You’re probably paying two suppliers for antivirus

Microsoft includes endpoint protection in the licences most businesses already hold. The separate subscription usually predates it, renews automatically, and nobody ever revisits the decision.

Somewhere on your monthly invoices there is a line for endpoint security. Antivirus, endpoint protection, EDR — the name depends on who sold it to you. It’s per device, it renews annually, and it has probably been there longer than anyone currently in the business.

Separately, you pay Microsoft for licences. And depending which licence your people are on, endpoint protection is very likely already in it.

Two suppliers. One job.

How this happens to almost everyone

It’s rarely a bad decision. It’s usually an old decision that nobody revisited.

The antivirus product came first — often years before the business moved properly onto Microsoft 365. It worked. It still works. Then the Microsoft licences were bought or upgraded for entirely different reasons: Teams, email, storage, a compliance requirement, a move to remote working. Endpoint protection came along inside that licence as one of dozens of things nobody itemised.

Nothing then prompts anyone to notice. The antivirus renewal is automatic. The Microsoft invoice doesn’t list what’s included. And the person who would spot the overlap is usually the person whose job is keeping things running, not auditing what you’re buying.

So it just continues. In most tenants we look at, for years.

What your IT team will say when you ask

This is the useful part, because you will get pushback, and the pushback is reasonable. There are three standard objections and they’re worth understanding before the conversation.

“What we’ve got works fine.” Almost certainly true. But that isn’t the question. The question is whether it’s worth paying a second supplier for something already covered by an invoice you’re paying anyway. “It works” is an argument for keeping protection, not for buying it twice.

“There’d be a gap during the switch.” This is the objection that stalls the decision for months, and it’s based on a misunderstanding of how the changeover works. The Microsoft product deploys and sits dormant while your existing antivirus stays in charge. You configure, you test, you confirm it’s right — and only then remove the old one, at which point the new one takes over. Think of changing security firms: the new team is in the building and trained before the old one hands over the keys. The building is never empty.

“We’ve got too many different devices.” Historically fair. Windows, Macs, servers, Linux — different products, different consoles, nothing joined up. That’s changed: policy and reporting for all of those now run from one place.

That last objection is worth pushing on for a different reason. When people describe a mixed estate as complicated, what that often means in practice is that the Windows machines are properly protected and the Macs have nothing on them at all, because at some point somebody decided Macs don’t need it. If that’s your situation, you’re not only paying twice — you’re paying twice for coverage you don’t actually have everywhere.

Be honest about the answer

Sometimes the answer is to keep what you’ve got. If your existing product does something specific that matters to your business, or you’re mid-contract, or there’s a compliance reason, then keeping it is a perfectly good decision.

The point isn’t that one product is better than another. It’s that paying two suppliers for the same job should be a decision somebody made deliberately — not something the business inherited and never looked at again.

Most businesses have never had that conversation. It takes about an hour.

Three questions to ask

1. What do we pay for endpoint security, separately from Microsoft? A per-device figure and an annual total.
2. Does the Microsoft licence we’re already on include it? Microsoft 365 Business Premium and the higher enterprise licences include endpoint protection. If most of your people are on one of those, ask what’s actually deployed.
3. If we’re paying for both – is that a decision, or an inheritance? There are good reasons to run a third-party product. “It’s always been there” isn’t one.

And one more if you have Macs in the business: are they covered too, or just the Windows machines?

Our founder makes the technical case in detail, including the three objections above — worth sending to whoever looks after your IT before you have the conversation.

Want to know what else is sitting on your invoice unused? The free Business Risk Audit takes four minutes.