diff --git a/windows/security/threat-protection/windows-defender-antivirus/next-gen-behavior-blocking.md b/windows/security/threat-protection/windows-defender-antivirus/next-gen-behavior-blocking.md
index f67c916bc7..e56abf5fe1 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/next-gen-behavior-blocking.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/next-gen-behavior-blocking.md
@@ -28,6 +28,7 @@ Behavioral blocking and containment capabilities in Microsoft Defender ATP use m
 
 Behavioral blocking is a post-execution protection, as shown in the following diagram:
 
+![diagram of pre and post execution protection](images/pre-execution-and-post-execution-detection-engines.png)
 
 
 Behavioral blocking consists of the following components: