A new Microsoft announcement suggests it has found a way to deliver kernel-level visibility and capabilities to apps running in user mode. Experts conclude a ban on kernel access for cybersecurity tools could be forthcoming.

CSO Online offers insights into cybersecurity, risk management, and IT leadership, providing articles, reports, and expert analysis to help security professionals navigate the evolving threat landscape and protect their organizations from cyber attacks. By exploring CSO Online's curated content, CISOs, security managers, and IT executives can learn about threat intelligence, security frameworks, and incident response strategies for building resilient cybersecurity programs. Whether you're defending against ransomware, phishing attacks, or insider threats, CSO Online offers resources to strengthen your security posture and safeguard your digital assets.

CSO Online

Microsoft is developing a new Windows endpoint security platform that allows security applications to run in user mode while maintaining kernel-level visibility and functionality. This approach aims to address the risks highlighted by the CrowdStrike outage, where kernel-level access caused widespread system crashes. The company plans to provide limited kernel access through APIs rather than direct access, requiring security vendors to rearchitect their products. While Microsoft hasn't explicitly announced a ban on kernel access, industry experts believe this is a gradual move toward eventually restricting direct kernel access for third-party security tools.

Microsoft hints at revoking access to the Windows kernel — eventually