Cybersecurity Foundations (Grades 6–8) · lesson 27 of 48 · 10 min
Your Built-In Security Suite — Windows Defender and Updates
Windows comes with a powerful, free security suite built in. Many users do not realise how capable it is — or how critical it is to keep it working and updated. Windows Defender (now called Microsoft Defender Antivirus) and Windows Update together form the foundation of Windows security.
The most common reason computers get infected with malware is not that their antivirus failed — it is that they were running outdated software with known vulnerabilities. The WannaCry ransomware attack infected 200,000+ computers using a vulnerability that had been patched two months earlier. Every single infected computer had failed to apply the update.
By the end of this lesson you will be able to describe Windows Defender’s key features, explain why software updates are critical, describe Patch Tuesday, and explain what end-of-life software means for security.
Windows Defender performance
Independent testing organisations like AV-TEST and AV-Comparatives consistently rate Windows Defender as comparable to paid third-party antivirus solutions. In 2023, AV-TEST gave Windows Defender a perfect 6/6 score for protection. You do not need to buy third-party antivirus if you keep Windows Defender updated and enabled.
Windows Defender
Windows Defender (now called Microsoft Defender Antivirus) is the built-in security solution in Windows 10 and 11. It provides real-time protection against malware, viruses, ransomware, and other threats.
Key features:
Real-time protection — continuously monitors files and programs for malicious behaviour. Blocks threats as they occur.
Cloud-delivered protection — sends suspicious file information to Microsoft’s cloud for analysis. Enables faster detection of new threats.
Controlled folder access — protects important folders (Documents, Pictures) from unauthorised changes. Ransomware cannot encrypt protected folders.
Windows Defender Firewall — separate from antivirus. Controls network traffic. Should always be enabled.
Windows Security app — the central dashboard for all Windows security features. Check it regularly for alerts.
Windows Defender is effective and free. Independent tests consistently rate it as good as paid alternatives. You do not need to buy third-party antivirus if you keep Windows Defender updated.
Windows Updates
Windows Update delivers security patches, bug fixes, and feature updates. Security patches are the most critical — they close vulnerabilities that malware exploits.
Patch Tuesday — Microsoft releases security updates on the second Tuesday of each month. Critical patches may be released out-of-band (outside the normal schedule) for urgent vulnerabilities.
Why updates matter: The WannaCry ransomware attack (2017) infected 200,000+ computers in 150 countries. It exploited a Windows vulnerability that had been patched two months earlier. All infected computers were unpatched.
Best practices: Enable automatic updates. Do not delay or disable updates. Restart your computer when prompted — updates often require a restart to take effect. Check Windows Update regularly if you have automatic updates disabled.
End of life (EOL) — when Microsoft stops releasing security updates for a Windows version. Windows 10 reached EOL in October 2025. Running EOL software is a significant security risk.
The WannaCry lesson
WannaCry (2017) was one of the most damaging cyberattacks in history. It spread automatically using a Windows vulnerability (EternalBlue). Microsoft had released a patch 60 days before the attack. Every infected organisation had failed to apply it. Updates save lives — literally (hospitals were affected).
Key Terms
Real-World Case Studies
Case 1: WannaCry — The Patch That Could Have Prevented Everything
On May 12, 2017, WannaCry ransomware spread to 200,000 computers in 150 countries in a single day. The UK’s NHS cancelled 19,000 appointments. Renault halted production at multiple factories. FedEx lost $400 million. The total damage exceeded $4 billion. The Windows vulnerability it exploited (EternalBlue) had been patched by Microsoft on March 14, 2017 — 59 days before the attack. Every infected computer had failed to apply a freely available security update. This is the most expensive example in history of what happens when you do not apply patches.
Case 2: Windows XP End of Life — The Ongoing Risk
Microsoft ended support for Windows XP in April 2014. Yet in 2017, when WannaCry hit, many organisations were still running Windows XP — including parts of the NHS. Microsoft made the extraordinary decision to release an emergency patch for XP (which it no longer supported) because the outbreak was so severe. Running end-of-life software is not just a personal risk — it can affect entire organisations and critical infrastructure. The lesson: upgrade before EOL, not after a crisis.
Activity — Windows Security Features Matching
Windows Defender Feature vs. What It Does
Knowledge Check
Windows Defender and Updates
Windows Defender’s “controlled folder access” feature protects against:
- Phishing emails
- Ransomware encrypting your files
- Network intrusions
- Password theft
- Answer: Ransomware encrypting your files
Controlled folder access prevents unauthorised programs from modifying protected folders — ransomware cannot encrypt them. The WannaCry ransomware attack could have been prevented by:
- Using a VPN
- Applying the available Windows security patch
- Using a stronger password
- Disabling Wi-Fi
- Answer: Applying the available Windows security patch
Microsoft had patched the EternalBlue vulnerability 60 days before WannaCry. All 200,000+ victims had not applied the patch. Microsoft releases security updates on:
- The first Monday of each month
- The second Tuesday of each month (Patch Tuesday)
- Every day
- Whenever vulnerabilities are found
- Answer: The second Tuesday of each month (Patch Tuesday)
Patch Tuesday is the scheduled monthly release. Critical patches may also be released out-of-band for urgent vulnerabilities.
You need to buy third-party antivirus software because Windows Defender is ineffective.
Answer: False
Windows Defender consistently scores well in independent tests. It is free, built-in, and effective. Third-party antivirus is optional.
Running Windows after its end-of-life date means:
- The computer runs slower
- No more security patches — vulnerabilities will not be fixed
- You lose all your files
- Windows stops working
- Answer: No more security patches — vulnerabilities will not be fixed
After EOL, Microsoft stops releasing security updates. New vulnerabilities discovered after that date will never be patched.
What is an “out-of-band” patch?
- A patch that costs extra
- An emergency security update released outside the normal monthly schedule
- A patch for third-party software
- A patch that requires manual installation
Answer: An emergency security update released outside the normal monthly schedule
Out-of-band patches are released when a vulnerability is so critical it cannot wait until the next Patch Tuesday.
Previous lesson: Windows users and accounts
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Safe browsing on Windows