Microsoft will push memory integrity on by default for eligible Windows 11 machines through its October 2026 Patch Tuesday update, scheduled for Oct. 13. The rollout also enables Virtualization-based Security—VBS, which uses hardware virtualization to isolate sensitive operating system processes from the rest of the system—on devices where it is not already active.
Peter Waxman, group program manager at Microsoft, said in an official M365 Admin post: "Windows quality updates will begin enabling memory integrity protection on eligible devices. If not already enabled, these updates will also enable Virtualization-based Security, helping make additional security capabilities available and reflecting our commitment to making Windows secure by design and secure by default."
Memory integrity—also called Hypervisor-Protected Code Integrity, or HVCI—restricts what code can execute in kernel mode, the deepest layer of the operating system where drivers and security software run. By allowing only trusted, verified kernel-mode drivers to load, it closes a common attack path: malicious drivers that inject code into the Windows kernel to bypass security controls or steal credentials.
The security gain comes with a performance cost that matters most to PC gamers. Microsoft has acknowledged that memory integrity can reduce frame rates in certain games, particularly on older processors. Newer CPUs carry less overhead because their virtualization hardware handles the workload more efficiently. On aging silicon, the frame-rate drop in select titles is visible.
Microsoft's own guidance reveals the trade-off: keep memory integrity on during normal operation, disable it before a gaming session on performance-sensitive hardware, and re-enable it when done. That is not a seamless experience for everyday users, and it effectively puts the performance-versus-security choice in the hands of consumers rather than resolving it at the platform level.
The October update will not override a user's prior choice. If memory integrity was manually disabled on a device before the update arrives, Microsoft will not force it back on. That carve-out gives performance-focused users—primarily gamers on older rigs—a path to stay opted out without fighting the update mechanism each month.
Users can check their current status by typing "Core Isolation" into Windows search and toggling memory integrity from within the Windows Security app. The setting also appears in Group Policy under Computer Configuration, Administrative Templates, System, Device Guard, where IT administrators can enforce it across a fleet—with or without a UEFI lock that prevents remote or policy-based reversal.
For enterprise IT, the October rollout narrows a gap that has long created inconsistency across managed Windows fleets. Devices enrolled in Microsoft's recommended security baseline already had memory integrity and VBS active; consumer and mixed-use machines often did not. Uniform enforcement reduces the attack surface that adversaries can exploit by targeting the weakest machine in a network.
Microsoft has faced sustained scrutiny over Windows kernel security since a faulty CrowdStrike driver update took down roughly 8.5 million Windows machines in July 2024. That incident exposed how much damage a single bad kernel-mode driver can do at scale. Memory integrity, by requiring driver code to pass integrity checks before loading, is a direct architectural response to that class of vulnerability—though it does not eliminate all driver-related risk.
The Windows 11 security push has accelerated under Microsoft's Secure Future Initiative, which the company launched after a series of high-profile breaches. VBS and memory integrity sit at the center of that effort on the client side, mirroring the hardware-root-of-trust requirements Microsoft already enforces through Windows 11's TPM 2.0 mandate at installation.
