@SwiftOnSecurity: Due to the very low perf cost of Defender antivirus update checks, I’m experimenting with launching an update request to their cloud 90 seconds after every login and workstation unlock.