Glossary
Memory integrity (HVCI)
Hypervisor-protected code integrity: a VBS feature that validates kernel-mode code in an isolated environment so unsigned drivers cannot run.
Memory integrity, also called hypervisor-protected code integrity (HVCI), moves kernel-mode code integrity checks into the virtualization-based security (VBS) environment. The hypervisor ensures kernel memory pages are only made executable after the code has passed signature checks in the isolated environment, and that executable pages are never writable. Malware running in the kernel therefore cannot inject or modify code in memory, and drivers that are unsigned or incompatible fail to load. It is enabled by default on many new Windows 11 devices and can be turned on through Group Policy, Intune or the Windows Security app under Core isolation.
HVCI raises the bar for kernel rootkits and for attacks that use a vulnerable driver to disable security tools. Before enabling it widely, check drivers for compatibility, because an incompatible driver will be blocked and can cause devices to fail. Confirm it is running with msinfo32 or Win32_DeviceGuard, and pair it with the vulnerable driver blocklist, which is on by default when HVCI is enabled.
See Virtualization-based security, HVCI and Kernel DMA protection.