Replacing your old antivirus: a step-by-step switch plan

Plenty of small businesses are still running the antivirus that came with a reseller deal years ago, renewed each year because nobody had time to look at it. Replacing it feels risky: what if something breaks, or a laptop is left unprotected? Done in the right order, it's a routine job.

This guide gives you a plan you can follow whether you move to Microsoft Defender, CrowdStrike Falcon or something else. It assumes you have somewhere between 10 and 250 devices and either do IT yourself or have an outside provider who can help.

Signs it's time to switch

You don't need to replace a product that's working, well managed and fits your needs. These are the signs it isn't:

• It is a consumer or "small office" edition with no central console, so nobody can see whether every device is protected.
• Renewals and licence counts are a guess. Leavers' laptops still use seats; new starters were never added.
• Alerts go nowhere, or to one person's inbox that nobody reads.
• It only does signature-based scanning, with no behavioural detection or EDR to spot an attacker using legitimate tools. See What is EDR? for the difference.
• An insurer or customer is asking questions you can't answer. In government-backed research, 65% of insured SMEs had to meet specific security requirements to get cover, and endpoint protection was among the measures they put in place.¹

Cyber Essentials also sets a clear bar. Under v3.3, malware protection must be active on all devices in scope, kept up to date in line with vendor recommendations, and set to prevent malware running, prevent execution of malicious code and prevent connections to malicious websites.² If you can't prove that across every device, it's time.

Step 1: Take an inventory

You can't protect what you haven't found. Build a simple list before you buy anything:

Pull the list from your current antivirus console (if it has one), your Microsoft 365 or Intune device list, and your asset register. Where the three disagree, that's a device you need to track down.

While you're there, flag anything out of support. Windows 10 reached end of support on 14 October 2025 and no longer receives security updates unless enrolled in Microsoft's Extended Security Updates programme.³ New antivirus does not make up for a missing operating system patch, so plan those replacements alongside this project.

Step 2: Choose the replacement

Be honest about what you need rather than what sounds impressive.

• Microsoft Defender for Business is a good product and is included in Microsoft 365 Business Premium, for organisations up to 300 users.⁴ If you already pay for Business Premium, it should be on your shortlist.
• CrowdStrike Falcon is a dedicated endpoint platform with optional 24/7 threat hunting and managed response. Coffee Cyber sells it monthly per device with no contract; see our plans.
• Other vendors are worth a look too. Check independent testing and ask who looks at alerts out of hours.

The deciding question is usually not which engine is best but who acts when it raises an alert at 2am. Our honest comparison of CrowdStrike and Microsoft Defender for Business covers this in detail.

Step 3: Understand why you shouldn't run two at once

The NCSC warns that separate antivirus products "won't always work alongside the built-in antivirus software and could even stop it from working completely".⁵ Two products both trying to block the same file can cause conflicts, slow machines and odd crashes.

Here's how Windows handles it, according to Microsoft:⁶

• Windows 10 and 11: when a non-Microsoft antivirus is the primary product, Microsoft Defender Antivirus is disabled automatically. If that product expires, is uninstalled or stops providing real-time protection, Defender can switch itself back on.
• Windows Server: Defender does not step aside automatically. You need to set it to passive mode or disable it yourself when running another product, to avoid conflicts.

CrowdStrike's own setup guidance says that "for optimal performance, uninstall or disable other antivirus solutions before installing the Falcon sensor".⁷ So the plan is: remove the old product and install the new one in the same session, device by device.

Step 4: Prepare before touching any device

Most failed switches trip over something that could have been sorted in advance.

1. Get the uninstall password or tamper protection key. Business antivirus usually stops users removing it. Turn off tamper protection centrally, or note the uninstall password, before you start.
2. Download the vendor's official removal tool. Many vendors publish a clean-up utility for when the normal uninstall leaves pieces behind.
3. Decide how you'll deploy. Intune, an RMM tool or Group Policy makes this painless. With no management tool, plan a short visit or remote session per device.
4. List your business applications. Accounts packages, CAD software and line-of-business databases are the usual sources of false alarms. Check whether the new vendor publishes exclusions for them, and agree who will approve any you add.
5. Agree who gets the alerts. Before the first install, decide who receives alerts and what they do with them. If that's your IT provider, confirm they have console access.
6. Tell staff. A short note saying "security software is being updated this week, expect a restart" saves a lot of confused messages.

Step 5: Run a pilot

Pick three to five devices that represent your estate: someone in finance, someone using your most awkward application, a Mac if you have them, and your own machine. Then:

1. Remove the old antivirus (normal uninstall, then the removal tool if needed).
2. Restart.
3. Install the new agent straight away.
4. Confirm the device appears in the new console as protected.
5. Ask the user to work normally for two or three days and report anything odd.

Watch for blocked applications, slow logins and printing or scanning problems. Fix exclusions or policies now, while it's five devices rather than fifty.

Step 6: Roll out in waves

Once the pilot is clean, work through the rest in groups of 10 to 20 devices, a few days apart. Do the same remove, restart, install, check on each device. A sensible order:

1. Office desktops (easy to reach, always on)
2. Laptops, chasing remote workers by appointment
3. Macs, approving the security permissions the agent needs (ideally pushed by your device management tool so users aren't prompted)
4. Servers last, one at a time, outside working hours, with a recent backup and someone available to roll back

Keep a running tick list against your inventory. The last 10% always takes longest: the laptop in a drawer, the meeting room PC, the director who's never in.

Step 7: Verify, then cancel the old licence

Don't cancel the old product until you can prove the new one is everywhere. Check:

• Every device on your inventory shows as online and protected in the new console
• No device still reports the old antivirus in its installed programs
• On Windows, the Windows Security app shows the new product as your antivirus provider⁶
• A test alert reaches the right person (most vendors provide a harmless test method)
• Policies are set to prevent, not just detect
• New starters' devices get the agent automatically through your deployment tool

Then cancel the old subscription, remove its console accounts and export a device report from the new console. Keep that report: it's exactly the evidence a Cyber Essentials assessor or insurer will ask for.

Common problems and fixes

Where Coffee Cyber fits

If you move to CrowdStrike Falcon through Coffee Cyber, old antivirus removal and rollout help are part of the service, and first-line agent and console support is through the control panel. We don't do general IT support, so things like replacing out-of-support Windows 10 machines stay with you or your IT provider. You can see how the setup works on how it works.

Whichever product you choose, the order is the same: find every device, prepare, pilot, roll out in waves, verify, and only then cancel the old licence.

Common questions