Malware delivered through social engineering and zero-day exploits are two of the top threats targeting endpoint PCs. Attackers are constantly evolving their tactics to bypass security tools and trick users into infecting their devices. They’re also exploiting zero-day vulnerabilities – flaws that are hard to detect, require little or no user interaction, and often remain unpatched for extended periods. Most successful attacks begin with a compromised endpoint, despite the many security solutions organisations deploy.

It is precisely because detection-based tools are often bypassed that HP has invested in a different approach: threat containment. With HP Sure Click Enterprise and HP Wolf Pro Security, organisations can enforce strong isolation between trusted and untrusted content. These solutions are designed to stop zero-day exploits and malware by isolating untrusted content, like documents and web pages, inside disposable micro-virtual machines (uVMs). They use built-in hardware protections to do this quietly in the background, in a way that’s transparent to the user.

Today, we are now offering HP Wolf Pro Security for ARM PCs – the first and only hardware-enforced virtualisation-based threat isolation solution on Snapdragon-based laptops¹ – bringing industry leading Sure Click threat containment to the growing number of ARM PCs. Bringing this capability to a new hardware platform is an important industry milestone. As ARM PCs become more mainstream, they’re increasingly being targeted by the same threats that have long plagued x86-64 systems. Bringing threat containment to ARM ensures users get the same protection, regardless of architecture.

Porting to ARM required significant engineering effort. We spoke with Kris Uchronski, HP’s Director of R&D (Advanced Projects), to understand how HP’s hypervisor and platform security expertise – and a close partnership with Microsoft – made it possible.

What Makes Sure Click Different

Alex Holland:

So Kris, let’s start from the beginning. What makes Sure Click’s architecture unique?

Kris Uchronski:

Sure Click is built around our specialised security hypervisor that can spin up fully functional Windows micro-VMs in a fraction of a second. To make this possible, we use CPU-enforced virtualisation, and we developed a robust VM cloning technique that uses the concept of copy-on-write for memory and storage management. The result is a seamless user experience with strong isolation where each potentially risky task runs in its own micro-VM, so if something goes wrong, it’s contained.

Alex:

That sounds pretty complex. How does Sure Click manage to spin up full Windows VMs so quickly and seamlessly for the user then?

Kris: 

That’s one of the core innovations behind Sure Click. We use a technique called VM cloning. During Sure Click initialisation, a fully functional Windows VM is built and booted. Next, key applications like Microsoft Word or Google Chrome are loaded to “warm up the memory,” and then the VM is suspended. This suspended state becomes a template. When a user opens a document or clicks a link, we don’t boot a new VM from scratch. Instead, we clone the template using copy-on-write principles to handle the micro-VM’s memory and disk. That means we only create private copies of memory pages and disk data when they’re modified. The result is a fully isolated micro-VM that launches very quickly.

Alex:

And how do you ensure performance doesn’t degrade with many VMs running?

Kris:

We’ve built a lot of intelligence into our VM manager. It can detect when a micro-VM isn’t being used and suspends it to free up CPU and memory. We also use virtual-CPU throttling for some background tasks like chat apps, and we avoid suspending VMs that are playing audio or video so that Sure Click feels invisible to users. Over time, we’ve shifted from aggressive optimisation of memory usage to optimising for responsiveness. We developed features like memory pre-divergence, where we pre-emptively copy certain memory pages we know will be modified to help reduce VM exits and hence improve performance and overall user experience.

HP’s Security Hypervisor

Alex:

You mentioned how Sure Click is built on a specialised security hypervisor. What makes isolation through CPU-enforced virtualisation more secure than software-based isolation?

Kris:

Workload isolation isn’t a new concept. In fact, modern operating systems have been implementing some form of execution isolation for decades, with process level isolation being a well-known example. Other common approaches include containers, which isolate multi-process environments and resources like the file system, and user-mode sandboxes, which confine single-process workloads. But all of these rely on the OS kernel for enforcement, which means they remain vulnerable to zero-day vulnerabilities in the OS or its components.

In contrast, CPU-backed virtualisation provides independent, hardware-enforced privilege and memory isolation. The attack surface still exists, but for well-designed hypervisors it’s significantly smaller than that of a general purpose OS.

Alex:

How is HP’s hypervisor stack designed with security in mind?

Kris:

Our security virtualisation stack was built with a clear purpose: to provide strong, CPU-enforced isolation between execution environments with varying trust levels. This virtualisation-based isolation is foundational to our security solutions, including Sure Click (for threat containment), HP Sure Access Enterprise (for protecting high-value assets), and HP Sure Start’s virtualisation-based BIOS protection (for isolating PCI device option ROM execution).

One of our main design goals was to leverage the virtualisation capabilities provided by the CPU. This allowed us to avoid certain pitfalls, such as the need for shadow page tables in the memory manager, and also helped improve performance.

We’ve also simplified component interfaces and inter-process communication (IPC) to reduce the risk of misuse. Our cloned VMs rely minimally on emulated hardware, instead favouring para-virtualised interfaces and devices, which are simpler to design and implement. This further reduces the need for broad CPU instruction emulation, which is a known source of hypervisor-level vulnerabilities.

Engineering for ARM

Alex:

Let’s get back to the ARM platform. What were the biggest technical challenges in porting Sure Click to ARM?

Kris: 

There were many. First, ARM64 and x86-64 are fundamentally different CPU architectures. Instructions like CPUID and model-specific registers (MSRs), which we rely on heavily in x86-64 for things like hypercalls and crash diagnostics, don’t exist on ARM64. We had to work closely with Microsoft to implement ARM-specific equivalents using Windows Hypervisor Platform (WHP). Since ARM doesn’t support legacy BIOS, we had to adopt a UEFI-based BIOS for Sure Click VMs. That meant reworking parts of our boot process and ensuring compatibility with ARM-specific virtual devices like keyboard and display controllers that differ from x86-64.

Alex:

But wasn’t there a simpler path using x86-64 emulation? Why not just run Sure Click in the x86-64 emulator on Windows for ARM?

Kris: 

Emulation can’t be used everywhere because of technical limitations. For example, kernel components must run natively, as emulation isn’t supported in the Windows kernel. The main reasons are performance and reduced complexity – with the latter being especially important for maintaining system stability. A hybrid approach – where some Sure Click components run natively and others are emulated – wouldn’t be acceptable either, as emulation introduces performance overhead, especially when fast micro-VM spin-up is required.

Partnership with Microsoft

Alex:

I know that this project was also a big collaboration with Microsoft. Can you tell us more about that?

Kris: 

It was essential. Microsoft was already investing in making Windows Hyper-V on ARM viable and porting WHP to ARM64. We worked closely with Microsoft Hyper-V and WHP teams to ensure WHP exposed the right functionality for our use case since Sure Click is quite unique in how it uses virtualisation. In collaboration with Microsoft, we systematically identified and addressed gaps in WHP’s ARM implementation. They helped us by implementing alternative mechanisms, such as ARM-specific hypercalls and synthetic timers.

There were also practical challenges. Waiting for full Windows builds with improvements would have slowed us down, so Microsoft provided us with custom test-signed binaries containing just the changes we needed. That allowed us to iterate quickly and keep development moving at a good pace.

Alex:

What role does Windows Hypervisor Platform play?

Kris: 

WHP was central to making Sure Click on ARM possible quickly. It acts as an abstraction layer between our user-mode hypervisor and the underlying virtualisation features provided by the hardware. That abstraction is what allowed us to avoid writing a full hypervisor stack from scratch for ARM, which wasn’t feasible given our tight deadlines. WHP also essentially lets us run our hypervisor as a user-mode application – an advantage that helps improve overall system stability.

Looking Ahead

Alex:

What does this mean for customers and the future of threat containment on ARM?

Kris:

This launch is a big step forward. Customers can now get the same level of protection from Sure Click on ARM PCs as they do on x86-64 systems. From an engineering perspective, this was a major milestone. It shows that with our team’s deep platform security expertise and strong partnerships, like the one we’ve built with Microsoft, it’s possible to bring state-of-the-art security technologies to new architectures without compromising performance or user experience. I would like to thank the engineering and product management teams at HP and Microsoft for making it happen.

We’re proud of what we’ve achieved, and we’re already thinking about what’s next. There’s more work to do to bring Sure Access Enterprise to ARM, but this is a solid start.

[1] Based on HP’s internal competitive feature analysis and publicly available specifications as of August 2025, HP is the first and only vendor to offer a software solution with hardware-enforced virtualisation-based threat isolation capabilities run locally on the endpoint on Qualcomm Snapdragon/ARM based laptops. Requires a Snapdragon-based HP laptop with Windows 11 or higher and included on select HP PCs or purchased as a software license option.