Windows Protected Process Light (PPL) is a Windows protection model that makes selected processes harder to inspect, inject into, or tamper with. It is used for sensitive services such as credential-related components, antivirus engines, and other security-critical code. PPL raises the bar by requiring stronger trust to open, modify, or load code into a protected process.
PPL matters because attackers often try to steal secrets or disable defenses by targeting high-value processes. If they can bypass PPL, they may be able to run code in a protected context, access memory, or interfere with endpoint security tools. Defenders use PPL alongside code-signing, access controls, and auditing, but they still need to watch for abuse of trusted binaries, privileged integrations, and unsigned code attempts that can become part of an attack chain.