Kernel-mode security agents

Endpoint protection software that loads code into an operating system kernel so it can observe process creation, file access and network activity from below user space. A fault in such code usually stops the whole machine rather than one process.