Windows 11 Security: Every Built-in Protection Explained

Windows 11 security is built in layers. Some protections run without you doing anything, such as Microsoft Defender Antivirus and the firewall. Others depend on hardware, like TPM 2.0 and Secure Boot, which is why they are part of the Windows 11 requirements. A few are worth checking yourself, because they are off on some PCs or need a one-time setup. This hub explains each layer, where to find it, and which settings to check.

Everything here applies to Windows 11 version 24H2 and 25H2. Where Home and Pro differ, we say so.

The Windows Security app

The starting point is the Windows Security app. Open it from Start, or go to Settings > Privacy & security > Windows Security and select Open Windows Security. Its home page shows a status for each area, with a green tick when no action is needed:

Section	What it covers
Virus & threat protection	Microsoft Defender Antivirus scans, real-time protection, ransomware protection
Account protection	Windows Hello, dynamic lock and Microsoft account security
Firewall & network protection	Windows Defender Firewall for each network profile
App & browser control	Smart App Control, reputation-based protection (SmartScreen), exploit protection
Device security	Core isolation, security processor (TPM), Secure Boot
Device performance & health	Storage, battery, apps and software health report
Family options	Links to Microsoft Family Safety
Protection history	Recent detections and actions

If a section shows a yellow or red warning, select it; Windows Security normally tells you exactly what to do.

Microsoft Defender Antivirus

Defender is the antivirus that comes with Windows 11. It runs real-time protection, uses cloud-delivered protection to identify new threats, and receives definition updates through Windows Update. You can run quick, full, custom and offline scans, review Protection history and, with care, add exclusions.

If you install a compatible third-party antivirus, Defender turns itself off automatically and the other product takes over; uninstall that product and Defender comes back. Our Windows 11 Defender guide covers scans and settings step by step, and ransomware protection explains controlled folder access.

Firewall and network protection

Windows Defender Firewall is on by default for Domain, Private and Public networks. In Windows Security > Firewall & network protection you can see which profile is active. Public is the stricter profile and should be used for hotel, cafe and airport Wi-Fi.

There is rarely a reason to turn the firewall off. If an app needs access, Windows will ask when it first runs; you can review allowed apps under Allow an app through firewall. More detail in our firewall guide.

Smart App Control and SmartScreen

Smart App Control is found in Windows Security > App & browser control. According to Microsoft, when you run an app it checks with a cloud-powered security service; apps judged safe run, malicious or potentially unwanted apps are blocked, and when the service cannot decide it checks the digital signature and blocks unsigned or invalidly signed apps. Microsoft says it is available only on some devices, and that recent Windows updates let you turn it on or off without a clean install. Microsoft also states there is no way to bypass it for individual apps, so if it blocks software you need, your choice is to turn it off. See Smart App Control.

Microsoft Defender SmartScreen is separate and older. Under App & browser control > Reputation-based protection settings, it checks downloaded apps and files, websites in Microsoft Edge and Microsoft Store apps, and can block potentially unwanted apps. It also includes phishing protection, which can warn you if you enter your Windows password on a reported phishing site or in an unsafe app. Leave these on. More in SmartScreen and phishing protection.

Core isolation and memory integrity

Device security > Core isolation details contains Memory integrity, also called hypervisor-protected code integrity. It uses virtualisation to make it much harder for malicious code to tamper with high-security processes in Windows. It is on by default on many new PCs.

If you try to turn it on and Windows reports incompatible drivers, the list shows which ones. The fix is to update the driver from the device maker or remove the hardware or software that installed it, not to leave memory integrity off permanently. A restart is needed after turning it on. See core isolation and memory integrity.

The same page shows Security processor (your TPM) and Secure boot. These are hardware foundations; see TPM requirement and Secure Boot explained.

Windows Hello and account protection

A PIN, face or fingerprint sign-in through Windows Hello is safer than a password alone, because the PIN is tied to that one device and biometric data stays on the PC. Set it up in Settings > Accounts > Sign-in options. Windows Hello also protects passkeys, which let you sign in to supporting websites without a password. Our Windows Hello guide covers each method, and PIN vs password explains the difference.

Dynamic lock, also in Sign-in options, can lock the PC when a paired phone goes out of Bluetooth range.

Encryption: Device encryption and BitLocker

Encryption protects your files if the PC or its drive is stolen.

• Device encryption is available on many Windows 11 PCs, including Home edition. If supported, you will see it under Settings > Privacy & security > Device encryption. When you sign in with a Microsoft account, the recovery key is backed up to that account.
• BitLocker Drive Encryption is included in Pro, Enterprise and Education. Manage it in Control Panel > System and Security > BitLocker Drive Encryption, or by searching Manage BitLocker. Pro also includes BitLocker To Go for USB drives.

Before changing firmware settings, replacing the motherboard or updating BIOS, make sure you know where your recovery key is. If you are already looking at a blue recovery screen, see BitLocker recovery.

Ransomware protection and backups

Ransomware encrypts your files and demands payment to unlock them. Windows 11 has two defences in Windows Security > Virus & threat protection > Ransomware protection:

• Controlled folder access, off by default, only lets trusted apps change files in protected folders such as Documents and Pictures. It can block legitimate apps at first, so you may need to allow a few apps you trust. See controlled folder access.
• Ransomware data recovery points to OneDrive, where file versions can help you recover files after an attack.

Neither replaces a backup. Keep a copy of important files somewhere that is not permanently connected to the PC, such as a cloud service with version history or an external drive you unplug after each backup.

Updates and good habits

Security features only help if the system is current. Keep Settings > Windows Update on and install cumulative updates when they arrive; restart when asked. Use a standard account for daily use if several people share the PC, and keep User Account Control on its default level so system changes ask for permission.

A few things to avoid: disabling Defender or Windows Update through scripts, downloading “cracked” software, and turning off memory integrity or SmartScreen to make a dubious program run. If something feels wrong, run a full scan and an offline scan from Windows Security. For safe customisation that leaves these protections intact, see our Windows 11 tweaks hub and the Windows 11 privacy settings guide.

For a PC that locks itself when you leave your desk, see Dynamic lock in Windows 11.

For family PCs, parental controls in Windows 11 covers Microsoft Family Safety: child accounts, screen time and web filters.