Breaking down client-side protection

Defender Antivirus actively protects your devices from the moment they are started. Running in the background, Antivirus scans suspicious binaries and alerts you the moment action is needed, sometimes even taking action on your behalf, and in either case notifying you so that you can investigate. In this section, we’ll break Defender Antivirus down into its component engines, gain an understanding of how that rolls up into RTP, clarify how it gets its security intelligence, and define different scan types, running modes, and exclusion options.

Client-side engines

As mentioned previously, both cloud-based and client-side engines work together to achieve next-generation protection. In this section, we’ll break down the different client-side engines to help illustrate how, when layered together, they create a holistic and dynamic protection stack on the client.

AMSI integration engine

The antimalware scan interface (AMSI)...