Microsoft’s Smart App Control blocks malware and has ‘lighter impact on your PC’s performance’

With Windows 11 22H2, Microsoft introduced a new component to its security suite, aiming to prevent malicious applications, dubbed Smart App Control (SAC). This feature complements Microsoft Defender, blocking untrusted or unknown code from executing on a proactive basis. Now, in an updated blog post pushing the feature, Microsoft claims a performance boost compared to traditional AV solutions, though small print indicates you will require a fresh Windows installation to use this feature.

Traditional antivirus software, such as Microsoft Defender, adopts an “Innocent until proven guilty” approach. These solutions are largely reactive, trusting programs until their behavior triggers an alert. Microsoft Defender employs signature-based detection, behavioral checks (heuristics), and cloud protection to prevent malicious software on your system. When faced with novel (zero-day) malware or polymorphic threats, which can bypass signature checks, Defender falls back to heuristics, observing the malware’s actions until it detects suspicious behavior.

Here’s where Smart App Control enters the fray, employing a proactive methodology, operating on the principle of “Guilty until proven innocent.” It assesses the application’s security by vetting it against Microsoft’s Intelligence Security Graph (a cloud-based reputation service). If this test is inconclusive, it attempts to validate the application’s digital signature, to ensure its origin from a trusted developer. The application is blocked by Windows Security if it is predicted to be malicious in the first check or unsigned in the second check.

Essentially, SAC bypasses traditional behavioral checks by ensuring only verified applications can run on your system. Although Microsoft claims Smart App Control offers a performance boost over traditional antivirus solutions, it is designed to operate in parallel with Windows Defender. Unlike Windows Defender, if SAC deems a program malicious, it cannot be flagged as a false positive or whitelisted. As such, SAC is likely to be a poor fit for enthusiasts or developers, better serving enterprise systems or individuals who aren’t as tech-savvy.