For years, the conversation about threat detection centered on the cloud: more data, better models, faster correlation. All of that still matters. But the most consequential fights between attackers and defenders in 2025 and 2026 have happened on the endpoint, at the boundary between user mode and the kernel. Attackers have learned that the fastest way to beat detection is to blind the sensor. That makes kernel driver development a frontline capability for any company that sells advanced threat detection.
This post explains how threat actors are evolving, why kernel-level visibility is essential, and which innovations will shape detection engineering over the next few years.
How threat actors are evolving
EDR killers and BYOVD go mainstream
The most important trend for executives to understand is the industrialization of "EDR killers," tools designed to disable endpoint security before ransomware is deployed. ESET reports tracking almost 90 EDR killers actively used in the wild by ransomware gangs of every size. Of these, 54 use bring your own vulnerable driver (BYOVD) techniques, abusing 35 legitimate but vulnerable signed drivers to gain kernel privileges and terminate security processes.
Named examples show how fast this has spread.
EDRKillShifter
Developed by RansomHub operators, EDRKillShifter was offered directly to affiliates. In August 2025, Singapore's Cyber Security Agency warned that a new EDR killer was being used by at least eight ransomware groups.
Qilin and Warlock
In April 2026, Cisco Talos and Trend Micro findings reported by The Hacker News described Qilin-linked tooling using a driver to terminate processes associated with over 300 different EDR drivers, while Warlock used a vulnerable NSec driver to kill security products at the kernel level.
Reynolds ransomware
In February 2026, the Symantec and Carbon Black Threat Hunter Team reported a payload that bundles a vulnerable NsecSoft NSecKrnl driver directly inside the ransomware, removing the separate step defenders could previously detect.
The business implication is blunt: if your sensor can be terminated by a signed driver an attacker brings along, your customers will experience that as your product failing. That is also why kernel-level security is a competitive advantage rather than an implementation detail.
Malware-free and faster attacks
CrowdStrike's 2025 Global Threat Report found that 79% of detections in 2024 were malware-free, up from 40% in 2019, and that average eCrime breakout time fell to 48 minutes, with the fastest at 51 seconds. Living-off-the-land binaries, scripting engines and remote management tools are legitimate software, so signature scanning offers little. Detecting abuse requires rich behavioral context: process lineage, command lines, memory operations, image loads, registry changes and network activity, ideally captured where the attacker cannot easily suppress it.
Below the OS: bootkits
Attackers also target the layers beneath the kernel. BlackLotus became the first publicly known UEFI bootkit able to bypass Secure Boot on patched Windows 11 systems in 2023. In November 2024, ESET discovered Bootkitty, the first UEFI bootkit targeting Linux. ESET assessed it as a proof of concept not seen deployed in the wild, but it demonstrated that bootkits are no longer confined to Windows. Defending against these threats requires measured boot validation, early-launch components and kernel integrity monitoring, all of which sit in low-level engineering territory.
Why visibility must start at the kernel
Think of the kernel as the building's foundation and wiring. User-mode security is a camera in the lobby. Kernel-level security is a sensor on every door, pipe and circuit. Three reasons explain why the most capable detection products invest there:
- Completeness. Process, thread, image load and registry callbacks on Windows, and LSM hooks and eBPF programs on Linux, see every relevant operation system-wide, not just those of processes the product chose to hook.
- Timeliness. Windows internals expert Pavel Yosifovich, quoted by Cybersecurity Dive in March 2026, warned that user mode is slower when accessing system APIs, and that for a short-lived malicious process user mode may be too slow to do anything about it. For prevention, milliseconds matter.
- Tamper resistance. Kernel components can protect the sensor's own processes, files and configuration, and detect suspicious driver loads before they are used against it.
This does not mean every feature belongs in ring 0. The strongest architectures keep kernel code small, rigorously tested and focused on collection and enforcement, while pushing analytics and decision logic into user mode and the cloud.
Five innovations shaping kernel-level detection
1. Microsoft's Windows Resiliency Initiative
After the July 2024 CrowdStrike outage, Microsoft convened the Windows Endpoint Security Ecosystem Summit in September 2024, launched the Windows Resiliency Initiative in November 2024 and introduced MVI 3.0, which requires gradual, ring-based and monitored security updates. In June 2025 it announced a private preview of a Windows endpoint security platform so that anti-virus and endpoint protection products can run in user mode. As of March 2026, reporting indicated the migration is a multi-year effort with no published API timeline. Vendors who deeply understand today's kernel interfaces will be best placed to map features onto new user-mode APIs without losing visibility.
2. eBPF on Linux
eBPF lets verified programs run safely inside the Linux kernel without a loadable kernel module. CrowdStrike's Falcon sensor for Linux, for example, can run in a user mode backed by eBPF programs, avoiding a kernel module while keeping kernel-sourced telemetry. BPF LSM extends this to enforcement. The trade-off is that eBPF has its own verifier limits, kernel version dependencies and, as security researchers have documented, potential for abuse by attackers themselves.
3. Apple's Endpoint Security framework
Since macOS Catalina, Apple has deprecated third-party kernel extensions in favor of user-space system extensions. The Endpoint Security framework provides NOTIFY events and AUTH events, which let a product allow or deny operations. AUTH events carry response deadlines, so performance engineering still decides product quality.
4. Hardened Windows defaults
Microsoft's vulnerable driver blocklist has been enabled by default since Windows 11 22H2, and memory integrity (HVCI) is on by default on most new Windows 11 devices. These defaults raise the bar for attackers, and for vendors: drivers must be HVCI compatible and properly signed, or they will not load.
5. Regulatory pressure on product security
The EU Cyber Resilience Act's reporting obligations took effect on 11 September 2026, requiring manufacturers to send an early warning within 24 hours of becoming aware of an actively exploited vulnerability, with full obligations applying from 11 December 2027. In the US, CISA's Secure by Design Pledge has grown from 68 signatories at launch in May 2024 to several hundred companies. A kernel driver with an exploitable flaw is now a regulatory event as well as a security one.
What this means for your roadmap
For CTOs and VPs of Engineering, the strategic questions are practical:
- Coverage: Which attacker techniques in your threat model, from BYOVD to credential theft to fileless execution, does your sensor see at the kernel level today?
- Self-protection: Could a known vulnerable driver terminate your agent? Have you tested against public EDR-killer tooling in a lab?
- Platform readiness: Is your Windows driver HVCI compatible, your Linux sensor eBPF capable across target kernels, and your macOS agent fully on the Endpoint Security framework?
- Deployment safety: Do content and code updates move through staged rings with automated health gates and rollback, as MVI 3.0 now expects?
- Future APIs: Have you inventoried which features depend on kernel mode so you can evaluate Microsoft's user-mode platform as it matures?
Answering these questions well is the difference between a sensor attackers route around and one they cannot. Where detection ends, remediation begins, and the engineering teams that can ship both are scarce, which is why we also wrote about the kernel talent gap.
FAQ
What is a BYOVD attack?
In a bring your own vulnerable driver attack, an adversary with administrative access installs a legitimate, digitally signed driver that contains a known vulnerability, then exploits it to gain kernel privileges and disable security tools. ESET reports BYOVD is the dominant technique among the nearly 90 EDR killers it tracks.
Why can't user-mode security tools stop EDR killers on their own?
EDR killers that reach the kernel operate with higher privilege than user-mode processes, so they can terminate or blind them. Kernel components, driver load monitoring and blocklists provide the layers needed to detect and resist these attacks.
Is Microsoft removing security vendors from the Windows kernel?
Microsoft is building a Windows endpoint security platform that lets security products run in user mode and is working with MVI partners on it. As of 2026 it remains in private preview, and Microsoft has not announced a date to block kernel-mode security drivers.
How does eBPF change Linux threat detection?
eBPF allows safe, verified programs to collect kernel telemetry and, with BPF LSM, enforce security policy without a traditional kernel module. It improves stability and portability but requires careful engineering around kernel versions and verifier constraints.
Get a threat-informed kernel roadmap
Threats are evolving at the kernel boundary, and your detection roadmap should too. VoidStarIndia's engineers can run a threat-informed kernel gap assessment: we map your sensor's Windows, Linux and macOS telemetry and self-protection against current BYOVD, EDR-killer and living-off-the-land techniques, then recommend what to build, harden or migrate.
Talk to a VoidStarIndia kernel engineer to turn attacker trends into a concrete driver development plan.
Sources
- ESET Research, "EDR killers explained"
- Cyber Security Agency of Singapore, advisory AD-2025-018
- The Hacker News, Qilin and Warlock ransomware (April 2026)
- CrowdStrike 2025 Global Threat Report
- ESET Research, Bootkitty analysis (November 2024)
- Microsoft Windows Experience Blog, Windows Resiliency Initiative (June 2025)
- SecurityWeek, Microsoft endpoint security platform preview
- Cybersecurity Dive (March 2026)
- Microsoft Learn, Microsoft recommended driver block rules
- Apple WWDC20, Build an Endpoint Security app
- ENISA, CRA Single Reporting Platform launch (September 2026)
- CISA, Secure by Design Pledge