Here's a metaphor for the future of Windows security: Microsoft and the industry are two acrobats on a tightrope with no net. The trick is to meet in the middle, shake hands and maneuver around each other.

PatchGuard, a feature that causes 64-bit Windows versions of Vista to blue-screen if the kernel code is modified unexpectedly, is the first of possibly many flashpoints as Microsoft adds new security features to its product line. Also called kernel patch protection, PatchGuard may stop some attack programs from infecting a system by embedding themselves in the kernel. However, PatchGuard also gets in the way of security vendors that "hook the kernel" to ensure their routines are called at the right times to monitor the system for unauthorized activity.

At first glance, PatchGuard seems like a desirable feature. It doesn't cost anything, and none of us wants malware messing with our kernels. Nor does hooking the kernel do much for system stability. Unfortunately, vulnerability researchers have demonstrated PatchGuard isn't a silver bullet and Vista isn't bulletproof. Much as we don't want to pay security taxes to independent software vendors (ISV), we still need them.

Microsoft must protect the operating system, but it should not deny customers a choice of security products. And given that Microsoft is competing with ISVs by selling its own Live OneCare antivirus package, it would be difficult for the company to be completely even-handed with PatchGuard, Windows Security Center and all the features that integrate security with the operating system.

Fortunately, European Union regulators assumed an oversight role, demanding even-handedness to protect customer choice. Bowing to the inevitable, Microsoft has initiated talks on PatchGuard with ISVs and now says 95% of ISV requirements boil down to three issues: monitoring/controlling process and thread launching; protecting the ISVs' programs from malware; and monitoring/controlling cross-process memory manipulation.

Microsoft says it is working to complete a new design in 90 days and will ship new application program interfaces (API) for security ISVs with Vista Service Pack 1. With these APIs, most host intrusion-prevention systems and other types of products should be able to protect systems without having to hook the kernel.