Runtime Memory Protection

At Prelude Security, we explored ways to generically identify the execution of private memory. We released a whitepaper, built a Windows endpoint agent (and corresponding backend) to detect private memory execution at scale. I was part of the small research team that pitched and built this product from the ground up. The whitepaper discusses how to configure and collect hardware telemetry from ETW and the ways we can use that data to detect any execution of private memory. We received a patent for this work in 2025.