Microsoft Is Turning On Kernel-Level Security by Default in October. The Performance Trade-Off Is the Real Story.

Here's the version of this story that sounds like good news: Microsoft is about to turn on a kernel-level security feature for millions of Windows 11 PCs, by default, with little or no configuration required. And it is good news — for most people. The part that doesn't make the headline is the trade-off hiding underneath it.

Starting in October 2026, Microsoft will expand memory integrity protection across eligible devices. The feature, which requires Virtualization-based Security (VBS), only allows trusted kernel-mode code and drivers to run on a Windows 11 PC. It's already on by default for Secured-core PCs and after a clean install, but some PC makers have been shipping machines with it disabled, and IT admins have been turning it off too. The October rollout is Microsoft's attempt to close that gap — to make strong kernel-level protection the default rather than the exception.

The catch is performance. Memory integrity works best on Intel Kaby Lake and newer processors with Mode-Based Execution Control, and AMD Zen 2 and newer with Guest Mode Execute Trap capabilities. On older CPUs, Windows falls back to an emulation called Restricted User Mode — and that emulation has a real cost. Microsoft itself acknowledges the feature "can actually impact performance on PCs with older CPUs," and that "some applications and hardware device drivers may be incompatible with memory integrity."

That's the strategic tension in a single paragraph. The same feature that blocks sophisticated kernel attacks can also slow down the machines that need it most, and can break the drivers that keep older hardware alive. Microsoft says Windows will automatically evaluate readiness before enabling the feature — checking hardware capabilities, compatibility, and performance — and it won't force it back on for anyone who already disabled it. That's a careful rollout, and it's the right instinct. But it also means the protection is only as good as the readiness check that decides who gets it.

The deeper story here is that Microsoft is quietly shifting the security baseline. For years, kernel-level protection like memory integrity was something you had to seek out — a checkbox in Windows Security, a policy an admin had to push. Now it's becoming the default state of the operating system. That's a meaningful change in how Windows thinks about security: not as a feature you opt into, but as a floor you have to opt out of.

The trade-off is real, and it's the kind of thing that doesn't show up in a security marketing slide. Rolling out kernel-level protection across a fleet means knowing which machines can handle it, which drivers will break, and which users will notice the slowdown. That's the same kind of production-grade reality that hardware and software teams wrestle with every day — the gap between what a feature does in a demo and what it does to a real deployment. At DMC, we work with companies navigating exactly these constraints, from rollout planning to compatibility testing when a security baseline shifts under your feet. Need help stress-testing your Windows deployment? Let's talk.