According to Ars Technica, Microsoft employs something called hypervisor-protected code integrity (HVCI) to guard against rogue drivers, and the firm claims that it is activated by default on some Windows devices. However, according to Ars Technica and Will Dormann, a senior vulnerability researcher at cybersecurity firm Analygence, this functionality does not offer effective protection against rogue drivers.
