Self-protection is a set of anti-tamper controls built into endpoint security software such as EDR, antivirus, and host agents. These controls are designed to make the product harder to stop, disable, uninstall, or modify. Common techniques include protected processes, service hardening, signed driver checks, access-control restrictions on configuration files, and blocking unauthorized changes to registry keys or agent settings.
In cyber security, self-protection matters because attackers often target defenses first. If malware can kill the security service, unload a driver, or remove the agent, it can operate with less chance of detection. Strong self-protection preserves telemetry, alerting, and containment during an intrusion. Defenders rely on it to keep endpoint controls active, especially on Windows systems where attackers may use administrative tools or privilege escalation to tamper with protection. When self-protection is weakened, the security product may still be installed, but it no longer reliably protects the host.