Hey folks, Is MS Defender enough protection with Malwarebytes Free on Windows 11? Or should I use something like Comodo Firewall with HIPS (free) alongside Defender? Or do you suggest some other tool to run alongside Defender or something that can run as a standalone service? Also how about for an A […]
Hi nishaddesilva —
for an IT-literate user with sensible habits, Microsoft Defender and the Windows Firewall are sufficient on Windows 11. Malwarebytes Free is useful as a second-opinion scanner, but it is not another preventive layer: its real-time protection requires a paid subscription (Malwarebytes documentation).
My suggested Windows setup
Use:
- Microsoft Defender Antivirus
- Windows Firewall
- Control D
- uBlock Origin Lite
- Osprey only if you want the additional URL-reputation checks
- Malwarebytes Free for occasional manual scans
Check that these Windows Security features remain enabled:
- Real-time protection
- Cloud-delivered protection
- Automatic sample submission
- Tamper Protection
- Reputation-based protection, including PUA blocking
- SmartScreen
- Firewall on all network profiles
Microsoft documents SmartScreen, Tamper Protection, PUA blocking and optional Controlled Folder Access as separate Windows 11 protection layers—not merely a basic signature scanner (Microsoft). Controlled Folder Access can be useful for important files, but it may block legitimate applications, so enable it only if you are prepared to maintain its allow-list.
More important than adding another security program: maintain at least one
versioned or offline backup. Antivirus is not a backup strategy wearing a different hat.
Would I add Comodo Firewall/HIPS?
No, not for this use case.
Comodo can add strong containment and granular application control, and it can run with Defender when Comodo’s antivirus component is not installed. However, you then become responsible for interpreting prompts and maintaining rules. A HIPS prompt answered incorrectly is just an unusually elaborate
Allow button.
Comodo remains available; its current CIS 2027 release has simply relabelled HIPS as “EDR” in the interface (Comodo announcement). That naming change does not remove the usual trade-offs: greater control, but more noise, maintenance and potential compatibility trouble.
I would choose Comodo only if you deliberately want a default-deny/containment setup and enjoy managing it—not because Defender needs a second firewall to become respectable.
Your browser layers
Control D, Osprey and uBO Lite overlap, but they are not identical:
- Control D filters domains for the whole device.
- uBO Lite blocks browser requests using filter lists.
- Osprey adds URL-reputation checks.
Keeping Control D and uBO Lite makes sense. Osprey is optional rather than essential. Its project says visited URLs are checked through its proxy against multiple providers, so decide whether that extra lookup layer is worth the additional disclosure model for you (Osprey project). More extensions do not automatically equal more security.
Android
On a supported, fully updated Android phone, I would generally use:
- Google Play Protect enabled
- Current Android security updates
- Current browser and Android System WebView
- Apps from the Play Store or other trusted sources
- Careful control of Accessibility, Device Admin, notification access and “install unknown apps” permissions
- Control D if you find its filtering useful
Google Play Protect checks Play Store apps, scans apps from other sources and can warn, disable or remove harmful applications. A third-party Android antivirus can provide another scanner or web filter, but Android’s sandbox limits what such apps can inspect. It cannot make an untrusted APK or a casually granted Accessibility permission safe.
If the phone is no longer receiving security updates, that is a more significant problem than the choice between two scanner apps.
Practical migration from Kaspersky
- Uninstall Kaspersky normally.
- Reboot.
- Open Windows Security and verify that Defender Antivirus and the firewall are active.
- Update Defender’s security intelligence and run an initial scan.
- Install Malwarebytes Free only if you want the manual second opinion.
- Avoid adding another real-time antivirus “just in case.”
So my cost-cutting configuration would be
Defender + Windows Firewall + Control D + uBO Lite, with Malwarebytes Free on demand. That is a reasonable modest step down from a paid suite’s extra features, not a plunge into the security wilderness.
Sources
