Anti-tamper controls are protective measures built into security software to stop unauthorized changes, removal, disabling, or hooking of the product itself. They help ensure that an endpoint agent, policy engine, or EDR component keeps running and keeps enforcing its rules even when an attacker has local access.
In cyber security, anti-tamper matters because security tools are high-value targets. If an attacker can bypass these defenses, they may be able to stop alerts, weaken least-privilege enforcement, or hide other malicious activity. Attackers often try to tamper with services, drivers, registry settings, or update mechanisms; defenders respond with code signing checks, protected processes, self-defense routines, and integrity monitoring. A bypass does not just affect one feature—it can undermine trust in the entire control layer.