Anti-tamper protection is a self-defense mechanism built into security software to stop higher-privileged processes from changing the product’s own files, registry keys, service settings, or local policy cache. On Windows endpoints, this helps an agent preserve its enforcement rules even when an attacker has some local access.
This matters because many attacks begin after a foothold is gained. If an attacker can disable the agent, alter its policy, or replace its configuration, they may be able to weaken logging, bypass restrictions, or escalate privileges. Defenders rely on anti-tamper controls to make those actions harder and more visible. In practice, these controls are tested through service protections, access control lists, code signing, protected configuration stores, and checks that block unauthorized writes. When anti-tamper is bypassed, the security tool itself becomes part of the attack surface.