Managed Endpoint Antivirus: Why the Software Matters Less Than Who Is Watching It

Almost every small business I have ever assessed told me the same thing in the first ten minutes: “We already have antivirus.” And almost every time, they were technically correct and practically wrong.

They did have antivirus. Some of it was the free tier of a consumer product installed by whoever set up the computer. Some of it was a real business product bought three years ago and never touched since. Some of it was Windows built-in protection, which is genuinely good software, running with default settings and nobody assigned to look at what it reports.

In one 22-person office, we ran a discovery scan and found endpoint protection installed on 19 of 26 machines. Of those 19, five had definitions more than 90 days stale, two had real-time scanning turned off by a user who got tired of a false positive, and one had a folder-wide exclusion someone added years earlier to make a line-of-business application stop complaining. That exclusion covered the entire application directory. Zero alerts had ever left any of those machines, because there was nowhere for an alert to go.

That is the actual difference between managed and unmanaged endpoint protection. It is not really about which engine catches more malware in a lab test. It is about whether anyone knows the state of every machine, whether policy is enforced instead of suggested, and whether a detection at 2:14 on a Sunday morning reaches a human being.

What the current data actually says

I want to be careful here, because this topic attracts some of the worst statistics in our industry. You will see the claim that a majority of small businesses close within six months of a cyberattack. That number has no credible source behind it and I will not repeat it. What follows comes from primary research with published methodology.

Verizon analyzed more than 31,000 security incidents and over 22,000 confirmed breaches for its 2026 Data Breach Investigations Report, covering November 2024 through October 2025. A few findings matter directly to this conversation.

• Malware is not obsolete. A malware action appeared in 63 percent of confirmed breaches, running nearly even with hacking actions at 64 percent. The two travel together.
• Ransomware kept growing. Ransomware showed up in 48 percent of all breaches, up from 44 percent the prior year. Within the System Intrusion pattern, which accounts for 60 percent of breaches, ransomware appeared in 77 percent of cases.
• Attackers are moving to legitimate tools. Abuse of remote monitoring and management software grew 240 percent year over year in System Intrusion breaches, while traditional backdoor and command-and-control activity dropped 27 percent. Attackers increasingly arrive looking like an administrator rather than like malware.
• Credential theft is often the opening act. Among ransomware victims that had an associated credential or infostealer event, half of those events occurred within 95 days before the ransomware attack became public. Infostealer malware on one workstation is frequently the first domino.

Sophos published a complementary view from actual incident response work. Its 2026 Active Adversary Report covers 661 investigations from the same twelve-month window, and it is unusually relevant to smaller companies: 84 percent of those cases came from organizations with fewer than 1,000 employees, and 56 percent from organizations with 250 employees or fewer. This is not enterprise data being stretched to fit a small business narrative.

Three numbers from that dataset have stuck with me.

• Unprotected systems were the third most common contributing finding, present in 29.35 percent of cases. Not systems where protection failed. Systems where protection was never there.
• 88.10 percent of ransomware was deployed outside local business hours, spread fairly evenly across the week. The busiest four-hour block for attacks of all kinds was 11 p.m. to 3 a.m.
• Median attacker dwell time was three days overall, but two days for organizations under managed detection versus five days for reactive incident response engagements. Monitoring shortened the window.

A caveat worth stating: The Sophos figures come from organizations that called an incident response team, which means every case in that dataset is a case where something went wrong. It tells you what failures look like. It does not tell you what percentage of all small businesses have unprotected systems. Treat it as a description of how incidents unfold, not as a base rate.

Put those together and a pattern emerges. Malware still matters. It runs on endpoints. It runs disproportionately at night and on weekends. And in roughly three out of ten incidents, some machine in the environment had no protection on it at all. That last point is why we wrote What Happens at 2 a.m., and it is the same argument in a different jacket.

What “managed” actually adds

The word gets thrown around loosely, so here is what I mean by it in concrete operational terms.

1. Coverage you can prove

A managed deployment maintains a console that lists every enrolled endpoint, its last check-in time, its definition version, and its policy state. When a new laptop shows up, onboarding puts an agent on it before it touches company data. When a machine stops reporting for 72 hours, that generates a ticket. Unmanaged antivirus has no equivalent. Nobody notices the gap because there is nothing looking for gaps. This is also why asset and documentation management is not busywork: you cannot protect an endpoint you do not know exists.

2. Policy that users cannot quietly undo

This is the one that changes outcomes most often. In an unmanaged setup, a user with local administrator rights can disable real-time protection, add an exclusion, or suppress alerts, and the change persists indefinitely with nobody informed. Managed platforms enforce settings centrally and lock them against local modification.

Microsoft documents why this matters. Disabling security features is a standard step in attacker playbooks, and tamper protection exists specifically to block registry edits, PowerShell commands, and policy overrides that would turn protection off, including attempts made by an account holding local administrator rights. Microsoft also notes that when Defender for Endpoint is centrally managed, individual users cannot change the tamper protection setting at all. That is a meaningful difference from a product where the setting is a toggle in a system tray menu.

3. Alerts that reach a person

Unmanaged antivirus tells the person sitting at the keyboard. That person is frequently not there, not technical, or not inclined to escalate a popup they do not understand. Given that 88 percent of ransomware deployment happens outside business hours, telling the keyboard is close to telling nobody.

CISA, the FBI, the NSA, and MS-ISAC address this directly in the #StopRansomware Guide. Their recommendation is a centrally managed antivirus solution, configured so warnings and indicators escalate to security personnel. Their stated reason is that it enables detection of precursor malware, not just ransomware itself. A ransomware infection is frequently the end of a compromise that began weeks earlier with something smaller, which is the same chain we walk through in Break the Chain.

4. Correlation across the fleet

One detection on one machine is an event. The same detection on four machines in eleven minutes is an incident. Only a central console sees that pattern. This is exactly how the infostealer-to-ransomware sequence in the Verizon data gets caught early, and it is invisible to standalone installations.

5. Response, not just notification

Detection without response is a smoke alarm in an empty house. Managed platforms allow remote isolation of an endpoint from the network, forced remediation, rollback of malicious changes, and a documented action trail. Someone has to be authorized and available to pull those levers.

6. Evidence for insurance and compliance

Cyber insurance applications now routinely ask whether endpoint protection is deployed across all endpoints and centrally managed. Answering yes without a console to back it up is a claim you may not want to make in writing. Managed deployments produce the deployment reports and retained logs that underwriters and auditors ask for. We covered the wider version of this problem in Are You Wasting Money on Cyber Insurance?

Here is the practical comparison.

Capability	Unmanaged	Managed
Coverage verification	Assumed	Enrolled device inventory with last-check-in reporting and alerts on machines that stop reporting
Definition and agent currency	Depends on the machine being on and the update succeeding	Monitored centrally, with failures raised as tickets
Configuration	Whatever the last person set, plus any exclusions added along the way	Enforced from policy, exclusions reviewed and documented
Tamper resistance	A local admin can disable protection	Settings locked against local modification, and tamper attempts alert
After-hours detections	A popup nobody sees	Routed to an on-call queue with a defined response time
Fleet-wide correlation	None	Repeat detections across machines surface as one incident
Containment	The user unplugs the network cable, or does not	Remote isolation and remediation without touching the device
Audit and insurance evidence	Screenshots and hope	Deployment reports, detection history, retained logs

What managed antivirus does not fix

I would rather lose a deal than oversell this layer, because overselling it is how people end up feeling protected while the actual risk sits somewhere else entirely.

Endpoint protection is largely irrelevant to the most common way attackers get in right now. Sophos found that 67.32 percent of incident root causes in 2025 were identity related: compromised credentials, brute force, phishing, and stolen authentication tokens. Verizon found exploitation of software vulnerabilities has become the leading initial access vector at 31 percent of breaches. An attacker who signs in to Microsoft 365 with a valid password and a replayed session token has not deployed anything for antivirus to catch. In one Sophos case study, an adversary ran three waves of phishing through a customer environment using legitimate internal accounts and a stolen session token that never triggered a second authentication prompt. We wrote about that failure mode in MFA Approved the Login. Someone Else Got In.

Specifically, managed endpoint antivirus does not address:

• Credential compromise and account takeover. That requires phishing-resistant multifactor authentication, conditional access, token protection, and identity threat detection and response. Sophos found MFA either absent or misconfigured in 59.46 percent of the incidents it investigated.
• Unpatched software. Verizon found that only 26 percent of known exploited vulnerabilities were fully remediated in 2025, down from 38 percent, with median time to full remediation rising to 43 days. No endpoint agent substitutes for patch management.
• Business email compromise and wire fraud. The FBI reported over $3 billion in BEC losses in 2025. These attacks typically involve no malware whatsoever, which is why email filtering and a written payment callback rule matter separately.
• Data exfiltration through legitimate channels. Verizon reported that unauthorized generative AI usage is now the third most common non-malicious insider action in its data loss prevention dataset.
• Backup and recovery. If encryption succeeds, tested offline backups are what determines whether you reopen Monday.
• Abuse of legitimate remote access tools, which grew 240 percent in the Verizon data. Blocking that requires application control and policy decisions about which tools are permitted, not signature matching.

There are also honest operational costs. Managed protection means an agent on every machine, which consumes some resources. Policy enforcement means users lose the ability to make local exceptions, which generates friction on legitimate edge cases. Central management creates a console that itself has to be secured, because a compromised management platform is a serious problem. And there is a per-endpoint fee, every month, forever.

Where our interests and yours line up, and where they do not: Harmony MSP bundles managed endpoint protection into our flat-fee agreements rather than selling it separately, so I have an obvious financial interest in arguing for it. Two things are true at once. We believe centrally managed endpoint protection is a baseline control, and CISA and the FBI say the same thing in writing. We also make money when you buy it from us. If you have an internal IT person capable of running a management console properly, you do not need us to do it, and you should not pay us to. What you should not do is keep calling standalone consumer antivirus a security program.

Questions to ask whoever runs your endpoints

Whether that is us, another provider, or your own staff, these six questions expose the real state of things quickly. Ask for evidence, not assurances.

1. How many endpoints do we own, how many have an agent installed, and can you show me the report? A gap between those two numbers is the single most common finding in our assessments.
2. When did each machine last check in, and what happens when one stops? If there is no alert and no ticket, coverage is a snapshot rather than a state.
3. Can a user with local admin rights disable protection or add an exclusion? If yes, ask what would notify you. If nothing would, that is the answer.
4. Where does a detection go at 2 a.m. on a Saturday? Get a specific answer: which queue, which person, what response time. “It logs to the console” is not a response process.
5. What exclusions are currently configured, who approved them, and when were they last reviewed? Old exclusions added for a line-of-business application are a standard blind spot.
6. If a machine is confirmed compromised, who can isolate it from the network remotely, and how long does that take? Containment speed is what limits blast radius.

Frequently asked questions

Is built-in Windows antivirus good enough?

The detection engine is genuinely competitive and performs well in independent testing. That is not the question. The question is whether it is centrally managed, whether tamper protection is enforced, whether policy is locked, and whether detections reach someone. Microsoft itself notes that managing Defender through Group Policy, WMI, or PowerShell is more susceptible to tampering than managing it through a proper central platform. Built-in and unmanaged is a different product from built-in and managed.

We have never had a malware incident. Does that mean we are fine?

It may mean you have been fortunate, or it may mean you would not know. Absent central logging and alerting, an infostealer that harvested credentials and exited leaves almost nothing a user would notice. Verizon found that missing telemetry and short log retention were among the most common obstacles investigators faced.

Do we still need this if we have moved everything to the cloud?

Yes. Your people still work on laptops, those laptops still hold session tokens and cached credentials, and those tokens are exactly what infostealers are built to collect. Moving your data to Microsoft 365 does not remove the endpoint from the attack path. It arguably makes the endpoint more valuable.

Is this the same thing as EDR or managed detection and response?

No, and the distinction matters. Managed endpoint protection is the prevention and enforcement layer. EDR adds behavioral telemetry and investigation capability. Managed detection and response adds a staffed team watching that telemetry around the clock. They stack. Managed antivirus is the floor, not the ceiling, and any provider who tells you otherwise is selling you a floor as a building.

How disruptive is the switch?

For most small environments, deployment is quiet. The disruptive part is usually not installation. It is the discovery phase, when you find out how many machines were unprotected, how many exclusions accumulated, and which line-of-business application has been running with security features waived for four years. That conversation is uncomfortable and worth having.

The short version

The antivirus product on your endpoints is not the interesting variable. Every major engine catches the commodity threats. What separates a control from a checkbox is whether coverage is verified, whether policy is enforced against local override, whether detections reach a person who is awake, and whether someone can contain a compromised machine quickly.

Unmanaged antivirus gives you the engine and none of that. It is not worthless. It is just considerably less than what most owners believe they are getting when they say the words “we have antivirus.”

And it is one layer. It will not stop the credential attack that accounts for two thirds of incident root causes, and it will not patch your firewall. Anyone who tells you it will is not being straight with you.

If you want a second set of eyes

If you are not sure how many of your machines are actually protected right now, that is a question with a definite answer, and it is worth knowing regardless of who you buy from. We are happy to walk through it with you, no obligation and no pressure. Harmony MSP works with small businesses across Lake Mary, Orlando, and Central Florida. You can reach us at (407) 720-6540.

Sources

• Verizon 2026 Data Breach Investigations Report
• Sophos X-Ops, 2026 Active Adversary Report
• CISA, FBI, NSA and MS-ISAC, #StopRansomware Guide
• FBI, 2025 Internet Crime Report announcement
• Microsoft Learn, Protect security settings with tamper protection
• Microsoft Learn, Tamper resiliency with Microsoft Defender for Endpoint

A note on statistics: Verizon and Sophos percentages are as published in the reports linked above. Sophos incident response data reflects organizations that experienced an incident and is not a base rate for all small businesses. We have deliberately excluded secondary-source figures we could not trace to a primary report.