Glossary
Exploit protection
Built-in Windows memory and process mitigations, such as DEP, ASLR and CFG, applied system-wide or per application and managed with policy.
Exploit protection is the set of exploit mitigations built into Windows 10 and later, and the successor to the Enhanced Mitigation Experience Toolkit (EMET). It includes system-level settings such as Data Execution Prevention (DEP), mandatory and bottom-up ASLR, Control Flow Guard (CFG) and SEHOP, plus per-program mitigations such as arbitrary code guard, blocking remote or low-integrity images, code integrity guard, export and import address filtering, and disabling child process creation. Each mitigation can be turned on, off, or run in audit mode, and the whole configuration can be exported to XML and deployed with Group Policy, Intune or PowerShell (Set-ProcessMitigation).
Mitigations raise the cost of turning a memory corruption bug into code execution, which is valuable for internet-facing and document-handling applications that cannot always be patched immediately. Some per-app mitigations break legacy software, so test in audit mode first and review events in the Security-Mitigations log. Keep the system defaults on, then add targeted mitigations to high-risk applications.