The Windows 10 Fall Creators Update will include EMET-like capabilities managed through a new feature called Windows Defender Exploit Guard.

Microsoft's EMET, the Enhanced Mitigation Experience Toolkit, was a useful tool for hardening Windows systems. It used a range of techniques—some built in to Windows, some part of EMET itself—to make exploitable security flaws harder to reliably exploit. The idea being that, even if coding bugs should occur, turning those bugs into actual security issues should be made as difficult as possible.

With Windows 10, however, EMET's development was essentially cancelled. Although Microsoft made sure the program ran on Windows 10, the company said that EMET was superfluous on its latest operating system. Some protections formerly provided by EMET had been built into the core operating system itself, and Windows 10 offered additional protections far beyond the scope of what EMET could do.

But as more mitigation capabilities have been put into Windows, the need for a system for managing and controlling them has not gone away. Some of the mitigations introduce application compatibility issues—a few even require applications to be deliberately written with the mitigation in mind—which means that Windows does not simply turn on every mitigation for every application. It's here that Exploit Guard comes in.

Exploit Guard will be able to control the operating system-wide mitigation capabilities, as well as more individual, tailored protections. For example, with Exploit Guard, certain kinds of macros in Office documents can be blocked, and access to websites known to host lots of malware can be prevented.

The update is also likely to include Application Guard for Edge. This feature, which runs the Edge browser in a special virtual machine to isolate it from the rest of the system, was (briefly) included in previews for the Creators Update. It went away and wasn't included in that release, but now it's back. This time, Microsoft says Application Guard is on track for inclusion in the fall update.

The Fall Creators Update will expand the scope of Windows Defender Advanced Threat Protection (ATP), the cloud-based, heuristic malware detection system. Since ATP's introduction, Microsoft has broadened the range of behavior that it can inspect—for example, the Creators Update earlier this year added detection of certain suspicious kinds of memory manipulation—and this will continue with the addition of monitoring of script-based attacks and detection of keylogging.

On the cloud side, the reporting and tracking capabilities are being improved to make quickly assessing an organization's security health easier.

With the autumnal update, ATP will also be offered on Windows Server, for both Windows Server 2016 and Windows Server 2012 R2. Microsoft has also said that it is going to bring ATP to unspecified non-Windows platforms.