Windows 11 gets a new security mode to block risky software before it runs

Windows 11

• Windows 11 adds Baseline Security Mode to block unsigned software
• Clearer prompts for app permissions and bundled software
• Admins can approve exceptions for trusted legacy or niche apps

Did our AI summary help?

Microsoft is introducing a new security feature for Windows 11 designed to stop risky software before it can embed itself deep inside the operating system. Called Windows Baseline Security Mode, the feature focuses on blocking unsigned apps, services, and drivers by default, particularly the kind that operate quietly in the background.

The goal is straightforward: make it harder for malicious or unwanted software to slip into low-level parts of Windows where it can persist across reboots and resist removal. Legitimate tools are not locked out entirely, but exceptions will now require explicit approval.

Baseline Security Mode changes what can run

The biggest shift is at the system level. Drivers and background services are powerful entry points, which is why attackers like them. Once installed, they can hook into other apps, survive restarts, and operate largely out of sight.

With Baseline Security Mode enabled, Windows relies on code signing as a gatekeeper. Signed software runs as expected. Unsigned code can be blocked before it installs or executes. If a trusted app is affected, users or IT administrators can approve an exception for that specific case.

Microsoft says developers will be able to detect when these protections are active and whether an exception exists, which should make troubleshooting less opaque than past security controls that failed silently.

Transparency and consent are the second layer

Security Mode is only half the story. Microsoft is also expanding User Transparency and Consent, which adds clearer prompts when apps try to access sensitive device features or data.

Windows will notify users when software reaches for the microphone, camera, files, or system-level permissions, and when installers attempt to add bundled software that was not explicitly requested. Crucially, these decisions are not permanent. Users can revisit and change them later.

That matters because many bad experiences on Windows are not classic malware infections. They are bundled installers, overly aggressive permissions, or tools that quietly modify settings. Clear prompts make those behaviours harder to disguise.

What it means for businesses and power users

For enterprises, the changes promise fewer surprises across managed systems, while still allowing administrators to approve legacy or niche software where needed. For individual users, the trade-off will be occasional friction, particularly around older drivers and specialised peripherals.

Microsoft describes the rollout as phased. Early stages focus on visibility, new APIs, and better insight into app behaviour. Broader enforcement through Baseline Security Mode comes later.

The practical advice is simple: keep an eye on new controls in Settings, and watch for updates from driver makers and security vendors. If something breaks, it will likely be at the edges first.