#microsoft-defender

Analysis · May 22, 2026 · analysis-desk

Your antivirus runs as SYSTEM, and that's the whole story

Two actively-exploited Defender zero-days look like 'the AV is broken.' The pattern underneath is older and more boring: the scanner has run unsandboxed as SYSTEM for a decade, and that makes it a target, not a sentinel.