...and to build on your comment: Incentive to not slow down the performance of the OS while protecting it.

That was what caught my eye about MS's antivirus offerings from the start. I was really impressed how well it ran without me ever noticing.

I got a new laptop from work recently and I didn't spend a great deal of time looking it over as i was busy and ... of course I hit some random performance problems as McAfee was abusing my machine while I was trying to work. Endlessly installing antivirus programs is getting pretty old.

I had to help some regular computer user to clean their computer; one of the user's requests was to "fix" their McAfee, meaning, to update the subscription and solve other "security threats" (not viruses) that McAfee reported. After seeing how indecent this antivirus is, how it uses real intimidation, and is very intrusive with constant pop-ups, we settled on not continuing the subscription and getting rid of it altogether.

I was dealing with MySQL running on a Windows server box with McAfee Active Response running (MarService.exe). It has a feature for tracking files created/deleted, which is accomplished by hashing all new files, saving them to its own local DB, and presumably pushing them to the management server async. The app running on MySQL frequently creates many new tables and fills them as part of SOP, so the disk was constantly hammered by both MySQL and McAfee...

Windows Defender is the worst-performing antivirus on the market so that logic flies out the window.

Can you undergird this claim? (serious question, no flaming)

I disagree that this incentive differs for Windows Defender vs other AVs.

All AV software has the desire to not negatively impact performance because if it's horribly slow people will uninstall it / quit paying for it.

The parent comment is pointing out that companies which primarily produce AV products benefit from the continued existence and fear of malware (to a degree at least). This is different for MS, as the eradication of Windows viruses will help Windows, which should be large enough a benefit to override any perverse incentives Windows Defender would otherwise have.

I know what you're trying to say is "also, Windows Defender isn't as slow", which happens to be true, but I think that's simply an emergent effect of other factors, such as AV companies feeling the need to "do more" to add value (whereas Windows Defender is funded by MS, so it has less incentive to "stand out").

> Third party AV companies rely on continuing threats to stay in business.

i'm pretty neutral on this topic, but doesn't this point by extension mean they have a more direct interest in discovering security flaws and publishing them rather than burying them under the rug if they haven't been seen in the wild?

I think they share the same incentives in the sense that discovering, patching and reporting flaws is the mission statement.

Where they differ, I think, is the end goal. Non-MS AV need an ecosystem where there is still active threats to make revenue. MS actively doesn't want any threats, because they would realize more profits through their OS being marketable as virus-free.

I'm not saying Non-MS AV is out there introducing threats. But, they are incentivized to play whack-a-mole with bandaid fixes (keeping the ecosystem in check but alive) whereas MS is incentivized to go after root problems (kill the virus ecosystem, profit from OS).