Why does kernel-mode matter so much?

A kernel-mode driver runs in ring 0, with full access to memory and hardware. A bug in kernel code is a bluescreen (BSOD), a boot loop, or, at scale, an entire fleet of endpoints simultaneously unbootable. Kernel-mode also requires a vendor-signed driver, which means the certificate authority chain, the driver-signing process, and Microsoft's kernel-driver attestation all become operational dependencies. Kernel-free application control removes the entire failure class.

Does removing the kernel driver weaken the security model?

It removes some detection depth, specifically the ability to mediate every individual syscall a process makes after it has been allowed to run. For typical MSP allowlisting goals (block unknown executables, control elevation, prevent off-the-shelf ransomware tools from running) the user-mode approach is more than sufficient. For deep ringfencing of permitted applications' subsequent behaviour, kernel-mode designs still have an advantage.

Can I run kernel-free application control alongside Defender or Huntress?

Yes. Application control and EDR are complementary layers. Lavawall® coexists with Defender, Huntress, Sophos, SentinelOne, CrowdStrike, and other EDR / AV products and surfaces their state alongside its own findings.

What happens when a vendor releases an update?

Because Lavawall® pre-approves by signed installer rather than by file hash, normal vendor updates from approved publishers continue to install without operator intervention. Hash-based allowlists, by contrast, require manual re-tagging on every Patch Tuesday, a major source of operational burden in kernel-driver-era application control.

Best application control without a kernel driver (2026)

Best application control without a kernel driver

Kernel-driver-based application control delivers deep ringfencing, but at the cost of BSOD risk, driver-signing breakage, and Remote Desktop Session Host instability. Kernel-free application control trades a small amount of detection depth for substantially better operational reliability.

Start free, no credit card What to look for

Kernel-free application control allowlists approved executables and blocks the rest without a kernel-mode driver, so it avoids the BSOD class of failure, the driver-signing dance when Microsoft renews certificate authorities, and the Remote Desktop Session Host instability inherent to kernel agents. The best tools run in user-mode or as a Microsoft-supplied built-in, pre-approve by signing certificate (not file hash) so vendor updates do not break the allowlist, enforce policy locally without a cloud callback, and feed allowlist events into compliance evidence automatically.

Application control, the discipline of allowlisting only approved executables and blocking the rest, has historically required a kernel-mode driver. Kernel-mode drivers see every process spawn and every binary load, which is exactly what you need for high-fidelity blocking. They are also exactly the wrong place for software bugs: a kernel-mode bug is a bluescreen, a boot loop, or an entire fleet of endpoints offline at once.

Several MSPs have learned this the hard way. After a high-profile kernel-driver outage, "application control without a kernel driver" went from a niche preference to a serious procurement requirement.

What to look for

No kernel driver. Look for products explicit about running entirely in user-mode or as a Microsoft-supplied built-in (AppLocker, Windows Defender Application Control). Some vendors describe themselves as "kernel-driver-free" while still installing a filter driver, so read the technical documentation carefully.
Pre-approval by signed installer. Allowlisting by file hash means every vendor update breaks your policy. Allowlisting by signing certificate (preferably with a publisher and product-name match) survives normal vendor updates without operator intervention.
No mandatory cloud callback. For clients in remote, regulated, or air-gapped environments, the application-control product must enforce policy locally without requiring a cloud round-trip.
Remote Desktop Session Host support. Kernel-mode agents have a long history of instability on RDS hosts because every session spawns processes that the kernel agent has to mediate. Kernel-free designs typically handle RDS far better.
Coexistence with EDR / AV. Application control sits alongside Defender / Huntress / Sophos / SentinelOne / CrowdStrike. The product must coexist cleanly with whatever EDR / AV the customer already has.
Audit-evidence integration. Allowlist events should flow into your CMMC / NIST 800-171 / CIS evidence automatically.
Cross-platform coverage. Look for application control on macOS and Linux as well, particularly for regulated client tiers where ringfencing applies across the whole fleet.

Options to evaluate

Five approaches to application control, with the buyers each one fits best.

Lavawall®

Kernel-free application control bundled with the rest of the platform

Application control without a kernel driver: no BSOD risk, no driver-signing dance, works on Remote Desktop Session Hosts, runs standalone on any modern Windows fleet. Pre-approves by signed installer (not file hash), so vendor updates do not break the allowlist on Patch Tuesday. Works without callback to the cloud. Bundled into the Lavawall® platform with patching, GRC, M365 / Azure / Entra and Google Workspace breach detection, helpdesk, and remote support.

Best when: MSPs that want application control without the kernel-driver failure modes, bundled with the rest of their security and compliance stack.

Microsoft Windows Defender Application Control (WDAC)

Microsoft-built kernel-free allowlisting

Built into Windows. Enforces policy at the kernel level via Code Integrity but does not require a third-party driver. Powerful but operationally complex: policy authoring is non-trivial and ecosystem tooling is thinner than commercial offerings.

Best when: Mature security teams with the engineering bandwidth to maintain WDAC policies and the discipline to test policies before broad rollout.

Microsoft AppLocker

Built-in Windows allowlisting

Built into Windows. Easier to author than WDAC; less resistant to modern bypass techniques. Useful as a starting point for organisations early on the application-control journey.

Best when: Smaller environments with simple application portfolios that just need a baseline allowlist.

ThreatLocker

Kernel-driver application control with ringfencing

Mature kernel-driver-based application control with deep ringfencing (network, registry, file, child-process). Highest detection depth. Trade-offs in BSOD risk, driver-signing maintenance, and RDS host stability are inherent to kernel-mode designs.

Best when: MSPs that have committed to a kernel-level zero-trust ringfencing model and have the engineering bandwidth to maintain it.

Airlock Digital

Application allowlisting

Mature application control product common in Australian and ASD-aligned environments. Supports Essential Eight allowlisting maturity requirements.

Best when: Australian government contractors and Essential Eight Maturity Level 2+ environments.

How Lavawall® fits

Lavawall® was designed deliberately to deliver application control without a kernel driver. The pricing page describes the design goal directly: "Replace ThreatLocker and AutoElevate with a faster, lighter approach, built for MSPs who got burned by kernel-level agents."

The technical approach: pre-approve installers by signing certificate, enforce policy locally without requiring a cloud round-trip, run cleanly on Remote Desktop Session Hosts, and avoid the driver-signing dance entirely. The trade-off is a slightly shallower ringfencing model than the deepest kernel-driver products. Lavawall® controls execution and elevation rather than every network / registry / file syscall. But for the vast majority of MSP clients that trade-off is the right one.

Because Lavawall® is also the patching, configuration-assessment, GRC, and breach-detection platform, application-control events flow directly into compliance evidence (CMMC 2.0, NIST 800-171, CIS Controls v8 IG2/IG3, Australian Essential Eight) without a separate integration tax.

Frequently asked

Why does kernel-mode matter so much?: A kernel-mode driver runs in ring 0, with full access to memory and hardware. A bug in kernel code is a bluescreen (BSOD), a boot loop, or, at scale, an entire fleet of endpoints simultaneously unbootable. Kernel-mode also requires a vendor-signed driver, which means the certificate authority chain, the driver-signing process, and Microsoft's kernel-driver attestation all become operational dependencies. Kernel-free application control removes the entire failure class.
Does removing the kernel driver weaken the security model?: It removes some detection depth, specifically the ability to mediate every individual syscall a process makes after it has been allowed to run. For typical MSP allowlisting goals (block unknown executables, control elevation, prevent off-the-shelf ransomware tools from running) the user-mode approach is more than sufficient. For deep ringfencing of permitted applications' subsequent behaviour, kernel-mode designs still have an advantage.
Can I run kernel-free application control alongside Defender or Huntress?: Yes. Application control and EDR are complementary layers. Lavawall® coexists with Defender, Huntress, Sophos, SentinelOne, CrowdStrike, and other EDR / AV products and surfaces their state alongside its own findings.
What happens when a vendor releases an update?: Because Lavawall® pre-approves by signed installer rather than by file hash, normal vendor updates from approved publishers continue to install without operator intervention. Hash-based allowlists, by contrast, require manual re-tagging on every Patch Tuesday, a major source of operational burden in kernel-driver-era application control.

Start free →