diff --git a/x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_14_0.test.ts b/x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_14_0.test.ts
index d058fd6b51375..f0c397e93ac4e 100644
--- a/x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_14_0.test.ts
+++ b/x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_14_0.test.ts
@@ -13,8 +13,14 @@ import { migrateEndpointPackagePolicyToV7140 } from './to_v7_14_0';
 
 describe('7.14.0 Endpoint Package Policy migration', () => {
   const migration = migrateEndpointPackagePolicyToV7140;
-  it('adds supported option for ransomware on migrations', () => {
-    const doc = {
+  const policyDoc = ({
+    windowsMalware = {},
+    windowsRansomware = {},
+    windowsPopup = {},
+    linuxMalware = {},
+    linuxPopup = {},
+  }) => {
+    return {
       id: 'mock-saved-object-id',
       attributes: {
         name: 'Some Policy Name',
@@ -42,26 +48,15 @@ describe('7.14.0 Endpoint Package Policy migration', () => {
               policy: {
                 value: {
                   windows: {
-                    ransomware: {
-                      mode: 'off',
-                    },
-                    malware: {
-                      mode: 'off',
-                    },
-                    popup: {
-                      malware: {
-                        message: '',
-                        enabled: false,
-                      },
-                      ransomware: {
-                        message: '',
-                        enabled: false,
-                      },
-                    },
+                    ...windowsMalware,
+                    ...windowsRansomware,
+                    ...windowsPopup,
                   },
                   linux: {
                     events: { process: true, file: true, network: true },
                     logging: { file: 'info' },
+                    ...linuxMalware,
+                    ...linuxPopup,
                   },
                 },
               },
@@ -71,330 +66,108 @@ describe('7.14.0 Endpoint Package Policy migration', () => {
       },
       type: ' nested',
     };
+  };
 
-    expect(migration(doc, {} as SavedObjectMigrationContext)).toEqual({
-      attributes: {
-        name: 'Some Policy Name',
-        package: {
-          name: 'endpoint',
-          title: '',
-          version: '',
-        },
-        id: 'endpoint',
-        policy_id: '',
-        enabled: true,
-        namespace: '',
-        output_id: '',
-        revision: 0,
-        updated_at: '',
-        updated_by: '',
-        created_at: '',
-        created_by: '',
-        inputs: [
-          {
-            type: 'endpoint',
-            enabled: true,
-            streams: [],
-            config: {
-              policy: {
-                value: {
-                  windows: {
-                    ransomware: {
-                      mode: 'off',
-                      supported: true,
-                    },
-                    malware: {
-                      mode: 'off',
-                    },
-                    popup: {
-                      malware: {
-                        message: '',
-                        enabled: false,
-                      },
-                      ransomware: {
-                        message: '',
-                        enabled: false,
-                      },
-                    },
-                  },
-                  linux: {
-                    events: { process: true, file: true, network: true },
-                    logging: { file: 'info' },
-                    malware: {
-                      mode: 'off',
-                    },
-                    popup: {
-                      malware: {
-                        message: '',
-                        enabled: false,
-                      },
-                    },
-                  },
-                },
-              },
-            },
+  it('adds supported option for ransomware on migrations and linux malware when windows malware is disabled', () => {
+    const initialDoc = policyDoc({
+      windowsMalware: { malware: { mode: 'off' } },
+      windowsRansomware: { ransomware: { mode: 'off' } },
+      windowsPopup: {
+        popup: {
+          malware: {
+            message: '',
+            enabled: false,
           },
-        ],
+          ransomware: {
+            message: '',
+            enabled: false,
+          },
+        },
       },
-      type: ' nested',
-      id: 'mock-saved-object-id',
     });
-  });
 
-  it('adds linux malware option and notification customization when windows malware is disabled', () => {
-    const doc = {
-      id: 'mock-saved-object-id',
-      attributes: {
-        name: 'Some Policy Name',
-        package: {
-          name: 'endpoint',
-          title: '',
-          version: '',
-        },
-        id: 'endpoint',
-        policy_id: '',
-        enabled: true,
-        namespace: '',
-        output_id: '',
-        revision: 0,
-        updated_at: '',
-        updated_by: '',
-        created_at: '',
-        created_by: '',
-        inputs: [
-          {
-            type: 'endpoint',
-            enabled: true,
-            streams: [],
-            config: {
-              policy: {
-                value: {
-                  windows: {
-                    ransomware: {
-                      mode: 'off',
-                    },
-                    malware: {
-                      mode: 'off',
-                    },
-                    popup: {
-                      malware: {
-                        message: '',
-                        enabled: false,
-                      },
-                      ransomware: {
-                        message: '',
-                        enabled: false,
-                      },
-                    },
-                  },
-                  linux: {
-                    events: { process: true, file: true, network: true },
-                    logging: { file: 'info' },
-                  },
-                },
-              },
-            },
+    const migratedDoc = policyDoc({
+      windowsMalware: { malware: { mode: 'off' } },
+      windowsRansomware: { ransomware: { mode: 'off', supported: true } },
+      windowsPopup: {
+        popup: {
+          malware: {
+            message: '',
+            enabled: false,
           },
-        ],
+          ransomware: {
+            message: '',
+            enabled: false,
+          },
+        },
       },
-      type: ' nested',
-    };
-
-    expect(migration(doc, {} as SavedObjectMigrationContext)).toEqual({
-      attributes: {
-        name: 'Some Policy Name',
-        package: {
-          name: 'endpoint',
-          title: '',
-          version: '',
+      linuxMalware: {
+        malware: {
+          mode: 'off',
         },
-        id: 'endpoint',
-        policy_id: '',
-        enabled: true,
-        namespace: '',
-        output_id: '',
-        revision: 0,
-        updated_at: '',
-        updated_by: '',
-        created_at: '',
-        created_by: '',
-        inputs: [
-          {
-            type: 'endpoint',
-            enabled: true,
-            streams: [],
-            config: {
-              policy: {
-                value: {
-                  windows: {
-                    ransomware: {
-                      mode: 'off',
-                      supported: true,
-                    },
-                    malware: {
-                      mode: 'off',
-                    },
-                    popup: {
-                      malware: {
-                        message: '',
-                        enabled: false,
-                      },
-                      ransomware: {
-                        message: '',
-                        enabled: false,
-                      },
-                    },
-                  },
-                  linux: {
-                    events: { process: true, file: true, network: true },
-                    logging: { file: 'info' },
-                    malware: {
-                      mode: 'off',
-                    },
-                    popup: {
-                      malware: {
-                        message: '',
-                        enabled: false,
-                      },
-                    },
-                  },
-                },
-              },
-            },
+      },
+      linuxPopup: {
+        popup: {
+          malware: {
+            message: '',
+            enabled: false,
           },
-        ],
+        },
       },
-      type: ' nested',
-      id: 'mock-saved-object-id',
     });
+
+    expect(migration(initialDoc, {} as SavedObjectMigrationContext)).toEqual(migratedDoc);
   });
 
-  it('adds linux malware option and notification customization when windows malware is enabled', () => {
-    const doc = {
-      id: 'mock-saved-object-id',
-      attributes: {
-        name: 'Some Policy Name',
-        package: {
-          name: 'endpoint',
-          title: '',
-          version: '',
-        },
-        id: 'endpoint',
-        policy_id: '',
-        enabled: true,
-        namespace: '',
-        output_id: '',
-        revision: 0,
-        updated_at: '',
-        updated_by: '',
-        created_at: '',
-        created_by: '',
-        inputs: [
-          {
-            type: 'endpoint',
+  it('adds supported option for ransomware on migrations and linux malware option and notification customization when windows malware is enabled', () => {
+    const initialDoc = policyDoc({
+      windowsMalware: { malware: { mode: 'on' } },
+      windowsRansomware: { ransomware: { mode: 'on' } },
+      windowsPopup: {
+        popup: {
+          malware: {
+            message: '',
             enabled: true,
-            streams: [],
-            config: {
-              policy: {
-                value: {
-                  windows: {
-                    ransomware: {
-                      mode: 'off',
-                    },
-                    malware: {
-                      mode: 'on',
-                    },
-                    popup: {
-                      malware: {
-                        message: '',
-                        enabled: true,
-                      },
-                      ransomware: {
-                        message: '',
-                        enabled: false,
-                      },
-                    },
-                  },
-                  linux: {
-                    events: { process: true, file: true, network: true },
-                    logging: { file: 'info' },
-                  },
-                },
-              },
-            },
           },
-        ],
+          ransomware: {
+            message: '',
+            enabled: true,
+          },
+        },
       },
-      type: ' nested',
-    };
+    });
 
-    expect(migration(doc, {} as SavedObjectMigrationContext)).toEqual({
-      attributes: {
-        name: 'Some Policy Name',
-        package: {
-          name: 'endpoint',
-          title: '',
-          version: '',
+    const migratedDoc = policyDoc({
+      windowsMalware: { malware: { mode: 'on' } },
+      windowsRansomware: { ransomware: { mode: 'on', supported: true } },
+      windowsPopup: {
+        popup: {
+          malware: {
+            message: '',
+            enabled: true,
+          },
+          ransomware: {
+            message: '',
+            enabled: true,
+          },
         },
-        id: 'endpoint',
-        policy_id: '',
-        enabled: true,
-        namespace: '',
-        output_id: '',
-        revision: 0,
-        updated_at: '',
-        updated_by: '',
-        created_at: '',
-        created_by: '',
-        inputs: [
-          {
-            type: 'endpoint',
+      },
+      linuxMalware: {
+        malware: {
+          mode: 'on',
+        },
+      },
+      linuxPopup: {
+        popup: {
+          malware: {
+            message: '',
             enabled: true,
-            streams: [],
-            config: {
-              policy: {
-                value: {
-                  windows: {
-                    ransomware: {
-                      mode: 'off',
-                      supported: true,
-                    },
-                    malware: {
-                      mode: 'on',
-                    },
-                    popup: {
-                      malware: {
-                        message: '',
-                        enabled: true,
-                      },
-                      ransomware: {
-                        message: '',
-                        enabled: false,
-                      },
-                    },
-                  },
-                  linux: {
-                    events: { process: true, file: true, network: true },
-                    logging: { file: 'info' },
-                    malware: {
-                      mode: 'on',
-                    },
-                    popup: {
-                      malware: {
-                        message: '',
-                        enabled: true,
-                      },
-                    },
-                  },
-                },
-              },
-            },
           },
-        ],
+        },
       },
-      type: ' nested',
-      id: 'mock-saved-object-id',
     });
+
+    expect(migration(initialDoc, {} as SavedObjectMigrationContext)).toEqual(migratedDoc);
   });
 
   it('does not modify non-endpoint package policies', () => {