defender is an antivirus product. and yes AV largely prevents malware compared to nothing. defender is a damn good one, but doesn't meet enterprise needs. centr

defender is an antivirus product. and yes AV largely prevents malware compared to nothing. defender is a damn good one, but doesn't meet enterprise needs. central administration and logging are nessecary when managing a fleet of tens of thousands of workstations. AV isn't perfect, partial prevention is more common than people think, partial prevention is also partial infection. I have seen countless incidents that started with their av product catching the malware half way through execution but they never knew because they don't receive central logs. defender ATP solves some of these issues, but osx and linux capabilities are meh at best, and still very new. (linux at least) so still not ready for most enterprises. third party av exists because enterprises need centralized av across multiple OS that works ok. no one is fooling themselves thinking av prevents all malware, but it prevents a lot, and more importantly allows you to get visibility into your endpoints activities so a human can be alerted to what needs to be investigated further. just because an av solution doesn't prevent things as much as others, doesn't make it completely useless, many many enterprises knowingly trade prevention and or performance for visibility, and cost, and that's ok.