Battle Bitdefender Total Security or Microsoft Defender — Who Wins for Everyday PC Users?

[Trident]

Please see my computer configuration Core i3 3rd Generation processor DDR3 RAM 8 GB, 128 GB SSD & 500 GB HDD.

Yeah I would assume scans are slow… anyway, TM scans are way quicker…

 

[Andy Ful]

Bitdefender depending on the region could include scam protection, which is more suitable for elderly people. Bitdefender removes SCAM emails and texts based on LLM analysis (offloaded to the OpenAI API it seems) and this aids malware detection too.

Yes, Anti-SCAM features are welcome for most people. But something like the Osprey extension + SmartScreen can probably protect as well (although later in the attack chain).

In addition, it’s easy for someone to manage their elderly parents’ Bitdefender through the Central.

Yes, this can be an advantage. However, in most cases, you can use Microsoft Quick Assist as well.

Microsoft Defender remains just an antivirus, how effective it is, is highly questionable and has always been.

One can try to get some insight from AV tests. But, most tests are similar to guessing if the person is nice because of a nice face.
Anyway, they suggest that Bitdefender protection can be slightly higher. But as you have noticed, those tests are questionable.

A lot of MSPs swore by Microsoft Defender for Business and a lot of them dropped partnerships and usage.

It is better to skip the discussion about the MD business versions. This could put Bitdefender in a worse position.

Post edited.

 

[Trident]

It is better to skip the discussion about the MD business versions. This could put Bitdefender in a worse position.

Yeah, Bitdefender is not really MSPs favourite either.

The AV tests are similar to guessing if the person is nice because of a nice face.
Anyway, they suggests that Bitdefender protection can be slightly higher. But as you have noticed, those tests are questionable.

The tests place Bitdefender higher by a very small and negligible margin (according to the test). The real protection will come from blocking SCAM tactics and websites which unfortunately extort way more than malware and require less skills. But these protections are not worldwide. Anyway, the most common scams are not worldwide either.

In this direction Defender cannot help.

Yes, this can be an advantage. However, in most cases, you can use Microsoft Quick Assist as well.

Defender anyway is fairly automated and the built-in settings are 5 toggles, on by default (I think only the OneDrive ransomware protection is off by default).
I don’t think there is a lot to assist, malware usually is removed automatically and Defender remediation is quite deep.

 

[Andy Ful]

Defender anyway is fairly automated and the built-in settings are 5 toggles, on by default (I think only the OneDrive ransomware protection is off by default).
I don’t think there is a lot to assist, malware usually is removed automatically and Defender remediation is quite deep.

It is a lot to assist when you use advanced settings (via ConfigureDefender, etc.). I do not think about malware, but rather about possible blocks and false positives.

 

[Trident]

It is a lot to assist when you use advanced settings (via ConfigureDefender, etc.). I do not think about malware, but rather about possible blocks and false positives.

Yeah that depends on the usage, for the parents and the girlfriend that only use the browser and 5-6 installed apps, it may be ok.
Though for such people Chrome OS/Chrome OS Flex could be considered too.

Problem will be for people who like to download files/software all the time or in the cases where Macros may need to be used (a lot of people cried that the new Outlook doesn’t support VBA, so they are still very popular). I do use VBA heavily myself, I don’t imagine a life without it.

For these people it may be best to just activate network protection and nothing more than that.

 

[Andy Ful]

Problem will be for people who like to download files all the time or in the cases where Macros may need to be used (a lot of people cried that the new Outlook doesn’t support VBA, so they are still very popular). I do use VBA heavily myself, I don’t imagine a life without it.

For these people it may be best to just activate network protection and nothing more than that.

You can use the FirewallHardening tool + ConfigureDefender (ASR rules + Network Protection). It would be a stronger (and free) alternative.
In many cases, VBA-related malware does not need to call home.

 

[Trident]

You can use the FirewallHardening tool + ConfigureDefender (ASR rules + Network Protection). It would be a stronger (and free) alternative.
In many cases, VBA-related malware does not need to call home.

Oh yeah for my projects that often use online APIs (and then my proprietary JSON parsing) it won’t be too amazing though. I really like to play with VBA, for example for time I wouldn’t use Now(), I’d get the time from an API cuz the clocks are not always in perfect sync.

 

[Andy Ful]

Oh yeah for my projects that often use online APIs (and then my proprietary JSON parsing) it won’t be too amazing though.

Did you try MD ASR rules for MS Office? You may be surprised.

 

[Trident]

Did you try MD ASR rules for MS Office? You may be surprised.

I haven’t to be honest, cuz my partners are Check Point. I’ve previously tried the McAfee containment rules (which to an extent duplicate the ASR rules). The system is locked down to a point even a fly can’t go nearby.
But yeah, I’m sure they can marginally reduce the attack surface.

 

[Andy Ful]

Bitdefender:

Microsoft Defender:

One has to make some effort to expose the part buried under the ground.

 

[Trident]

Bitdefender:

View attachment 290004


Microsoft Defender:

View attachment 290005

One has to make some effort to expose the part buried under the ground.

It’s not all rosy at Bitdefender, the overall architecture with all these definitions is not all that amazing and the hourly (sometimes more often than that) updates are not really performance friendly.

 

[Andy Ful]

It’s not all rosy at Bitdefender, the overall architecture with all these definitions is not all that amazing and the hourly (sometimes more often than that) updates are not really performance friendly.

No AV can satisfy all users. Thank God for many products.

 

[Trident]

No AV can please all users. Thank God for many products.

500 mb of definitions copied twice (and again and again on every update) certainly don’t please me, it triggers my OCD.

And they put the whole database in a package on Mac OS too.

Microsoft Defender has higher chances with me, if I remember right the intelligence was around 250 MB? And updates once a day. In the meantime the cloud does the heavy lifting.

 

[Parkinsond]

updates once a day

According to the default settings; can be changed from GP up to every hour, but will not get new definitions most of times; the ideal is every 6-8 hours.

 

[Trident]

According to the default settings; can be changed from GP up to every hour, but will not get new definitions most of times; the ideal is every 6-8 hours.

No, once a day is perfect

 

[Parkinsond]

No, once a day is perfect

Yes, it is perfect as it is cloud-dependent.

 

[Andy Ful]

Let's expose the MD unofficial parts buried in the system.

Windows Firewall = Windows Defender Firewall with Advanced Security (name still used in Local Group Policy Editor)
App & browser control = Microsoft Defender SmartScreen
Application Control = Windows Defender Application Control (name commonly used until 2024) and Smart App Control
Exploit Protection = Microsoft Defender Exploit Guard (name still used in Local Group Policy Editor)

It is funny that Microsoft created two different features named (in Local Group Policy Editor) Microsoft Defender Exploit Guard.
The first is visible as Exploit Protection in Security Center. The second is a hidden part of the official Microsoft Defender, which includes ASR rules and Network Protection, as well as Controlled Folder Access, visible in Security Center as Ransomware Protection.

What a mess. It was likely caused by U.S. antitrust restrictions.
Unofficially, MD is far more than a basic antivirus.

Post edited (I forgot about Microsoft Defender SmartScreen in Security Center >> App & browser control >> Reputation-based protection)

 

[Parkinsond]

What a mess

Thanks to you, WHHLight has solved this mess.

 

[lostpass]

I don't like 3rd party security products. Most security products looks like cheap optimization apps from the 00s. They try to mislead users with useless extras - driver updates, app updates, registry cleaner, files cleaner, duplicate files cleaner etc. Bloatware.
Hard times have come for 3rd party antiviruses ever since Microsoft built MD into Windows.
I suspect this is the reason for the merger and acquisition of some antivirus companies.

Why is that This message is awaiting moderator approval, and is invisible to normal visitors.

 

[rashmi]

Thanks to you, WHHLight has solved this mess.

I prefer H_C, plus CD and FH. I'm unsure whether terms like "hardening" or "advanced security" for Windows make users think the software is too complex. @Andy Ful's Tools are user-friendly, in my opinion. The tools' security and usability design make them better and easier to use than similar software like OSArmor, Application Control Manager, or smart-deny software such as CyberLock or Comodo. The notable "Run By SmartScreen" function stands out, boosting both security and ease of use. Everything has been smooth; running, updating, and installing software has been issue-free on my family's and kids' systems. In my view, default settings, the whitelist, and whitelisting your portable apps folder should be enough for most people's security and usability needs, offering a comfort level similar to traditional security.