Microsoft announced Morro on November 18, 2008. It marked a change in Microsoft's consumer antivirus marketing strategy. Instead of offering a subscription antivirus with a host of other tools — parental controls, photo backup, and a firewall, Morro would be free for all genuine installations of Windows and simply offer protection against malware. Microsoft Forefront will be offered alongside Morro, with central management tools not present in Morro.

While OneCare offered a Managed Firewall, PC Performance Tuning, Data Backup and Restore, Multi-PC Management, and Printer Sharing, MSE is really closer to Forefront Client Security, Microsoft's antivirus product for the enterprise.

MSE is a basic security suite designed for consumers but based on the Forefront Client Security desktop agent, solely providing malware detection and removal, but lacking Forefront Client Security's centralized management features. It includes the same antimalware engine (dubbed "Microsoft Malware Protection Engine", or MSMPENG for short), and virus definitions that all other Microsoft desktop antimalware products share, including Forefront Client Security, Windows Live OneCare, and Windows Defender (Defender excludes the antivirus definitions[citation needed] which are separate from the antispyware definitions). Before installation, MSE checks for a validated copy of Windows. No registration or personal information is required. The program will disable Windows Defender, as it provides protection against malware, not limited to spyware and adware.

Updates are published 3 times a day to Microsoft Update. Using default settings, archived files are decompressed, and then scanned. File downloads and e-mail attachments are also scanned. Its Dynamic Signature Service attempts to better identify malicious files by checking for updates if an application exhibits suspicious behavior. Before taking action against a suspect file, MSE prompts for user input. If no response is received in 10 minutes, then the suspected malware is handled according to its default action, letting MSE determine what to do with the malware. System Restore points are created before removing found malware.