To the anti-virus question, just Microsoft, default settings. I think the utility of AV these days is a bit questionable, and I don't think the other options are worth any premium. Instead, I use firefox w/ noscript add-on, and I don't run as a local admin day to day. Back up your files off-line in some manner to reduce risk of damage from ransom ware. Don't let other people use the computer.
Corporate environment, I recommend some sort of monitored endpoint product, like crowdstrike or tanium. No affiliation, have just seen good results. Zero-trust ideas are great, but if you're running legacy software (Microsoft) you need to be extra cautious about the internal network. Perimeter firewalls, IPS, segmentation, all matter.
Day to day, I use a chromebook a lot now. Same spy collection as Microsoft, but it's faster, cheaper, and more reliable.
) and you'll be forced to upgrade your hardware. My current rig is high performance, and nothing I run on it comes close to bogging it down. I'd hate to replace it just because it doesn't have the TPM (I'm probably OK, the MB is less than 3 years old, and EVGA has great support.)