Microsoft will begin automatically enabling memory integrity protection, the virtualization-based security layer that restricts Windows to running only trusted, signed kernel-mode code, on eligible devices starting with October 2026 quality updates. The feature blocks a class of attack that has proven durable for years: kernel-level exploits and rootkits that hijack core OS functions to run undetected beneath standard security tooling. Peter Waxman, Group Program Manager at Microsoft, said “existing administrator and user decisions and policies remain in effect,” meaning organizations that have deliberately disabled the feature for compatibility reasons will not have it silently re-enabled.
The rollout only targets devices that pass Microsoft’s readiness checks for hardware capability, driver compatibility and performance impact, and it will also auto-enable virtualization-based security itself if not already running, since memory integrity depends on it. Microsoft notes the change is not purely defensive bookkeeping: memory integrity is also a prerequisite for hotpatching, the reboot-free update model Microsoft has been expanding, so devices that stay unprotected will also be locked out of that faster patching path.
The original insight is the dependency Microsoft has built between hardening and patch velocity. By tying a modern update mechanism to a kernel-protection feature, Microsoft has created a real incentive, not just a security best-practice recommendation, for organizations to resolve whatever legacy driver incompatibilities have kept memory integrity off their fleets. Security teams still carrying kernel-mode drivers that block VBS should treat this as a forcing function: the cost of staying on legacy drivers is no longer just foregone kernel protection, it is foregone patch speed too.
Related: how patch deadlines increasingly diverge by exploitation status rather than severity score alone and why patch speed alone was never going to solve the detection gap.
Source: Microsoft Windows IT Pro Blog
