I do not know what makes sense financially but technically Windows Defender is well integrated within Windows and uses the power of cloud to detect advanced attacks.

@cyb_lawrence

Based on security, which detect and blocks zero-day's first, defender or anti-virus?

@bharaths for 0days, it's difficult to say as they are 0days... technically speaking Microsoft is well positioned for threat detection in the endpoint as Windows is one of the most attacked systems. Additionally, Microsoft uses the power of cloud thus any attack detected in one their customers is automatically detected by all its customers. We can say that Microsoft defender intercepts the attacker's OODA Loop.

I would go for Windows Defender for the obvious reasons already explained. Microsoft Windows is the most attacked platform and the product aligns well with the MITRE ATT&CK framework.

Other good positioned endpoint solutions for the enterprise in Symantec.

Check a global comparison below.

Summary Report 2020 - AV-Comparatives (av-comparatives.org)

https://www.av-test.org/en/antivirus/home-windows/