Self-Defense is an anti-tamper feature in security software that prevents unauthorized changes to protected files, services, drivers, registry settings, and control interfaces. Its purpose is to stop local users, malware, or even other administrative tools from disabling or rewriting the product’s defenses.
This matters because endpoint protection software sits close to the operating system and often runs with elevated privileges. If an attacker can bypass Self-Defense, they may be able to turn off scanning, weaken policy enforcement, hide malicious processes, or create a path for privilege escalation. In practice, attackers try to tamper with protected components, while defenders look for blocked writes, denied service control actions, and unexpected changes to self-protection settings. Self-Defense is one of the main barriers that keeps a security tool from becoming an easy target inside the system it is meant to protect.