What we can say reliably
I’m not aware of any public Kaspersky document that plainly says “we built our own hypervisor because Microsoft restricts X” (i.e., a clear vendor rationale statement). Their public help pages mainly describe
what the hardware-virtualization protection does and
when it can’t be used (e.g., when VBS/Device Guard is enabled), not the internal product decision-making. ([support.kaspersky.com](https://support.kaspersky.com/kfa/83057?utm_source=openai))
So “maybe Microsoft restricts it” is plausible, but it’s still an inference unless someone can cite a specific Microsoft policy/doc or a Kaspersky engineering note that confirms it.
Why vendors sometimes avoid “just use Hyper‑V / a full VM” (non-conspiracy reasons)
Even if Microsoft doesn’t “restrict” it, there are practical reasons an AV vendor might not implement banking protection as a full Hyper‑V VM:
- User experience: A full VM is a separate OS instance with its own browser/profile. Kaspersky’s Safe Money is designed to open your banking site in a “protected browser” flow that feels like normal browsing, not “boot another Windows”. ([usa.kaspersky.com](https://usa.kaspersky.com/enterprise-security/wiki-section/products/online-banking-the-safe-money-technology?utm_source=openai))
- Compatibility: Hyper‑V usage depends on edition, configuration, corporate policy, other hypervisors, drivers, etc. A “normal VM” approach can break more often than a lighter isolation/container approach.
- Performance/overhead: Running a VM continuously (or spinning one up for each session) can be heavier than process/container hardening.
- Threat model: Their docs point to interception/phishing/clipboard-style issues. That can be addressed by hardening the browser session + anti-injection checks, without needing a whole OS VM. ([usa.kaspersky.com](https://usa.kaspersky.com/enterprise-security/wiki-section/products/online-banking-the-safe-money-technology?utm_source=openai))
Those are engineering/product trade-offs, not evidence of “reinventing the wheel” for malicious reasons.
About “Microsoft restrictions” specifically
The one concrete, documented friction point we can point to is: Kaspersky’s hardware-virtualization layer is
not available when Windows VBS/Device Guard is enabled. That suggests a “can’t coexist cleanly with Microsoft’s virtualization security stack” situation, more than “Microsoft tech is flawed.” ([support.kaspersky.com](https://support.kaspersky.com/kfa/83057?utm_source=openai))
Microsoft also documents VBS/HVCI as a security feature they want enabled in many environments, so it’s not positioned as something vendors should bypass. ([learn.microsoft.com](https://learn.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity?utm_source=openai))
Bottom line
“MS restricts it” is a reasonable hypothesis, but without a specific citation it remains a hypothesis. What’s documented is simply that Kaspersky’s hypervisor-based banking protection conflicts with Windows VBS/Device Guard being enabled. If you want a clean “sound Windows baseline,” the safest approach is usually to keep VBS/Memory Integrity on and treat third-party hypervisor add-ons as optional—not worth disabling core OS protections for.