Windows Defender Update Released for Windows 10 & 11 ISOs – March 2026

Microsoft has released a new security update package for its Defender anti-malware solution, now integrated within Windows 10 and 11 installation images – including various Windows Server editions. This update, designed to bolster protection against emerging threats, is intended for deployment across all new installations of the operating systems. The move addresses a potential security gap that can exist immediately after a fresh OS install, where the anti-malware definitions may be outdated.

The demand for these periodic updates stems from the constant evolution of the threat landscape. Malware developers continually devise new techniques to evade detection, necessitating frequent updates to anti-malware software. Updating the installation images directly ensures that even a newly installed system benefits from the latest threat intelligence, minimizing the window of vulnerability. This isn’t a new practice; Microsoft routinely pushes these updates to Windows images (WIM and VHD files, and ISOs) roughly every three months.

The latest security intelligence update, version 1.445.6.0, also updates the Defender package to the same version number. This impacts a broad range of Windows versions, including Windows 11, Windows 10 (even those utilizing Extended Security Updates or ESU), Windows 10 Enterprise LTSC 2021, Windows 10 Enterprise LTSC 2019, Windows 10 Enterprise LTSB 2016, as well as Windows Server 2022, 2019, and 2016. The update specifically targets the anti-malware client, engine, and signature versions, bringing them to platform version 4.18.26010.5, engine version 1.1.26010.1, and security intelligence version 1.445.6.0.

Closing the Initial Protection Gap

The core issue this update addresses is the inherent delay between the creation of a Windows installation image and its actual deployment. Because these images are created ahead of time, the anti-malware definitions included within them can quickly become stale. Microsoft explains that these updated definitions help to close this protection gap, providing a more secure out-of-box experience. Without this, a newly installed system could be vulnerable to threats that were already known at the time of the image creation but weren’t reflected in the included security definitions.

The security intelligence update version 1.445.6.0, released earlier in February 2026, adds detections for a variety of malware types, including trojans, backdoor exploits, and AutoKMS activators. AutoKMS, in particular, is a common method used to illegally activate Windows and other Microsoft software, often bundled with malicious payloads. The update also addresses emerging threats that exploit vulnerabilities in commonly used software.

How Defender Updates Work

Microsoft Defender, formerly known as Windows Defender, operates on a layered security model. It combines real-time protection, cloud-delivered protection, and regular signature updates to identify and neutralize threats. Real-time protection monitors system activity for suspicious behavior, while cloud-delivered protection leverages Microsoft’s vast threat intelligence network to identify and block emerging threats. Signature updates, like the one detailed here, provide the anti-malware engine with the latest definitions of known malware, enabling it to accurately detect and remove threats. Microsoft’s dedicated security page provides a more detailed overview of the Defender suite.

The update process for installation images differs from the regular update mechanism used by installed Windows systems. Installed systems receive updates automatically through Windows Update, ensuring that they are always running the latest security definitions. However, installation images are static snapshots of the operating system, requiring a separate update process to incorporate the latest security intelligence. This update package is designed to be integrated into these images before they are used to deploy new systems.

Impact on Different Windows Versions

The broad compatibility of this update highlights Microsoft’s commitment to security across its entire Windows ecosystem. While Windows 11 is the latest version of the operating system, many organizations and individuals continue to rely on older versions, such as Windows 10 and Windows Server. The inclusion of these older versions in the update ensures that they remain protected against emerging threats, even after their official end-of-life dates (in the case of Windows 10 ESU). As noted by Microsoft, Windows 10 support ended on October 14, 2025, making continued security updates via ESU or upgrading to Windows 11 crucial.

The Long-Term Servicing Channel (LTSC) versions of Windows 10 and Server are specifically designed for environments that require a high degree of stability and predictability. These versions receive security updates for an extended period, but they do not receive feature updates. This update package ensures that even LTSC versions remain protected against the latest threats.

What Comes Next: Ongoing Threat Intelligence

Microsoft’s release of this update is not a one-time event. The company continuously monitors the threat landscape and releases new security intelligence updates on a regular basis. The current latest intelligence update is version 1.445.415.0 as of March 8, 2026, indicating a rapid pace of updates. Organizations and individuals should ensure that their Windows systems are configured to receive these updates automatically to maintain a strong security posture. For those managing large deployments, incorporating these updated images into their standard build processes is essential. The ongoing cycle of threat detection, analysis, and update release is a critical component of Microsoft’s overall security strategy.

Microsoft encourages users to leverage the full suite of security features available in Windows Defender, including cloud-delivered protection and behavioral monitoring. These features provide an additional layer of defense against sophisticated threats that may evade traditional signature-based detection methods. Regularly reviewing security settings and enabling all available protection features can significantly enhance the overall security of a Windows system.