It's useless until it's not. Something like it is necessary on Windows. The naming is pretty off though. "Responder" would be a better name than "Defender". A

It's useless until it's not. Something like it is necessary on Windows. The naming is pretty off though. "Responder" would be a better name than "Defender". At a high level we all know that it's theoretically impossible to detect all unknown "malicious" software ahead of time, by inspection. Defender also necessarily acts as an "oracle", if you're writing malicious software you have the ability to keep trying different things until Defender doesn't complain about what you're doing. However, once some specific malicious software has been identified, a fleet-wide response is necessary and at that point "Defender" has some use.