“Is Microsoft Defender enough?” is one of the most common security questions small businesses ask, and it deserves an honest answer, not a scare pitch. Microsoft Defender for Business is a strong product at a very good price.
The honest answer is: it’s a strong foundation, and it’s incomplete. This guide covers what Defender does well, where the gaps are, what an attack that slips through looks like, and how to close the gaps without replacing what already works.
What Defender for Business is
Microsoft Defender for Business is Microsoft’s endpoint security for organisations with up to 300 users. It’s included in Microsoft 365 Business Premium and is also sold on its own. According to Microsoft, it brings together features from Defender for Endpoint Plan 1, some from Plan 2, and a few designed for smaller businesses.
It protects Windows and Mac computers, plus iPhone, iPad and Android devices. Linux and Windows servers need a separate server licence.
Where Defender for Business is genuinely good
Credit where it’s due. Defender for Business gives you:
- Next-generation antivirus that goes beyond fingerprints and looks at behaviour.
- Endpoint detection and response (EDR) in a streamlined form, so attacks on a machine are recorded and can be acted on.
- Attack-surface reduction, including rules that block common attack tricks, controlled folder access, web protection and firewall management. Some of these need to be switched on in Intune.
- Automated investigation and remediation, which can clean up many threats on its own.
- A price that’s hard to beat if you’re already on Business Premium.
If your laptops run Defender and it’s properly set up, you have a solid baseline on the endpoint. Keep it.
Where the gaps are
The problem isn’t that Defender is weak. It’s that most attacks on small businesses today don’t start on the laptop, and Defender for Business is an endpoint product.
1. Identity: the sign-ins themselves
More than 97% of identity attacks are password attacks, and identity-based attacks rose 32% in the first half of 2025, according to the Microsoft Digital Defense Report 2025. Coveware’s Q4 2025 data says plainly that identity is the primary intrusion surface, not endpoints or malware.
An attacker who signs in from another country with a stolen session never touches your laptops, so endpoint protection never sees them. Microsoft’s own risk-based sign-in protection, Microsoft Entra ID Protection, needs Microsoft Entra ID P2, and P2 is not included in Microsoft 365 Business Premium. Without it, much of the detail behind risky sign-ins is hidden. Read what ITDR is for what watching sign-ins involves.
2. Email fraud with nothing to scan
Coalition’s 2026 Cyber Claims Report found that business email compromise and funds transfer fraud made up 58% of the claims it saw. Many of these emails carry no link or attachment at all: just a convincing request to change bank details or pay a new account. Filters built to hunt for malware have little to scan. Read what business email compromise is for how these attacks work.
3. Joining the dots
A phishing email, an odd sign-in, a new inbox rule and a strange program on a laptop might each raise a separate alert in a separate place, or none at all. Seeing them as one attack takes something that reads identity, email and endpoint together.
4. Someone to act on it after hours
Defender raises alerts, and its automated remediation handles many threats on its own. But the decisions that need context, like ending a director’s sessions, revoking an app or cutting a laptop off the network, still need someone to look. At most small businesses, nobody is looking at 11 pm on a Saturday.
5. AI tools and AI agents
Staff use AI tools that Defender for Business isn’t built to govern: which ones are in use, who connected them to company mail and files, and what data goes into them. And AI agents increasingly hold access to company data on their own. Read shadow AI detection for why this is now its own risk.
Put simply: Defender watches one surface well. The attacks that cost small businesses the most often start on the others.
A worked example: Defender did its job, and it still wasn’t enough
Here’s an illustrative example at a 25-person accounting firm running Microsoft 365 Business Premium with Defender on every laptop.
Tuesday, 10:14 am. A partner gets an email that looks like a DocuSign request from a client. The link leads to a fake Microsoft sign-in page. She signs in and approves the MFA prompt. The page copies her session.
10:16 am. The attacker signs in with the copied session from abroad. Her laptop is untouched, so Defender has nothing to see.
10:19 am. The attacker sets a rule to hide any email mentioning “wire” or “payment”, then reads two weeks of client threads.
Thursday, 3:02 pm. From her real mailbox, the attacker tells a client that the firm’s bank details have changed for this quarter’s payment.
Defender did exactly what it was built to do. Every laptop stayed clean. The attack happened in the sign-in, the mailbox and the client relationship, where an endpoint product doesn’t look.
With an identity and email layer on top, the session from abroad, the browser that doesn’t match her laptop and the hidden rule land in one case within minutes on Tuesday. The sessions end, the rule is removed, and the email to the client is never sent.
Supplement, don’t replace
The smart move isn’t to rip Defender out. Keep it as your endpoint baseline and add the surfaces it doesn’t cover. That avoids the cost and disruption of a full migration, and it means you keep paying for something you already have instead of paying twice.
Checklist: is Defender plus Microsoft 365 enough for you?
- Defender is onboarded on every laptop, and a machine that stops reporting is noticed.
- Attack-surface reduction rules and controlled folder access are switched on, not just licensed.
- Someone is told if Defender is switched off on a machine.
- Every sign-in is watched for stolen sessions, impossible travel and MFA prompt floods.
- New inbox rules and forwarding to outside addresses are flagged.
- Payment and bank-detail change requests are checked, even with no link or attachment.
- Apps and AI tools connected to company mail and files are listed and reviewed.
- An email alert, a sign-in alert and a laptop alert about the same person end up in one case.
- Someone can end every session for an account in minutes, at any hour.
If you ticked the first three but not the rest, Defender is doing its job and the gaps are elsewhere.
How Centeye complements Defender
Centeye sits beside Defender and closes the gaps it leaves:
- Identity: Centeye Gatewatch watches every sign-in across Microsoft Entra ID and Google Workspace for stolen sessions, impossible travel, password sprays, MFA prompt floods and risky app consent, without needing Entra ID P2.
- Email: Centeye Lighthouse finds the payment fraud and phishing that get past the filter, including requests with no link at all, and pulls every copy from every inbox.
- Endpoint: Centeye Ironwatch works beside Defender, picks up its detections, notices if it is switched off, and links each attack to the email or sign-in that started it.
- AI use and AI agents: Centeye Lumen shows which AI tools people use and what data goes out, and Centeye Synthwatch, in early access, gives AI agents an owner and an off switch.
- Response: Kavach, the security operations agent, works every case day and night at the setting you choose, and Argus writes a plain-English weekly report.
Keep Defender. Add the rest. That’s the honest recommendation.
Frequently asked questions
Is Microsoft Defender for Business good enough on its own?
For the endpoint, it’s a solid baseline. For identity attacks, email fraud and after-hours response, it needs help.
Does Microsoft 365 Business Premium include ITDR?
It includes Conditional Access, which lets you set sign-in rules. Microsoft’s risk-based sign-in protection needs Microsoft Entra ID P2, which Business Premium doesn’t include.
Do I need to remove Defender to use Centeye?
No. Centeye is built to run beside Defender and uses what Defender finds.
What’s the difference between Defender for Business and Defender for Endpoint?
Defender for Business is designed for organisations up to 300 users and combines Plan 1 features with some Plan 2 features. Defender for Endpoint Plan 2 adds deeper capabilities such as threat hunting and longer data retention.
Is Defender for Business enough for cyber insurance?
Insurers’ questions vary, so check your own application. Ask your broker what they need to see for endpoint, MFA and email protection.
Wondering about the difference between EDR and MDR? Read EDR vs. MDR for small business. For identity versus endpoint, read ITDR vs EDR. For Microsoft’s own identity tools and the licences they need, read Microsoft ITDR explained. To harden the tenant itself, work through our Microsoft 365 security checklist. Want to see what Centeye adds on top of Defender? Start a free trial.
Figures cited from the Microsoft Digital Defense Report 2025, the Coveware Q4 2025 quarterly ransomware report and the Coalition 2026 Cyber Claims Report. Defender for Business features and Entra licensing per Microsoft Learn. The worked example is illustrative. Centeye is a supplement to, not a replacement for, Microsoft Defender.