At this point and time your AVs of the world are actually pretty close to what Defender has to offer. The reason we have Webroot on the client pcs is most of them are laptops in which case we added Webroot DNS to it. Huntress (ransomware) allows us to monitor and watch for footprints that are left by ransomware. We have also been looking at a EDR total package recently as well instead of having (2) separate pieces of software.