--- title: Importance of self-defense in cybersecurity software proven yet again description: Cybersecurity software needs to include effective self-defense capabilities against modern threats, which is what Acronis Cyber Protect has donea canonical_url: https://www.acronis.com/en/blog/posts/importance-self-defense-cybersecurity-software-proven-yet-again/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # Importance of self-defense in cybersecurity software proven yet again At Acronis, we’ve taken the ability for security software to defend itself seriously right from the start. In 2017 and 2018, our solutions were tested for self-defense capabilities by independent labs, and their research revealed Acronis Cyber Protection Solutions delivered excellent results. Of course, we continue to improve our technologies with every release and constantly research what we can improve in all aspects of cyber protection. Given our mission of delivering cyber protection solutions that ensure the safety, accessibility, privacy, authenticity, and security (SAPAS) of data, in preparing for our upcoming Acronis Cyber Platform launch, we improved the self-defense capabilities even further. [Try Now](https://www.acronis.com/en/products/cloud/trial/) [![Image 2: MSP Threats Security Team](https://staticfiles.acronis.com/images/content/1578b8dff96325855c4525d865e7fc63.png)](https://www.acronis.com/en/blog/authors/acronis-security-team/ "MSP Threats Security Team") [MSP Threats Security Team](https://www.acronis.com/en/blog/authors/acronis-security-team/) 3 min read Last updated 28 April 2020 At Acronis, we’ve taken the ability for security software to defend itself seriously right from the start. In 2017 and 2018, our solutions were tested for self-defense capabilities by independent labs, and their research revealed Acronis Cyber Protection Solutions delivered [excellent results](https://www.acronis.com/en-us/resource-center/resource/364/). Of course, we continue to improve our technologies with every release and constantly research what we can improve in all aspects of cyber protection. Given our mission of delivering cyber protection solutions that ensure the safety, accessibility, privacy, authenticity, and security [(SAPAS)](https://www.acronis.com/en-US/cyber-protection/) of data, in preparing for our upcoming Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) launch, we improved the self-defense capabilities even further. In 2019, Acronis became a member of the Microsoft Virus Initiative, passed all of the required tests, and became officially recognized as a security solution for Windows. That allows the upcoming Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) to use the Early Launch Antimalware (ELAM) driver and Protected Process Light (PPL) feature of the Windows operating systems. ![Image 3: ELAM drivers load before potential threats](https://staticfiles.acronis.com/images/content/33bc4f2710be838cab4ac1bce419b0fd.png) ELAM drivers load before potential threats _As shown by Broderick Ian Aquilino in his “Relevance of Security Features Introduced in Modern Windows OS” (2019), “ELAM ensures that no malicious third-party drivers that may potentially be a rootkit are initialized before an antimalware software has completely loaded.”_ The ELAM feature provides a Microsoft-supported mechanism that allows antimalware (AM) software to start before other third-party components. AM drivers are initialized first and allowed to control the initialization of subsequent boot drivers, which enables them to potentially block unknown boot drivers from malicious rootkits and bootkits. When a system starts, ELAM scans all third-party apps and drivers and sends the system kernel a report that includes all of the device and software drivers. Those are then classified as one of the following four groups: good, bad, bad but boot critical, and unknown. All drivers are loaded in Windows by default, except for those marked as bad drivers. Microsoft has another connected technology, Protected Process Light (PPL), which ensures that the operating system only loads trusted services and processes. To be trusted, they should have an internal or external signature that meets the Windows requirements. PPL loosened some of the restrictions on which DLLs are considered valid for loading into a protected process and introduced different signing requirements for the main executable. Now, the only type of protected process that a third-party can create in Windows operating systems is an antimalware PPL (AM-PPL). Acronis created its own ELAM driver for its cyber protection products and uses this driver for the AM-PPL protection of the Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) service. Acronis’ ELAM driver allows the listing of specific certificate hashes that are used to allow or deny a DDL from loading as a PPL protected process. ![Image 4: ELAM drivers help allow or deny DDL](https://staticfiles.acronis.com/images/content/3adbdd56b8bbc7c4cd4bf93240ab9b99.png) ELAM drivers help allow or deny DDL _Acronis’ ELAM driver allows the listing of specific certificate hashes that are used to allow or deny a DDL from loading as a PPL protected process_ ### Why is all this important? Not so long ago, SafeBreach Labs discovered a new vulnerability in Symantec’s Endpoint Protection software. This vulnerability allows hackers to bypass Symantec’s self-defense mechanism and achieve defense evasion, persistence, and privilege escalation by loading an arbitrary, unsigned DLL into a process that is signed by Symantec and runs as NT AUTHORITY\SYSTEM. You need to have admin rights to exploit it but, as we know, getting admin privileges is not that hard. Exploiting such a vulnerability is very useful for cybercriminals because they can do whatever they want in the system without being detected ... and this is not what you expect from a security solution. In the case of Acronis Cyber Protect, the service is based on an ELAM driver that is protected against the kind of attack described above and service does not even invoke an exploitable code path (IWbemServices as described in SafeBreach’s vulnerability disclosure). More than that, Acronis Cyber Protect should not be vulnerable to this type of attack since the threat is based on loading the arbitrary unsigned (or even signed with some “not approved by vendor” certificate) DLL in the security solution's main service. ### Final thought There’s one trend that’s been constant in cybersecurity: cybercriminals are always looking for ways around the defenses that users put in their way. As hackers look to disarm antimalware software directly, the importance of strong, reliable self-defense mechanisms becomes critical for any solution built for the current and future threat landscapes. [Cybersecurity](https://www.acronis.com/en/blog/tags/cybersecurity/) [Cyber protection](https://www.acronis.com/en/blog/tags/cyber-protection/) ## Written by ![Image 5: MSP Threats Security Team](https://staticfiles.acronis.com/images/content/1578b8dff96325855c4525d865e7fc63.png) MSP Threats Security Team [Previous post](https://www.acronis.com/en/blog/posts/storagecraft-msp-alternative/) [StorageCraft MSP Solutions vs Acronis Cyber Cloud](https://www.acronis.com/en/blog/posts/storagecraft-msp-alternative/) [Next post](https://www.acronis.com/en/blog/posts/cyberattacks-target-remote-work-tools/) [Cyberattacks Target Remote Work Tools](https://www.acronis.com/en/blog/posts/cyberattacks-target-remote-work-tools/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 6: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 7: Introducing New Acronis CEO: Prakash Panjwani](https://staticfiles.acronis.com/images/blog-card/30cb571f6f1aaa131733e5727a4a250c.png) [Introducing New Acronis CEO: Prakash Panjwani](https://www.acronis.com/en/blog/posts/introducing-new-acronis-ceo-prakash-panjwani/) We are pleased to announce the appointment of our new Chief Executive Officer, Prakash Panjwani. A veteran cybersecurity CEO, Panjwani previously served as CEO of WatchGuard Technologies and SafeNet. **October 15, 2026**2 min read ![Image 8: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read