Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / Windows 11 Is Blocking Third-Party Security Tools
Transcript
- Lucas: If your enterprise relies on CrowdStrike or SentinelOne for endpoint protection, Windows 11 might be quietly making those tools less effective. And Microsoft isn't exactly advertising that. Luna: Less effective how? Like, they don't work at all, or they just miss more stuff? Lucas: Both, depending on the build. The core issue is Virtualization-Based Security — VBS. Microsoft enabled it by default on new Windows 11 devices starting with version 22H2, and it's essentially a hypervisor that runs inside the OS. It isolates critical processes in a virtual secure mode. Luna: Right, that's the thing that makes it harder for malware to tamper with kernel-level stuff. Sounds good on paper. Lucas: Exactly. And it is good for security. But the trade-off is that VBS locks down kernel access. Third-party security vendors have historically relied on kernel-mode drivers to get deep visibility into processes, file operations, network activity. With VBS, those drivers either get blocked or they have to run in user mode, which is a fundamentally different architecture. Luna: So Microsoft is essentially saying 'use our security stack or your third-party tool will be handicapped.' Lucas: That's the perception, and a growing number of enterprise IT teams are seeing it play out. I talked to a security architect at a mid-size financial services firm — about 3,000 endpoints. They had CrowdStrike Falcon deployed across the fleet. After a Windows 11 feature update last fall, the CrowdStrike agent stopped being able to access certain kernel events. The vendor had to push an update that switched to a user-mode sensor, but the detection coverage dropped noticeably for fileless malware attacks. Luna: And what was Microsoft's response when they raised it? Lucas: Microsoft's position is that VBS is a security improvement designed to protect the kernel, and that third-party vendors can adapt by using the Windows Filtering Platform and other user-mode APIs. The problem is those APIs don't provide the same level of telemetry. CrowdStrike's own documentation acknowledges that kernel-mode sensors offer 'the highest level of visibility.' So you're asking vendors to downgrade their capabilities. Luna: And meanwhile, Microsoft Defender for Endpoint — which is a first-party product — gets to keep its kernel-level access, because Microsoft has a special exception. Lucas: That's the crux of it. Microsoft has a kernel-mode driver for Defender that's signed with a special certificate that VBS trusts. Third parties can't get that certificate. So Defender gets full visibility, while every other vendor operates from the outside looking in. It's a structural competitive advantage baked into the operating system. Luna: And you can't disable VBS easily either, right? I mean, you can, but... Lucas: You can. But it's not a simple toggle in Settings. You have to go into Group Policy or the registry, and then there are performance implications. VBS uses memory isolation that can impact SSD performance by up to 10-15 percent in some workloads. And Microsoft has said that future security features — like Credential Guard — will require VBS. So disabling it now could mean missing out on later protections. IT teams are stuck between a rock and a hard place. Luna: And this is only going to get worse with Windows 11 24H2, which I think tightens VBS further? Lucas: Correct. 24H2, which is rolling out to more devices this quarter, enables VBS by default on all new Windows 11 Pro and Enterprise devices, not just new hardware. It also enables Microsoft Defender for Endpoint's kernel-mode sensor by default if you have a qualifying license. So the default experience is Microsoft's security stack, and everything else is second-class. Luna: You know, this reminds me of the old browser wars — Microsoft bundling Internet Explorer and making it impossible for Netscape to compete. Except now it's the kernel, not the browser. Lucas: It's a fair parallel. And the stakes are arguably higher, because security is not just about user preference — it's about risk exposure. If you're a regulated industry — healthcare, finance, government — you may have compliance requirements that mandate specific security tools. If those tools can't operate effectively on Windows 11, you either switch tools or switch OS. Neither is cheap. Luna: And switching tools means retraining your SOC, reconfiguring SIEM integrations, redoing playbooks. That's months of work. Lucas: Months and six-figure costs. The financial services firm I mentioned — they ended up migrating to Microsoft Defender for Endpoint across the board. Not because they thought it was better, but because it was the path of least resistance on Windows 11. Their CrowdStrike contract had another year, but they paid the penalty to exit early. They calculated that the operational overhead of maintaining a degraded tool was higher than the switch. Luna: So Microsoft is effectively using the OS to drive adoption of its security products. And that's a multi-billion dollar revenue stream. Lucas: It's a huge part of their commercial cloud business. Microsoft's security revenue is now over 20 billion dollars annualized. And Defender for Endpoint is a key piece. Every enterprise that switches from a third-party tool to Defender adds to that number. And the OS update cycle is a natural forcing function. Luna: But what about enterprises that don't want to switch? Are there any workarounds that don't compromise security? Lucas: A few. One is to disable VBS entirely, but that lowers the overall security posture and might violate compliance rules. Another is to run third-party tools in user-mode and accept reduced visibility, then supplement with additional monitoring layers. Some organizations are deploying Linux-based endpoints for high-security roles — but that's a minority. The most practical workaround right now is to delay Windows 11 deployment as long as possible. But Windows 10 end of life is October 2025, so that clock is ticking. Luna: And extended security updates for Windows 10 are available — but they cost per device per year. Lucas: Right. Microsoft is essentially monetizing the transition. You either upgrade to Windows 11 and deal with the security stack implications, or you pay for extended updates on Windows 10. Either way, Microsoft wins. It's a captive market. Luna: And this is why some enterprises are looking seriously at third-party alternatives like Linux or ChromeOS for certain workloads. Not as a full replacement, but as a way to push back against the lock-in. Lucas: Yeah, I've seen that too. Particularly in regulated industries where the compliance cost of being locked into one vendor is higher than the migration cost. But that's a longer-term play. For the next few years, Windows 11 is the dominant enterprise desktop, and the VBS issue is something every IT leader needs to understand. Luna: And the irony is that VBS was sold as a security feature to protect users. But it's also a business strategy. Lucas: Exactly. And that's worth keeping in mind as you plan your next endpoint refresh. Anyway, I wanted to add — this kind of deep-dive analysis is exactly why a lot of listeners tell us they appreciate the show. We don't run ads, we don't take vendor money, and that's intentional. A small group of listeners helps keep it going through buy me a coffee dot com slash fexingo. If you find these conversations useful, that's the only way the show stays independent. Luna: And it really does make a difference. Every contribution adds up and lets us keep digging into topics that matter, without worrying about sponsors. Lucas: Alright, back to the VBS issue. I think the key takeaway for IT leaders is: don't wait until your next feature update to discover that your security toolchain is broken. Start testing now. Run your third-party EDR on a Windows 11 device with VBS enabled and see what telemetry you're actually getting. You might be surprised. Luna: And if you're in procurement, start asking your security vendors: 'What is your roadmap for user-mode detection on Windows 11? Can you guarantee parity with kernel-mode?' Because right now, most of them can't. Lucas: Right. And some vendors are investing in user-mode architectures. SentinelOne, for example, has been working on a user-mode sensor that uses machine learning to compensate for the lack of kernel visibility. But early reports suggest it's not as effective in detecting certain types of fileless attacks. So it's still a work in progress. Luna: The other angle is regulatory. If you're in a jurisdiction that requires vendor neutrality — like some EU countries — could Microsoft's approach be seen as anti-competitive? Lucas: It's possible. The EU has been scrutinizing Microsoft's bundling practices with Teams and Office. The kernel access issue is different, but it's similar in spirit: leveraging a dominant platform to push an ancillary product. I wouldn't be surprised if regulators start looking at this, especially if enterprises complain loudly enough. Luna: I think the bottom line is: for now, enterprises need to plan for a world where Microsoft's security stack is the default path of least resistance. And that might mean rethinking your whole endpoint security strategy. Lucas: Exactly. It's not a conspiracy, it's just a structural reality. And the more you understand the architecture, the better decisions you can make.