The Windows Endpoint Security Platform From the Outside: What SYSTEM Can Do Without PPL, and Where It Holds

· Adrian's Security Research · Oct. 25, 2026, 3:49 p.m.
Summary
The blog post discusses the Windows Endpoint Security Platform (WESP), a new feature in Windows 11 that modifies the kernel hooking process for third-party endpoint security products, allowing them to compile detection rules into the kernel. This approach enhances security and efficiency by changing the traditional minifilter model. The article explores the potential benefits and limitations of WESP for developers and security professionals.
AUTHOR