Understanding Windows Defender alert levels


Alert levels help you choose how to respond to spyware and potentially unwanted software. While Windows Defender will recommend that you remove spyware, not all software that is flagged is malicious or unwanted. The information in this table can help you decide what to do if Windows Defender detects potentially unwanted software on your computer.

Alert level
What it means
What to do

Severe or High

Programs that might collect your personal information and negatively affect your privacy or damage your computer, for example, by collecting information or changing settings, typically without your knowledge or consent.

Remove this software immediately.

Medium

Programs that might affect your privacy or make changes to your computer that could negatively impact your computing experience, for example, by collecting personal information or changing settings.

Review the alert details to see why the software was detected. If you don't like what the software does or if you don't recognize and trust the publisher, consider blocking or removing the software.

Low

Potentially unwanted software that might collect information about you or your computer or change how your computer works, but is operating in agreement with licensing terms displayed when you installed the software.

This software is typically benign when it runs on your computer, unless it was installed without your knowledge. If you're not sure whether to allow it, review the alert details or check to see if you recognize and trust the publisher of the software.