What Is Virtualization-Based Security and Its Speed Cost

What VBS actually is

VBS uses the CPU's hypervisor to carve out a region of memory the operating system itself cannot touch — a virtual secure mode. Into that vault go the services that matter most: memory integrity (HVCI), which lets only Microsoft-approved code run in kernel mode, and, on the editions where it ships, Credential Guard, which isolates the hashes and tickets Windows uses to prove who you are, out of reach of the classic dump-the-LSASS attack. New Windows 11 installs come with it on when the hardware qualifies: UEFI, Secure Boot, TPM 2.0 and CPU virtualization with second-level address translation. Your own state shows in msinfo32 — the Virtualization-based security lines say whether it is running and which services are active.

The speed cost, honestly

On CPUs Windows 11 officially supports, the overhead is single-digit percent at worst, concentrated in CPU-bound games and anything that itself runs virtual machines. The hypervisor also reserves a slice of RAM on top of your normal footprint. Reports of dramatic losses almost always unravel into outdated drivers or tools with kernel components that predate the feature.

• CPU: single-digit percent worst case on supported hardware, mostly in CPU-bound games
• RAM: a reserved slice for the hypervisor, on top of your normal footprint
• Virtual machines and anything that virtualizes: the corner where VBS hurts the most
• Old kernel drivers: unsigned or expired-signature drivers are refused at load — by design, not by accident
• Check yourself: msinfo32 → Virtualization-based security — state and services running
• Ground truth: a before/after benchmark on your own machine, not a stranger's chart

The security you are trading for it

The attacks VBS blunts are not theoretical: loading a stolen-signature driver into the kernel is a documented opening move of ransomware operations, and Credential Guard breaks the standard playbook that turns one stolen laptop into a whole domain's credentials. It is a security boundary, not telemetry — nothing here phones home. Turning memory integrity off is defensible when you have measured a repeatable regression on your own machine after updating every driver involved; doing it preemptively for frames you cannot measure trades protection for a rumor. The toggle lives in Windows Security → Device security → Core isolation, and it comes back on as easily as it goes off.

Questions and Answers

Read next