Blocking at the right level
The biggest difference between version 4.0 and earlier clients is where the protection sits. It now lives in the operating system kernel rather than as a program on top of it.
User mode and kernel mode
Windows divides running code into two levels. Ordinary programs run in user mode, with limited access. The operating system's own components and drivers run in kernel mode, closer to the hardware and the network stack.
Protection in user mode learns about traffic after the system has already handled it. It can react, but rarely get there first. A driver in kernel mode sees the connection while it is being set up and can abort it there.
What that means for the protection
- The connection is stopped before it is established, not after
- Protection covers all network traffic on the device, whatever the program
- A program cannot bypass the protection by talking to the network directly
- Blocking works for traffic that does not go through the browser
What Microsoft's signature means
Windows does not allow arbitrary code in kernel mode. A driver must be signed, and to be signed it must be submitted to Microsoft and pass their review and certification.
For you as a customer that means three concrete things: the driver is loaded by Windows without you having to turn off security features, it works with Secure Boot enabled, and it has been reviewed by someone other than us.
The road to a signed driver
Microsoft does not sign kernel code on trust. Before a driver is allowed to run in kernel mode it has to pass hundreds of tests against every supported variant and configuration of Windows 10 and Windows 11 — different editions, different hardware, different combinations of drivers and security settings.
Only once the full test suite has been completed and the results submitted does Microsoft review the code. If it passes, it is signed, and only then will Windows load it into the kernel.
It is a threshold that takes time to clear, and deliberately so. Code running in kernel mode can bring down the whole operating system if it is poorly written.
Compact code, a small footprint
The driver is written to be small. The block lists can hold millions of IP addresses, networks and domains without memory use rising above a few megabytes — the data structures are chosen to look up quickly and take little space, not to be easy to write.
It shows in operation. On a gigabit network, traffic passes through with no measurable performance loss. Lookups happen per connection rather than per packet, and the answer is already in memory.
The reason this matters is simple: protection that slows the machine down gets switched off. And then it protects nothing.
Operating system support
The client is built for Windows 10 in both 32-bit and 64-bit editions, and for Windows 11. The same driver and the same protection whichever one you run.
What the driver does and does not do
The driver does
- Inspect network connections as they are set up
- Compare address and domain against fetched block lists
- Abort the connection when there is a match
- Report the event onward to the log
The driver does not
- Read files on disk
- Open the contents of your traffic
- Forward your traffic to us
- Replace antivirus or a firewall
Read more about the client
The product page covers what Windows client 4.0 does in practice and how to get started.