Windows 11 Without a Paid Antivirus: Six Built-in Tools That Cover the Main Vectors of Cyberattacks

Most Windows 11 users believe that full computer protection requires installing a third-party antivirus suite. However, as RBC Ukraine highlights in a recent article, Microsoft's built-in security features already cover the vast majority of typical cyber threats — from phishing and malware to ransomware and physical device theft. The key condition is proper configuration of these tools, which not every user performs by default.

Biometrics and PIN: Moving Away from Vulnerable Passwords

The first and simplest step is replacing a text password with biometric sign-in (face scan via webcam or fingerprint) or a numeric PIN code. Both options are significantly harder to guess or intercept than a standard password, which can be written down, peeked at, or stolen via a keyboard trojan. To enable this, open "Settings" → "Accounts" → "Sign-in options", choose the appropriate authentication method, and confirm the action. From then on, each time you sign in to the system or perform privileged operations, Windows will request biometric data or a PIN rather than a password.

Firewall and Network Connection Segmentation

The second critical element is network protection and the firewall. In the menu "Settings" → "Privacy & security" → "Windows Security" → "Firewall & network protection", make sure the toggles are enabled for all three network types: domain, private, and public. This means that even when connected to an open Wi-Fi network at a café or airport, incoming and outgoing traffic will be filtered, and suspicious connections will be blocked at the operating system level.

Microsoft Defender: Real-Time Monitoring and Ransomware Protection

The built-in Microsoft Defender antivirus works "out of the box", but its effectiveness depends on the enabled subsystems. In the "Virus & threat protection" section, you need to check two settings: "Real-time protection" (scans files when they are opened, downloaded, or written) and "Controlled folder access" — a feature that blocks attempts by unknown or suspicious processes to encrypt user documents. It is the second setting that serves as the main barrier against ransomware, which in recent years has become the most common type of attack on home and corporate PCs.

Core Isolation: Memory Integrity as a "Sandbox" for Malicious Code

In the "Device security" menu, there is a "Core isolation details" tab. Enabling the "Memory integrity" parameter allows the operating system to run suspicious or potentially malicious code in an isolated virtual environment, separated from the Windows kernel. As a result, even a successful exploitation of a vulnerability will not give an attacker kernel-level privileges and full control over the system. On modern processors with VT-x / AMD-V support, this feature has virtually no impact on performance.

BitLocker, Two-Factor Authentication, and Linking to a Microsoft Account

Linking a local profile to a Microsoft account unlocks access to two important mechanisms. The first is two-factor authentication (2FA), which requires sign-in confirmation via a code from an app or SMS, even if the password has been compromised. The second is BitLocker disk encryption: in the event of a laptop theft, an attacker will not be able to read the data, even if they physically remove the drive and connect it to another computer. Without the recovery key tied to the Microsoft account, the encrypted volume remains unreadable.

"Find My Device": Geolocation and Remote Locking

The last, but no less important, element is the "Find My Device" service, enabled in the "Privacy & security" section. Once activated, the user can use the Microsoft web portal to determine the geolocation of a lost or stolen computer, as well as remotely block access to it, reset the password, and, if necessary, wipe the data. This turns Windows 11 into an ecosystem where security is not limited to the perimeter of a single device but extends across the entire lifecycle of the gadget — from system sign-in to physical loss.

Thus, a comprehensive configuration of the six listed tools — biometrics, firewall, Defender with folder control, core isolation, BitLocker with 2FA, and the device-finding service — forms a multi-layered defense comparable in threat coverage to most paid antivirus solutions. For a typical home or office user, this is sufficient to close the main attack vectors without additional financial costs.