Just Defender. Some bozo at work stumbled onto some questionable sites and got whacked with a cryptolocker a few years back, and in response to that, we had to

Just Defender. Some bozo at work stumbled onto some questionable sites and got whacked with a cryptolocker a few years back, and in response to that, we had to run WebRoot for a while, and that was just awful - it may not be intrinsically terrible, but as configured here, it was centrally administered through as SAAS web app, and configured so that it wouldn't show any UI on users' machines - which ended up meaning that when it would false-flag something benign, it would pop an invisible modal window that locked out the machine for two or three minutes until it timed out. Every time you build a project... And especially excruciating with anything that used NPM and downloaded half the internet, because the real-time scanning would get swamped. Thankfully, after a few months of struggling, we got some exemptions.