Honest question: what is AV even for these days? I have had some form of AV on all of my Windows machines since the 90's. I don't think I have seen a detection in at least ten years.
I suspect it is mandated by some sort of compliance requirement, and the IT departments are just ticking a box. Maybe that's how this industry is still alive.
It doesn't mandate it explicitly, but your auditor may get fussy if you can't answer questions about the relevant controls with a clear answer.
I imagine things are different for people on PCIe NVMe SSD but Windows (or any modern OS I guess with any antivirus) is not so good if we are on spinning rust.
I think if we insist on real-time file scanning, the least we can do is provide at least a decent SATA SSD like the Samsung 860 EVO and adequate RAM to avoid thrashing.
(Enabling RAPID mode basically creates an invisible RAM disk and uses it under the hood.)
Gotta say, it works amazingly well. I am getting almost PCI/NVMe speeds on my SATA III SSD.
Sorry if this is obvious but does that mean we will have a better experience with a total of 32GB RAM than say 8GB? I have not worked with RAM disk before...
Make an AV, that does not really do anything, but can be used by thoughtful companies to "tick the box". Sell licenses and then do only the minimum required for compliance.
It could be described that it uses Windows Defender service to provide the basis of AV solution.
Nobody told NC State to require anti-virus, and the same company that created the requirements isn't going to accept some "minimal" solution to check their own box. Instead they will maintain a list of approved software, and your solution won't be on it.
For ransomware anyway. If they're targeting you specifically they'll find out what you're running and customize against it.
The AV needs to be up to date, pervasive, and with central reporting. Here is where simply having Windows Defender installed falls flat -- when it finds some malware on Betty's computer, you can't be sure what the scope was until you investigate yet standalone Windows Defender won't give you that information. So you need the enterprise version with the reporting console, alerts, etc.
AV is a nuisance for most of us, and I've gone sans it for many years, but it's critical in most workplaces because there are a lot of people who will happily run that program, etc, and you can't catch everything at the edge.
That said, I don't know if there's any compelling reason to use something beyond what the OS vendor already provides.
AV is still super important to have for people who don't understand that downloading a fake flash player to watch the newest game of thrones episode isn't the best idea. And there's a lot of those people out there.