One thing I'm very eager to see is how Defender and Microsoft in general will interact with various third-party AV and "enterprise security" solutions which almost invariably contain rootkit-ish/malware-ish modules.