A Cyber Essentials vulnerability scan reporting outdated Microsoft Defender components is not simply a case of forcing an update. This walkthrough explains how to confirm what security software is installed, which product Windows considers active, why an outdated Defender component matters even when it is not your primary antivirus, and how to repair and verify the fix before rescanning.
This question has been published anonymously. Details that could identify the person or organisation have been removed.
“We’re trying to resolve some vulnerabilities ahead of Cyber Essentials Plus. Our vulnerability scan is reporting outdated versions of Microsoft Defender across several PCs. Defender isn’t supposed to be our main antivirus, so we’re confused about why it’s being flagged and why it isn’t updating. What should we check?”
Advisor’s short answer
If Windows Defender is not updating, don’t immediately start forcing updates across every workstation. First establish exactly what security software is installed, which antivirus Windows considers active, and what state Microsoft Defender is actually in.
Having another endpoint security product does not automatically make an outdated Defender component harmless. Vulnerability scanners assess what vulnerable software exists on the endpoint — not just which product you consider your primary antivirus.
The practical approach: identify → understand → repair → verify → rescan.
We recently investigated exactly this situation while helping an organisation resolve Cyber Essentials vulnerabilities.
The vulnerability scanner was finding outdated Microsoft Defender components across several PCs, even though Defender was not intended to be the primary antivirus. That immediately raised a more important question: what is actually providing antivirus protection on these machines?
Last checked: 18 August 2026.
Step 1 – Ask the PC what’s actually installed
Rather than relying on assumptions or what’s visible in the Start menu, query Windows directly. On an affected machine, open PowerShell as Administrator and run:
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct |
Select displayName,pathToSignedProductExeThis identifies antivirus products registered with Windows Security Center.
In the case we investigated, the results revealed:
- Datto was providing the main endpoint security protection
- Webroot components were still present from an earlier installation
- Microsoft Defender was still installed
- Defender’s platform and engine were significantly behind current versions
So the scanner was not saying: “You aren’t protected because Defender isn’t working.”
It was saying: “There is a vulnerable Microsoft Defender component present on this computer.”
Those are two very different problems.
Step 2 – Check Microsoft Defender’s actual status
Use PowerShell rather than relying entirely on the Windows Security interface. Run:
Get-MpComputerStatus | Select `
AMRunningMode,
AMProductVersion,
AMEngineVersion,
AntivirusSignatureVersion,
AntivirusSignatureLastUpdatedThis returns:
- Defender operating mode
- Defender platform version
- Malware protection engine version
- Security intelligence version
- Date security intelligence was last updated
Microsoft Defender consists of several components. Having current antivirus signatures does not necessarily mean that the Defender platform or engine itself is current. Vulnerability scanners can report outdated platform and engine versions even when the signature database appears up to date.
Why does Cyber Essentials care if we’re using another antivirus?
Because vulnerability scanners generally assess what vulnerable software exists on the endpoint — not just which product you consider your main security application.
Having another endpoint protection platform installed does not automatically make an outdated software component harmless. If an old or vulnerable Defender component remains present on the machine, the sensible approach is:
identify it → understand why it isn’t updating → repair it → verify the version → rescan
Rather than simply excluding the vulnerability from the report.
Step 3 – Remove unwanted security software
The investigation also identified remnants of an older Webroot installation. This is worth dealing with.
Multiple antivirus or security products can interfere with one another, particularly where old services, drivers or components remain after a previous product has supposedly been removed.
Once the intended primary security platform was confirmed, the legacy components were cleaned up before concentrating on repairing Microsoft Defender.
The principle is straightforward: know which security product is supposed to be protecting the machine and remove security software that no longer has a purpose.
Step 4 – Reset and update Microsoft Defender
With the environment clarified, the next step was repairing the Defender installation and bringing its components current.
Start by trying a normal security intelligence update via PowerShell:
Update-MpSignatureYou can also force a Defender update using Microsoft’s command-line utility:
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdateWhere the Defender platform itself is behind, install Microsoft’s current Defender platform update. Microsoft publishes Defender platform updates under KB4052623. Security intelligence updates are commonly identified as KB2267602.
Applying the current Defender platform update corrected the old platform and engine versions that the vulnerability scanner had detected.
Step 5 – Check the version again
Don’t assume the remediation has worked just because Windows Update says everything is current. Run the same check again:
Get-MpComputerStatus | Select `
AMRunningMode,
AMProductVersion,
AMEngineVersion,
AntivirusSignatureVersion,
AntivirusSignatureLastUpdatedCompare the output with the values recorded before the repair. This gives you evidence that:
- The Defender platform changed
- The engine updated
- Security intelligence is current
- The machine is no longer running the vulnerable component detected by the scanner
Step 6 – Reboot and rescan
Once the update has completed:
- 1Reboot the workstation
- 2Recheck Get-MpComputerStatus
- 3Run your vulnerability scan again
This last step matters. Cyber Essentials remediation is not complete because you’ve clicked Update. It’s complete when the vulnerable condition the scanner identified no longer exists.
What did we learn?
What initially looked like several separate vulnerabilities across multiple computers turned out to have a common underlying cause. The investigation followed a consistent process:
- 1Vulnerability detected
- 2Identify security products installed
- 3Confirm which product is genuinely providing protection
- 4Find legacy security software
- 5Check Defender platform, engine and signature versions
- 6Repair and reset Defender
- 7Apply current Microsoft Defender updates
- 8Verify the new versions
- 9Rescan
That approach is much more useful than treating every CVE as an individual problem.
Advisor’s view
Cyber Essentials vulnerability reports can look intimidating because a single outdated component may generate several separate vulnerability findings.
Don’t start by chasing every CVE individually. Start by asking: what software or component is causing these findings?
Fixing one underlying application or update problem can sometimes remove several vulnerabilities at once.
And if Windows Defender is not your primary antivirus, don’t assume a Defender vulnerability can simply be ignored. Find out what’s installed, what’s active, what’s outdated, why it’s outdated, fix it, and prove it’s fixed.
That’s the practical route to Cyber Essentials remediation.
Related reading
Other IT Club articles relevant to Cyber Essentials and endpoint security:
What Counts as a Cloud Service for Cyber Essentials? →
Microsoft 365 Security Baseline Checklist for SMEs →
Make Chrome Autofill Safer with Windows Hello →
Got an IT problem you’re getting conflicting answers about?
Ask the Advisor. Send us the problem and we’ll try to cut through the technical noise and give you a practical answer.
Plain-English Takeaway
When a Cyber Essentials vulnerability scan reports outdated Microsoft Defender components, do not assume the finding can be ignored because you use another antivirus. Establish what is installed, confirm which product Windows considers active, remove any legacy security software, update the Defender platform and engine, and verify the result by running the version check again before rescanning.
Tap to follow The IT Club Briefing on WhatsApp.
Related Articles
Do I Really Need to Spend £1,000+ on a Business Laptop?
Need a powerful business laptop without spending £1,000+? See why a refurbished workstation with 32 GB RAM can offer better value for many SMEs.
Read articleA Customer Has Asked for All Their Data — What Do You Do?
A customer asks what personal data you hold, says they never agreed to marketing and wants everything deleted. This practical UK guide explains what a small business should do first — without treating one email as one simple request.
Read articleDoes MFA Have to Apply to Every Microsoft 365 Guest?
Does every Microsoft 365 guest need MFA? IT Club explains Teams meetings, SharePoint sharing, guest access and Conditional Access in plain English.
Read article