A customer recently emailed us directly: “I checked the results of the last evaluation Microsoft took part in, and they don’t look good. 85% of common attacks weren’t blocked and 16% of alerts were missed. How will Microsoft help us protect our devices, Windows, Linux and Ubuntu?”
We couldn’t match those exact numbers to MITRE’s published results, but the question itself is fair, and we hear it a lot. This article explains what those numbers mean, what they don’t, and why Defender’s real protection comes from the capabilities around the EDR: ASR rules, device risk in Intune, vulnerability management (TVM), and a single incident view that ties together identities, devices, email, cloud apps and Active Directory. These are the layers we configure in our Microsoft 365 security projects.
What MITRE ATT&CK Evaluations test, and what they don’t
MITRE ATT&CK Evaluations is a yearly test that emulates a real threat group and checks how EDR products respond. MITRE itself stresses that it doesn’t rank vendors or name a “winner”. The evaluation has two very different parts:
- Detection: blocking is deliberately turned off so the attack runs to the end and you can see what the product saw at each step. “Blocked” means nothing here, only visibility.
- Protection: blocking is on, and the test checks at which stage the product stops the attack.
What it doesn’t test: how the product is configured in your environment, how many false positives it raises on a normal workday, how your SOC triages and handles an incident, and what happens when the product works alongside identity, email and cloud protection. The scenarios also change every year, so one year’s score can’t be compared with another’s.
Why people think Defender isn’t good enough
The perception rests mostly on the 2024 protection test, where Defender’s results were weaker. In the same round, according to Microsoft, Defender XDR achieved full detection coverage across every attack stage in the detection test, but the number that circulates is, of course, the blocking one.
In 2025 the picture changed completely: in June Microsoft announced it wouldn’t take part, and in September SentinelOne and Palo Alto Networks followed. All three said they would rather put those resources into the product. According to Infosecurity Magazine, industry analysts also raised concerns that the evaluation had become more of a marketing tool than a real benchmark.
So the figure the customer saw is real, but it comes from one test, one scenario, and a product tested in isolation.
What’s true: how to read the results
The right question isn’t “who got 100%” but “how will this product perform for me, configured properly, with the other layers of protection”. Four points to keep in mind:
- Detection vs. blocking. In the detection test blocking is off by design, so “not blocked” there isn’t a failure. Only the protection test measures blocking, and its methodology is disputed.
- More alerts isn’t better. A product that alerts on every small step scores well, but in a real SOC that’s a recipe for alert fatigue. Defender groups individual events into one incident with the full attack story.
- Be careful with perfect scores. With most of the big vendors gone, some of those still in the test publish 100%. A Forrester analyst warned after the 2024 round not to take such claims at face value. Settings tuned for a known scenario don’t always work in a live organization.
- EDR is only one layer. The evaluation tests the endpoint component alone. In production, Defender also gets signals from identities (Entra ID and Defender for Identity), email and cloud apps, and that’s what lets it stop an attack early, sometimes before it reaches the device at all.
As for the customer’s original question: Defender for Endpoint supports Windows, Linux (including Ubuntu) and macOS, all managed from one place. On Linux it provides antivirus, EDR and vulnerability management. Some of the layers below are Windows-only, such as ASR rules, and blocking access by device risk works on Windows, iOS and Android. The difference between weak and strong protection lies mostly in the capabilities around the EDR, and in how they’re configured. That’s what the rest of this article covers.
ASR rules: what you lose when another antivirus is primary
ASR (Attack Surface Reduction) rules on Windows only work when Microsoft Defender Antivirus is the primary antivirus and runs in active mode. As soon as a third-party antivirus is installed, Defender switches to passive mode (on a device onboarded to Defender for Endpoint) or turns off (on one that isn’t), and ASR rules stop enforcing, even if they’re set in policy.
It’s a very common gap: Defender for Endpoint is installed and reporting, but its most effective preventive protection is quietly off. ASR rules block exactly the behaviors attackers use early in an attack, for example:
- Office files creating child processes or running code
- Credential theft from the LSASS process
- Running obfuscated PowerShell and JavaScript
- Running email attachments and unsigned files from USB
- Abuse of vulnerable signed drivers to disable protection
Our recommendation: turn on each rule in audit mode first, check the impact on your environment, set rule-specific exclusions, and only then move to block or warn. All of it is managed from one place in Intune, and the reports show up in the Defender portal.
If your organization runs a third-party EDR or AV alongside a Microsoft 365 E5 license (which includes Defender for Endpoint) or Business Premium (which includes Defender for Business), it’s worth asking what you actually get from that combination, and what you’re paying for twice. We cover how to make the switch in practice in our guide to moving from SentinelOne to Defender for Endpoint.
Intune and device risk: an infected device doesn’t reach company data
Connecting Defender for Endpoint to Intune turns every detection on a device into an access decision. Defender calculates a machine risk score for each device, Intune marks a device over the threshold as non-compliant, and Conditional Access in Entra ID blocks it from email, SharePoint, Teams and every app connected to Entra. In practice:
- An attacker runs a suspicious tool on an employee’s laptop.
- Defender detects it and raises the device’s risk level to medium or high.
- Intune marks the device non-compliant, automatically.
- Conditional Access blocks new access from that device to cloud resources, even if the attacker has a valid password.
- After cleanup, the risk level drops and access comes back automatically.
This is exactly the layer an isolated EDR test can’t measure: even if the attacker managed to run something, they can’t use the device to reach your data. The same mechanism works on mobile too, with Defender for Endpoint for iOS and Android.
What TVM does well: closing the door before anyone walks in
Most attacks don’t start with sophisticated code but with an old, unpatched vulnerability. Microsoft Defender Vulnerability Management (formerly TVM) uses the same Defender for Endpoint agent, with no network scans and no extra install, and gives you a continuous view of your devices.
| Capability | What it gives you |
|---|---|
| Software and vulnerability inventory | A live list of every application, version and CVE on every device: Windows, Linux and macOS |
| Risk-based prioritization | Ranked by active exploitation, exposure and device importance, not just CVSS |
| Security recommendations | An ordered list of actions by their impact on your exposure score |
| Remediation requests to IT | A remediation request with a due date, connected to Intune |
| Block vulnerable applications | Block a vulnerable version from running until it’s updated |
| Security baselines assessment | Compare device settings with CIS and STIG |
| Browser extensions and certificates | Find risky extensions and expiring or weak certificates |
Four of them, blocking vulnerable apps, security baselines assessment, browser extensions and certificate inventory, need the Defender Vulnerability Management add-on on top of Defender for Endpoint Plan 2. Check what’s included in yours.
One incident, every source on the same screen
Defender’s biggest advantage isn’t the EDR itself, but that every source of attack data flows into one incident in the Microsoft Defender XDR portal:
| Source | Product | What it adds to the incident |
|---|---|---|
| Devices | Defender for Endpoint | Processes, files, network connections, device isolation |
| Cloud identities | Entra ID Protection | Risky sign-ins, risky users, token theft |
| On-premises Active Directory | Defender for Identity | Kerberoasting, pass-the-hash, lateral movement against domain controllers |
| Email and Teams | Defender for Office 365 | The original phishing message, who else got it, who clicked |
| Cloud apps | Defender for Cloud Apps | Unusual SaaS activity, data downloads, malicious OAuth apps |
Instead of jumping between five consoles and connecting the dots by hand, the analyst sees the whole story: a phishing email that was opened, a user signing in from an unusual location, a laptop running suspicious PowerShell, and a lateral movement attempt against AD, in one incident with one timeline.
Automatic attack disruption builds on this: when Defender detects an active attack such as ransomware or account takeover, it can contain devices and disable the compromised user, including in on-premises Active Directory (with Defender for Identity), automatically, without waiting for an analyst. You can extend all of this with Microsoft Sentinel, in the same portal, to more sources such as firewalls and other cloud platforms.
The bottom line
A MITRE score is one data point, not a buying decision. Microsoft Defender’s real protection comes from the combination: EDR with Defender Antivirus active, enforced ASR rules, device risk feeding Intune and Conditional Access, continuous vulnerability management, and one incident view across devices, identities, email, cloud and AD.
We see the same thing in project after project: the licenses are there, but half the capabilities are off or only partly configured.
Want to know where you stand? Book a call with the OnCloud team and we’ll review your Defender, Intune and Conditional Access settings together.
Book a callSources
- Microsoft Security Blog: Defender XDR in the 2024 MITRE ATT&CK Evaluations
- Microsoft Tech Community: Microsoft’s participation in MITRE ATT&CK Evaluations Enterprise 2025
- Infosecurity Magazine: Major vendors pull out of the MITRE evaluations
- SecurityWeek: MITRE posts results of the 2025 ATT&CK Enterprise Evaluations
- Forrester: Don’t trust vendor claims about getting 100% on the MITRE ATT&CK Evaluations
- Microsoft: ASR rules requirements
- Microsoft: Defender Antivirus compatibility with other security products
- Microsoft: Configure Conditional Access with Defender for Endpoint
- Microsoft: Compare Defender Vulnerability Management plans