Ensure endpoint protection on Azure machines

Endpoint protection on Azure machines is unusually cheap to put right. Microsoft Defender Antivirus is built into Windows Server 2016 and later at no extra charge, the Microsoft Antimalware extension for older Windows is free, and the only meaningful Azure spend is the Defender for Servers plan that licenses Defender for Endpoint as the EDR layer and powers the health assessment itself. So the cost question is narrow: are we paying for the Defender for Servers plan that both protects the machines and produces this evidence, and is engineering time being spent to install and repair across the fleet?

Frame each failing machine as a line on the risk register rather than a compliance checkbox. A domain-joined production server with no antimalware carries a far higher expected loss than an ephemeral build agent that lives for an hour, yet both surface as a single red finding. Map the failures to what each machine runs and how exposed it is, then prioritise by blast radius, not by finding count.

The insurance arithmetic is one-sided. The remediation is a modest, predictable plan charge plus engineering time. The downside of leaving machines undefended is the documented cost of a malware or ransomware incident: business interruption, recovery and forensics, ransom pressure, regulatory exposure and reputational damage. Most cyber-insurance questionnaires now ask explicitly whether endpoint protection is deployed and monitored across the server estate.

Sam is the finance partner supporting the platform team's ISO 27001 push. The security report lands with two dozen endpoint-protection findings across two older subscriptions: some machines with nothing installed, some installed but unhealthy. The instinct is not to wave through an open-ended remediation budget; it is to ask what is actually behind each finding and where the real Azure cost sits. Installing Microsoft Defender Antivirus or the free antimalware extension changes nothing on the bill, so the spend question is narrow: it is the Defender for Servers plan that licenses the EDR layer and produces this very health evidence, and that is a known, per-machine plan charge rather than an open cheque.

Sam asks the team to map each failing machine to the workload behind it. Three are production servers handling payment data with no antimalware at all, a handful are unhealthy because signatures fell stale after a network change, and the rest are short-lived build agents that barely matter. The list is reframed on the risk register: the three payment servers are high expected-loss items to fix today, the stale-signature machines are a quick repair, and the build agents are low-value drift to mop up or simply exempt. The finance pack reads: 'The protection is free or built in; the only recurring cost is the Defender for Servers plan, which also gives us the evidence; everything else is engineering time, prioritised by what each machine actually runs.'

The cost model here is asymmetric. The protection itself is built into Windows Server or free as an extension, and the only recurring Azure cost is the Defender for Servers plan that licenses the EDR layer and produces the health evidence, a known per-machine charge rather than an open-ended one. Against that bounded cost sits the unbounded tail risk of a malware or ransomware event: business interruption, recovery and forensics, ransom pressure, and regulatory and reputational fallout.

Each failing machine is a server where a future compromise has nothing standing in its way, and while the probability per machine is low, the probability across an undefended fleet over time is not. Cyber-insurance questionnaires now routinely ask whether endpoint protection is deployed and monitored across the server estate, and a 'no' or 'partly' here can raise premiums or void a claim. The finance role is to attach expected loss to each failing machine, fund the Defender for Servers plan as a known line, and prioritise the work by what each machine actually runs rather than by the order the report lists it.

Endpoint protection is the control that decides whether a single compromised server stays a single compromised server or becomes a ransomware event across the fleet. A machine with no antimalware, or one where protection was installed and then silently stopped, is a foothold an attacker can hold and spread from, and the report shows this as a scatter of separate findings across the estate.

The leadership question is not 'did we install antivirus once?' It is 'does every machine, including the ones built last week, have a defence that is actually running and up to date today?' The defensible end state is that endpoint protection is deployed everywhere by policy, its health is monitored continuously, and the unhealthy machines are repaired rather than left amber on a dashboard.

This is not a large cost decision. The protection itself is built in or free, and the only real spend is the Defender for Servers plan that licenses the EDR layer and produces the evidence. It is a governance decision about whether the estate is defended by design or only on the machines someone happened to set up correctly.

After a peer company spent a fortnight recovering from ransomware that spread from one unprotected server across its fleet, the CEO asked the obvious question at the next review: could that happen to us? The honest answer at the time was that it depended on how each machine had been built, because endpoint protection across the estate was governed by whoever set the server up rather than by policy.

The team's response was to stop treating endpoint protection as a per-machine install and start treating it as a guardrail. They listed every machine with no protection or unhealthy protection, deployed Microsoft Defender Antivirus and the antimalware extension where missing, enabled Defender for Endpoint as the EDR layer, repaired the unhealthy machines, and then assigned an Azure Policy that automatically installs the antimalware extension on any new Windows server that lacks it. The next time the CEO asked the question, the answer had changed from 'we believe most machines are covered' to 'every machine is protected, its health is monitored continuously, and new machines arrive defended.' That shift, from relying on each engineer to set protection up correctly to making the defended state automatic, is the confidence signal this capability delivers, and the protection itself costs nothing beyond the plan that monitors it.

Almost every ransomware event that crosses a fleet starts the same way: an endpoint with no working defence is compromised, and from there the attacker spreads. Endpoint protection on every machine is the control that makes that first foothold hard to take and easy to spot, and an Azure Policy backstop makes the gaps close automatically rather than waiting for someone to notice them.

The cost of getting this wrong is large and well documented, while the cost of fixing it is a modest plan charge plus engineering time, because the protection itself is built in or free. This is the rare class of control where the risk of inaction is severe, the cost of action is small and predictable, and a cyber-insurer will ask about it by name, which is exactly the trade leadership should be quickest to approve.