Is Microsoft Defender enough for Cyber Essentials?

For most Windows estates, yes — the antivirus built into Windows can meet the malware protection requirement. What fails organisations isn't the product. It's Defender switched off, out of date, or overridden by something else.

What the malware protection control asks for

Every in-scope device that supports it must be protected by either anti-malware software or application allow-listing. Where anti-malware is used, it should be kept up to date in line with the vendor's recommendations and configured to:

prevent malware from running;
prevent malicious code from executing;
prevent connections to malicious websites.

The scheme doesn't name products. Built-in and third-party anti-malware are treated the same way, judged on whether they're on, current and configured.

Where Defender fits

Microsoft Defender Antivirus ships with Windows and, with real-time protection on and definitions current, covers the core of the requirement. Paired with SmartScreen, which warns about and blocks known malicious sites and downloads, it addresses the web side too. For a typical small or medium organisation on supported Windows, no extra product is required to pass.

Paid products can add management, reporting and extra layers, which may well be worth having. They aren't what the certificate asks for.

How Defender ends up failing

Real-time protection turned off

Switched off to install something, to troubleshoot, or by a user with admin rights, and never turned back on. The machine still says it has antivirus; it just isn't doing anything.

Out-of-date definitions

A laptop that has been off, or can't reach Microsoft's update servers, falls behind on definitions. The protection is only as current as its last update.

A third-party product half-removed

When another antivirus is installed, Defender steps aside. If that product later expires or is partly uninstalled, a machine can end up with neither working properly.

Exclusions that grew

Folder exclusions added for one application's performance, then widened, until a large part of the disk isn't scanned at all.

Devices without it

Macs, Linux machines and phones in scope need their own answer. Defender on Windows says nothing about them.

The question an assessor asks isn't "which antivirus?". It's "is it running, up to date and doing its job on every machine?" That's a question about state across the estate, and it changes day to day.

A quick check for each Windows machine

Is an antivirus product running, and is it the one you expect?
Is real-time protection on?
How old are the definitions?
Is SmartScreen or equivalent web protection enabled?
Are there exclusions, and does each have a reason?

Quick answers

Is Windows Defender acceptable for Cyber Essentials?

Yes, when it's enabled, kept up to date and configured to block malware, malicious code and malicious websites.

Do I have to buy antivirus for Cyber Essentials?

No. The requirement is protection, not a particular product.

Is application allow-listing an alternative?

Yes. Allowing only approved software to run meets the control instead of anti-malware, though it takes more effort to manage.