Licensed Is Not the Same as Protected: Keeping Microsoft Defender Healthy in E5 Environments

Microsoft 365 E5 gives organisations one of the broadest security stacks on the market: Microsoft Defender for Endpoint Plan 2, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, Microsoft Entra ID P2 and Microsoft Purview. Many organisations therefore assume that once E5 is licensed and Defender is onboarded, every endpoint is protected.

In practice, licensed is not the same as protected. Defender only protects a device when its engine is in active mode, its security intelligence is current and its sub-modules, such as real-time protection, cloud-delivered protection and tamper protection, are running correctly. On Windows, the local Windows Security Center decides which antivirus product is in charge, and stale registrations left behind by previously installed security products can quietly push Defender into a degraded state.

The E5 Assurance Gap

Microsoft Defender reports what its sensors report. When a sensor is active and healthy this is highly effective, but several common conditions leave a device looking covered while its protection is reduced. Practitioner guidance on Defender for Endpoint deployments consistently highlights the same pitfalls [3]:

• Incomplete coverage: devices known to Active Directory, Entra ID or other tools that were never onboarded to Defender.
• Incomplete onboarding: devices visible in the portal but not fully protected.
• Inactive or impaired sensors: sensors that are onboarded but no longer communicating correctly.
• Stale protection: out-of-date security intelligence or disabled real-time protection on active sensors.
• Passive mode left behind: Defender Antivirus remaining in passive mode after a third-party antivirus has been removed.
• Siloed data: Defender findings managed in isolation from asset, vulnerability, configuration and compliance context.

None of these are product defects. They are operational drift that accumulates over migrations, re-imaging, product changes and user activity. They are also the conditions an attacker looks for, because a device with tamper protection or real-time protection not working is far easier to disarm.

A second gap is scope. E5 is centred on the Microsoft ecosystem. Most organisations also run Linux and macOS servers, firewalls, network devices, several cloud platforms, third-party scanners and a long list of compliance obligations. Bringing these into one risk and compliance view is outside what E5 is designed to do.

Windows Security Center: The Hidden Point of Failure

Windows Security Center (WSC) is the local Windows service that tracks which security products are installed and arbitrates between them. When a non-Microsoft antivirus registers with WSC on Windows 10 or later, Microsoft Defender Antivirus automatically moves to passive mode so that the two products do not conflict [1][2]. In passive mode, Defender does not act as the primary antivirus and, for example, scheduled scans are disabled unless specifically configured [1].

Problems start when a previous security product is removed incompletely, which is common during migrations to E5. Its WSC registration can remain behind as a stale entry. Windows still believes another provider is present, and Defender sub-modules may not work as intended.

These conditions are difficult to spot at scale from a console view alone. CyberCyte validates them directly on each endpoint, continuously, and fixes them with automated remediation.

Case Study: A 1,500-Endpoint Microsoft 365 E5 Deployment

An enterprise with approximately 1,500 Windows computers had completed its move to Microsoft 365 E5 and considered Microsoft Defender fully deployed. CyberCyte was deployed alongside Defender to validate Defender health and the wider exposure of the estate.

The organisation held full E5 licences throughout. The gaps were not caused by a lack of Microsoft capability, but by operational drift that no one was measuring. Once remediated, CyberCyte continued to validate Defender health on every endpoint so that any new drift is caught as it appears.

How CyberCyte Validates Defender Health

• Collect: the CyberCyte agent or agentless collection gathers Defender engine mode, signature age, sub-module status and Windows Security Center provider registrations from each endpoint, alongside 500+ other artefact types.
• Assess: classification rules compare each endpoint against the expected healthy state and raise prioritised findings on the CISO Dashboard.
• Remediate: Unified Remediation & Response and Registry Management correct the condition through PowerShell scripts, service and registry actions, with an audit trail.
• Prove: Security Diagnostics runs ransomware and data-leakage simulations to confirm that Defender actually detects and blocks, not just that it is reported as running.

Shadow IT and Shadow AI Discovery

Shadow IT has moved from unapproved servers and SaaS sign-ups to the edges of the user workstation: browser add-ons, IDE extensions, portable tools and personal AI accounts. Industry data reported from the 2026 Verizon Data Breach Investigations Report shows how quickly this has grown [4]:

• Regular use of AI on corporate devices rose from 15% to 45% of users in one year.
• 67% of users reach public AI services from non-corporate accounts on corporate devices.
• More than 15% of users at the average company have unauthorised AI browser extensions installed.
• Shadow AI is the third most common non-malicious insider action in data loss prevention data.

CyberCyte detects Shadow IT and Shadow AI from the forensic artefacts it already collects: browser add-ons, Visual Studio and VS Code extensions, processes and their DNS and IP requests, installed applications and packages, persistence mechanisms, and local and domain users. Its generative AI engine classifies, allowlists and enriches these artefacts so that security teams review what matters rather than thousands of raw entries. Findings flow into the CISO Dashboard and the GRC risk registry, and can be acted on through Application Control or Unified Remediation & Response.

What CyberCyte Adds to E5

Beyond Defender health and Shadow AI, CyberCyte extends E5 with capabilities that complete the Continuous Threat Exposure Management (CTEM) cycle and connect it to governance and compliance:

• Configuration assessment against CIS, DoD, BSI and Microsoft security baselines across Windows, Linux and macOS.
• Centralised vulnerability management that combines Defender findings with 10+ tools such as Tenable, Qualys, Invicti and Burp in one prioritised view.
• Unified remediation and patch management across Windows and Linux.
• Security Diagnostics simulations that measure ransomware and data-leakage risk.
• Active Directory, firewall, network device and cloud platform analysis, including CIS-based assessment for Azure, AWS and Google Cloud.
• External exposure analysis: risky open ports, SSL certificate health, cybersquatting, dark web mentions and data leakage.
• GRC and TPRM: a risk registry and SoA populated from findings, with compliance mapping across ISO 27001, NIST, CIS, PCI DSS, DORA, NIS2 and 30+ standards, and evidence-based assessment of suppliers.

How CyberCyte and Microsoft Work Together

The two platforms have distinct, complementary roles. Microsoft Defender prevents, detects and responds to threats. CyberCyte assures that this protection is working, reduces the exposure around it and turns the combined findings into measurable risk and compliance outcomes.

CyberCyte is not an antivirus or EDR replacement. Microsoft Defender remains the prevention, detection and response layer, and Microsoft Sentinel or another SIEM remains the central security monitoring platform where used. CyberCyte protects the investment in E5 by making sure it works as licensed and fills the exposure, Shadow AI and compliance gaps around it.

Recommended Next Steps

• Baseline: deploy CyberCyte collection across the estate and measure Defender health, Windows Security Center registrations, configuration and Shadow IT and Shadow AI exposure.
• Remediate: fix Defender and Windows Security Center issues with automated remediation and confirm effectiveness with Security Diagnostics.
• Integrate: connect Defender alerts and vulnerability data to CyberCyte for unified prioritisation and incident tracking.
• Sustain: move to continuous validation, optionally through CyberCyte MDR with regular risk review meetings, remediation assistance and compliance support.

Frequently Asked Questions

Sources

1. Microsoft Learn, “Microsoft Defender Antivirus in passive mode”. learn.microsoft.com
2. Microsoft Learn, “Microsoft Defender Antivirus compatibility with other security products”. learn.microsoft.com
3. Sevco Security, “A Practitioner’s Guide: Top 5 Pitfalls in Deploying & Configuring Microsoft Defender for Endpoint”. sevcosecurity.com
4. Kiteworks, “Verizon DBIR 2026: Shadow AI Surges as Top Insider Threat”, 2026. kiteworks.com