stops ransomware
298
00:09:34,840 --> 00:09:36,880
attacks in an average of just three minutes.
299
00:09:36,880 --> 00:09:37,760
Three minutes.
300
00:09:37,760 --> 00:09:39,920
The attacker doesn't have time to encrypt anything.
301
00:09:39,920 --> 00:09:41,720
The system moves faster than they do.
302
00:09:41,720 --> 00:09:43,920
And this isn't some theoretical capability.
303
00:09:43,920 --> 00:09:46,280
Microsoft disrupts about 16,000 such incidents
304
00:09:46,280 --> 00:09:47,240
every single month.
305
00:09:47,240 --> 00:09:48,520
That's happening right now.
306
00:09:48,520 --> 00:09:49,400
Think of it this way.
307
00:09:49,400 --> 00:09:51,440
Traditional antivirus is a lock on the door.
308
00:09:51,440 --> 00:09:53,600
Defender for endpoint is a security guard who
309
00:09:53,600 --> 00:09:55,320
sees someone trying to pick the lock and calls
310
00:09:55,320 --> 00:09:57,080
the police before they get inside.
311
00:09:57,080 --> 00:09:58,600
And then stays on watch to make sure they don't
312
00:09:58,600 --> 00:09:59,360
try a different door.
313
00:09:59,360 --> 00:10:00,520
That's the difference.
314
00:10:00,520 --> 00:10:03,440
But all of this works better because it's not standing alone.
315
00:10:03,440 --> 00:10:05,120
It's part of a bigger platform.
316
00:10:05,120 --> 00:10:07,920
How Defender for endpoint fits into Microsoft 365?
317
00:10:07,920 --> 00:10:10,120
Here's the thing that makes Defender for endpoint different
318
00:10:10,120 --> 00:10:11,680
from a standalone security product.
319
00:10:11,680 --> 00:10:13,240
It doesn't live in isolation.
320
00:10:13,240 --> 00:10:15,840
It's part of the Microsoft Defender XDR platform.
321
00:10:15,840 --> 00:10:18,960
And XDR stands for extended detection and response.
322
00:10:18,960 --> 00:10:21,080
What that means in plain English is that it pulls data
323
00:10:21,080 --> 00:10:23,440
from multiple sources, not just endpoints.
324
00:10:23,440 --> 00:10:25,520
So it's watching your devices, but it's also
325
00:10:25,520 --> 00:10:28,480
watching identities, email, cloud apps, and data.
326
00:10:28,480 --> 00:10:30,880
All those feeds come together into a single view.
327
00:10:30,880 --> 00:10:33,360
Let me give you a concrete example of why this matters.
328
00:10:33,360 --> 00:10:35,880
Imagine a phishing email arrives in someone's inbox.
329
00:10:35,880 --> 00:10:38,520
Defender for Office 365 flags it as suspicious,
330
00:10:38,520 --> 00:10:41,000
but the user clicks the link anyway.
331
00:10:41,000 --> 00:10:42,880
Defender for endpoint sees the malware
332
00:10:42,880 --> 00:10:44,320
trying to run on the device.
333
00:10:44,320 --> 00:10:46,880
Defender for identity watches for credential theft.
334
00:10:46,880 --> 00:10:48,600
Now, instead of three different alerts
335
00:10:48,600 --> 00:10:50,400
in three different portals, all of these
336
00:10:50,400 --> 00:10:52,240
get correlated into a single incident.
337
00:10:52,240 --> 00:10:53,240
You get one story.
338
00:10:53,240 --> 00:10:54,960
The attack is full journey from the email
339
00:10:54,960 --> 00:10:57,880
to the endpoint to the stolen credentials, all in one place.
340
00:10:57,880 --> 00:10:59,320
That's the power of XDR.
341
00:10:59,320 --> 00:11:00,840
Silent alerts from different products
342
00:11:00,840 --> 00:11:02,360
become one complete picture.
343
00:11:02,360 --> 00:11:04,840
You see the full story, not just fragments.
344
00:11:04,840 --> 00:11:06,160
And the integration goes deeper.
345
00:11:06,160 --> 00:11:08,520
If your organization uses Microsoft Sentinel,
346
00:11:08,520 --> 00:11:11,360
Defender for endpoint feeds directly into it.
347
00:11:11,360 --> 00:11:13,480
If you use Intune for device management,
348
00:11:13,480 --> 00:11:16,400
Defender enforces security policies through it.
349
00:11:16,400 --> 00:11:18,680
The same sensor handles endpoint protection, identity
350
00:11:18,680 --> 00:11:20,160
protection, and data loss prevention.
351
00:11:20,160 --> 00:11:22,880
One agent, one portal, one view of your security.
352
00:11:22,880 --> 00:11:24,880
If you're already using Microsoft 365,
353
00:11:24,880 --> 00:11:26,600
you're not starting from scratch.
354
00:11:26,600 --> 00:11:27,920
The pieces are already there.
355
00:11:27,920 --> 00:11:29,280
You just need to connect them.
356
00:11:29,280 --> 00:11:31,200
And here's the part that surprises most people.
357
00:11:31,200 --> 00:11:33,680
Defender for endpoint plan two is included
358
00:11:33,680 --> 00:11:35,400
in Microsoft 365 E5.
359
00:11:35,400 --> 00:11:37,560
If you have E5, this is already paid for,
360
00:11:37,560 --> 00:11:38,920
you're leaving protection on the table
361
00:11:38,920 --> 00:11:40,040
if you don't turn it on.
362
00:11:40,040 --> 00:11:41,360
So that's the system.
363
00:11:41,360 --> 00:11:43,360
Prevention, detection, response,
364
00:11:43,360 --> 00:11:45,720
all connected across the Microsoft ecosystem.
365
00:11:45,720 --> 00:11:47,680
But how do you actually get started?
366
00:11:47,680 --> 00:11:48,760
How to get started?
367
00:11:48,760 --> 00:11:51,000
You've heard the pitch and the technology sounds great.
368
00:11:51,000 --> 00:11:52,960
But how do you actually get this thing running?
369
00:11:52,960 --> 00:11:53,880
Let me walk you through it.
370
00:11:53,880 --> 00:11:55,720
First step, check your license.
371
00:11:55,720 --> 00:11:58,720
If you have Microsoft 365 E5 or business premium,
372
00:11:58,720 --> 00:12:00,800
you already have access to Defender for endpoint.
373
00:12:00,800 --> 00:12:01,720
It's already paid for.
374
00:12:01,720 --> 00:12:03,080
You just need to turn it on.
375
00:12:03,080 --> 00:12:06,000
That's the single biggest unlock most organizations miss.
376
00:12:06,000 --> 00:12:07,720
Second step, connect the portals.
377
00:12:07,720 --> 00:12:10,640
You need to enable the link between Intune and Defender
378
00:12:10,640 --> 00:12:11,960
so they can share data.
379
00:12:11,960 --> 00:12:13,160
Head over to security.
380
00:12:13,160 --> 00:12:16,480
Microsoft.com, navigate to settings, find the endpoint section,
381
00:12:16,480 --> 00:12:18,400
and look for the Microsoft Intune connection.
382
00:12:18,400 --> 00:12:19,360
Flip that switch on.
383
00:12:19,360 --> 00:12:22,680
Then go to Intune, Microsoft.com, find endpoint security,
384
00:12:22,680 --> 00:12:24,560
and enable the same connection on that side.
385
00:12:24,560 --> 00:12:25,640
It takes about two minutes.
386
00:12:25,640 --> 00:12:27,960
Microsoft says it could take up to 24 hours
387
00:12:27,960 --> 00:12:30,040
for the sync to complete, but in practice,
388
00:12:30,040 --> 00:12:31,360
it's usually much faster.
389
00:12:31,360 --> 00:12:33,760
Third step, onboard your devices.
390
00:12:33,760 --> 00:12:35,520
For Windows machines, the Defender sensor
391
00:12:35,520 --> 00:12:37,840
is already built into the operating system.
392
00:12:37,840 --> 00:12:38,880
You don't need to install anything.
393
00:12:38,880 --> 00:12:40,120
You just need to turn it on.
394
00:12:40,120 --> 00:12:41,880
For Mac OS Linux, Android, and iOS,
395
00:12:41,880 --> 00:12:44,240
you'll need to download and install the Defender agent.
396
00:12:44,240 --> 00:12:46,160
But once it's installed, the same policies
397
00:12:46,160 --> 00:12:47,680
apply across all platforms.
398
00:12:47,680 --> 00:12:50,080
Fourth step, create security policies.
399
00:12:50,080 --> 00:12:51,680
Microsoft provides security baselines
400
00:12:51,680 --> 00:12:53,520
that follow industry best practices.
401
00:12:53,520 --> 00:12:55,000
These are pre-configured settings
402
00:12:55,000 --> 00:12:56,800
that cover the most important protections.
403
00:12:56,800 --> 00:13:00,160
You can use them as is or customize them for your environment.
404
00:13:00,160 --> 00:13:02,920
If you're not sure where to start, just apply the baseline.
405
00:13:02,920 --> 00:13:05,040
It's better than leaving things at default.
406
00:13:05,040 --> 00:13:07,240
Fifth step, monitor and respond.
407
00:13:07,240 --> 00:13:09,080
The Defender portal gives you a single view
408
00:13:09,080 --> 00:13:11,560
of all your alerts, incidents, and device health.
409
00:13:11,560 --> 00:13:13,520
You can investigate suspicious activity,
410
00:13:13,520 --> 00:13:15,920
track your security posture, and respond to threats
411
00:13:15,920 --> 00:13:16,680
from one place.
412
00:13:16,680 --> 00:13:18,680
You don't need to jump between multiple tools.
413
00:13:18,680 --> 00:13:20,320
Now, an honest word of warning.
414
00:13:20,320 --> 00:13:22,680
If you're a small team without dedicated security staff,
415
00:13:22,680 --> 00:13:24,320
the technology alone isn't enough.
416
00:13:24,320 --> 00:13:25,600
The system generates alerts.
417
00:13:25,600 --> 00:13:26,680
Someone needs to watch them.
418
00:13:26,680 --> 00:13:28,200
Someone needs to tune the settings,
419
00:13:28,200 --> 00:13:30,360
and someone needs to respond when something happens.
420
00:13:30,360 --> 00:13:31,880
That's why many small organizations
421
00:13:31,880 --> 00:13:34,640
pay a Defender for endpoint with a managed detection
422
00:13:34,640 --> 00:13:36,280
and response service or MDR.
423
00:13:36,280 --> 00:13:37,600
It's like hiring a security guard
424
00:13:37,600 --> 00:13:39,400
to watch the cameras you just installed.
425
00:13:39,400 --> 00:13:41,840
The technology is powerful, but it still needs human eyes.
426
00:13:41,840 --> 00:13:43,400
You don't need to do all of this at once.
427
00:13:43,400 --> 00:13:44,560
Start with the basics.
428
00:13:44,560 --> 00:13:45,760
Turn on the connection.
429
00:13:45,760 --> 00:13:47,400
Onboard your devices.
430
00:13:47,400 --> 00:13:50,320
Apply the baseline and build from there.
431
00:13:50,320 --> 00:13:51,680
So that's Defender for endpoint.
432
00:13:51,680 --> 00:13:53,280
It's not just a better antivirus.
433
00:13:53,280 --> 00:13:55,600
It's a whole new way to protect your devices.
434
00:13:55,600 --> 00:13:57,120
Prevention blocks what it can.
435
00:13:57,120 --> 00:13:58,800
Detection finds what slips through
436
00:13:58,800 --> 00:14:01,680
and responds acts fast before any real damage happens.
437
00:14:01,680 --> 00:14:05,360
All three layers work together using the Microsoft 365 tools
438
00:14:05,360 --> 00:14:06,200
you already have.
439
00:14:06,200 --> 00:14:08,240
If you're not sure your current security is enough,
440
00:14:08,240 --> 00:14:10,000
drop a comment with your biggest worry.
441
00:14:10,000 --> 00:14:11,560
Subscribe to Microsoft Knowledge Nuggets
442
00:14:11,560 --> 00:14:13,240
for more plain English explanations.
443
00:14:13,240 --> 00:14:14,960
I'm Mirko Peters from M365.
444
00:14:14,960 --> 00:14:17,160
FM, thanks for listening.
