Every endpoint security vendor claims AI-driven detection. Far fewer can prove their sensor sees what attackers do at the moment they do it, cannot be switched off by a signed but vulnerable driver, and can stop malicious activity before damage is done. That gap is where kernel-level security creates durable competitive advantage, and it is why product leaders at EDR, XDR and DLP companies should treat kernel engineering as a strategic capability rather than a plumbing detail.
This article explains, in business terms, what kernel-level security delivers, what the 2024 CrowdStrike outage taught the industry, and how to weigh the cost of building that capability against the cost of not having it.
What kernel-level security actually means
The operating system kernel sits between hardware and every application. It schedules processes, manages memory, loads drivers and mediates file, registry and network access. As ESET's chief security evangelist Tony Anscombe told Cybersecurity Dive in March 2026, a security vendor wants to see everything happening on the device.
Where Windows security products hook in
On Windows, security products typically reach that layer through a small set of supported mechanisms.
File system minifilters
Minifilters observe and can block file creation, writes, renames and deletes. This is the foundation of ransomware protection and data loss prevention.
Kernel callbacks
Callbacks for process creation, thread creation, image (DLL and driver) loading and registry operations let a sensor see and veto activity as it happens.
Windows Filtering Platform (WFP) callouts
WFP callouts inspect and control network connections at the host, before traffic ever leaves the endpoint.
Event Tracing for Windows (ETW)
ETW, including the Threat Intelligence provider, exposes security-relevant events such as suspicious memory operations to protected security processes.
The Linux and macOS equivalents
On Linux, the modern equivalents are eBPF programs, Linux Security Module (LSM) hooks and kprobes. On macOS, Apple deprecated third-party kernel extensions and now routes security products through the user-space Endpoint Security framework, which still delivers kernel-originated events and lets products authorize or deny operations.
Three capabilities that only the kernel delivers well
Deeper, earlier detection
Adversaries increasingly avoid classic malware. CrowdStrike's 2025 Global Threat Report found that 79% of its detections in 2024 were malware-free, as attackers relied on stolen credentials, native tools and hands-on-keyboard activity. Living-off-the-land and fileless techniques leave little on disk, so detection depends on behavioral telemetry: which process spawned which, what memory was written where, which driver loaded and which registry key changed. Kernel callbacks and minifilters capture that sequence synchronously, with context that user-mode hooks can miss or that an attacker can tamper with.
A smaller, harder attack surface
Attackers now target the security product itself. ESET researchers report tracking almost 90 EDR killers used in the wild, 54 of them based on bring your own vulnerable driver (BYOVD) techniques abusing 35 different vulnerable drivers. A product that runs only in user mode is exposed to process termination and hook removal by anything with sufficient privilege. Kernel components let vendors protect their own processes, files and registry keys, monitor driver loads for known-vulnerable signatures, and complement Microsoft's vulnerable driver blocklist, which Microsoft itself says is not guaranteed to block every vulnerable driver. We examine BYOVD and EDR killers in depth in a companion post.
Real-time intervention
Speed decides outcomes. CrowdStrike measured an average eCrime breakout time of 48 minutes in 2024, with the fastest at 51 seconds. A sensor that only logs and forwards events to the cloud will often lose that race. Kernel enforcement points can block a file write, deny a process launch or drop a network flow inline, buying time for analysts and automated response. We explore this shift in depth in our post on real-time remediation.
The CrowdStrike lesson: power demands rigor
No honest discussion of kernel security can skip 19 July 2024. A faulty CrowdStrike content update triggered an out-of-bounds memory read in the kernel-mode Falcon sensor and crashed an estimated 8.5 million Windows devices. Insurer Parametrix estimated $5.4 billion in direct losses for US Fortune 500 companies, excluding Microsoft, with only 10% to 20% likely to be insured.
CrowdStrike's own root cause analysis is instructive for every product team. The template type defined 21 input fields while the sensor supplied only 20. A logic error in the content validator let the bad file through. The content interpreter lacked a runtime bounds check. The fixes CrowdStrike announced were engineering basics: compile-time validation, runtime bounds checks, broader test coverage and staged deployment with customer control over rapid response content.
Microsoft responded with the Windows Resiliency Initiative, announced in November 2024. Under its MVI 3.0 program, Microsoft requires security product updates to be gradual, ring-based and monitored. In June 2025 it announced a private preview of a Windows endpoint security platform that lets anti-virus and EDR products run in user mode. As of March 2026, Cybersecurity Dive reported that it could be years before customers see the results, and that Microsoft had not published API timelines.
The takeaway for executives is not "leave the kernel." It is that kernel access is now a privilege earned through engineering discipline. Vendors who can demonstrate defensive coding, fuzzing, crash-resilient design, staged rollouts and rapid rollback will win procurement conversations that others lose.
The business case: cost, benefit and differentiation
Four commercial outcomes
For a CTO or CEO, kernel capability translates into four commercial outcomes:
- Detection efficacy you can prove. Independent evaluations and proofs of concept reward sensors that see more and block earlier. Kernel visibility is a primary input to those results.
- Resilience against tampering. When ransomware crews disable your agent, the customer experiences that as your product failing. Anti-tamper engineering protects revenue and reputation.
- Faster, more autonomous response. Inline prevention reduces analyst workload and supports managed detection offerings with better margins.
- Regulatory alignment. US public companies must disclose material incidents on Form 8-K within four business days of determining materiality, and the EU's Cyber Resilience Act now requires manufacturers to report actively exploited vulnerabilities and severe incidents within 24 hours. Buyers under that pressure favor tools that both prevent incidents and do not create new ones.
What the market data shows
The market rewards this. MarketsandMarkets estimates the global endpoint security market at $27.46 billion in 2025, reaching $38.28 billion by 2030, with North America the largest region. Within it, EDR is growing far faster: SNS Insider values the US EDR market alone at about $2.10 billion in 2025, projected to reach $12.20 billion by 2033 at a 22.3% CAGR. Analyst estimates vary widely, but every major firm projects double-digit EDR growth. In a crowded market, differentiation increasingly comes from the sensor rather than the dashboard.
The cost side is real
Kernel defects can crash customer fleets, so investment in test infrastructure, hardware compatibility matrices, Microsoft signing and attestation workflows, and HVCI (memory integrity) compatibility is non-negotiable. HVCI is on by default on most new Windows 11 devices, so a driver that is not HVCI-compatible will simply not load on a growing share of endpoints. The cost of getting this wrong is measured in outages and lost deals, not just engineering hours.
Build, buy or partner
Most security product companies face three options:
| Option | Strengths | Risks | Best fit |
|---|---|---|---|
| Build in-house | Full IP control, deep product integration | Scarce, expensive talent; long ramp-up; key-person risk | Large vendors with sustained kernel roadmaps |
| Buy (OEM sensor or SDK) | Fast time to market | Limited differentiation; dependency on another vendor's roadmap | Platforms competing on analytics, not sensors |
| Partner with a specialist team | Senior kernel expertise on demand, faster delivery, retained IP | Requires strong governance and partner vetting | Growth-stage vendors and enterprises adding kernel features |
Many teams use a hybrid: a small in-house core that owns architecture and IP, extended by a specialist partner for driver development, porting, testing and signing. Our post on hiring kernel engineers covers how to evaluate such partners.
FAQ
What is kernel-level security?
Kernel-level security refers to protection mechanisms that operate at or directly interface with the operating system kernel, such as Windows minifilters and callbacks, Linux eBPF and LSM hooks, or macOS Endpoint Security events. It gives security products visibility and control over processes, files, registry and network activity as they occur.
Is kernel-mode security still necessary after the CrowdStrike outage?
Yes, for most advanced EDR and DLP use cases today. Microsoft is building a user-mode endpoint security platform, but as of 2026 it remains in preview with no published timeline for general availability. The outage raised the bar for testing and staged deployment rather than eliminating the need for kernel visibility.
How does a kernel driver reduce the attack surface?
Kernel components can protect a security product's own processes and files from termination or tampering, monitor and block loading of known-vulnerable drivers used in BYOVD attacks, and enforce policy below the level where most attacker tools operate.
Should we build kernel capability in-house or outsource it?
It depends on roadmap depth and talent availability. Many vendors keep architecture and IP ownership in-house while partnering with specialist kernel teams for implementation, testing and signing workflows.
Talk to a kernel engineer
If you are deciding how much of your detection and prevention roadmap should live in the kernel, start with evidence. VoidStarIndia's kernel engineers can run a kernel architecture review of your current sensor across Windows, Linux and macOS: telemetry coverage, anti-tamper posture, HVCI compatibility, crash resilience and deployment safety. You will leave with a prioritized roadmap, not a sales pitch.
Book a kernel architecture consultation with VoidStarIndia to see where kernel-level security can become your product's competitive edge.
Sources
- CrowdStrike 2025 Global Threat Report
- CrowdStrike Channel File 291 Root Cause Analysis
- ESET Research, "EDR killers explained"
- Microsoft Learn, Microsoft recommended driver block rules
- Microsoft Windows Experience Blog, Windows Resiliency Initiative (June 2025)
- Cybersecurity Dive, Microsoft Windows Resiliency Initiative and the kernel (March 2026)
- Parametrix estimates via InformationWeek and Axios
- MarketsandMarkets, Endpoint Security Market
- SNS Insider, Endpoint Detection and Response Market
- SEC press release 2023-139 and SEC small business compliance guide
- European Commission, CRA reporting obligations