@AndyFul
Smartscreen, Cloud protection level Zero Tolerance, ISG and SAC seem to use the same back-end cloud technology, as always with Microsoft the implementations are different.
SAC seems to be a tighter omplementation of Microsoft Defender on MAX (also looks at DLL's). ConfigureDefender on MAX allowed me to install a (signed) Photobook application in user folders which did not have signed DLL's. Defender on MAX allowed that application to run while SAC blocked it.
That said I have SRP (using H_C) running on my wife's laptop for years while also running Defender on MAX (using CD), to limit the execution of risk in user folders for unelevated processes (with standard user / medium IL rights).H_C allowed me to add exceptions for the Photobook executable. Defender on MAX worked well on a Lenovo laptop, an Asus laptop (which sadly passed away when my wife spilled a mug of hot thee over it) and her latest HP laptop.
Maybe you could start a poll how many H_C users were running Defender on MAX, to get an idea of how many people would still like to have SRP using H_C with SAC?
I have an other question: Why would people need SAC when they also can run Defender on MAX (and add exceptions)? Like UAC, SAC seems to be an ALL or NOTHING first implementation, this will like UAC probably will be lowered (you already explained the differences of SAC and ISG when Defender/Smartscreen decided to allow something). My bet is that the next version of SAC will also have this ISG behaviour to enhance useability and reduce protection.
When that happens (second less rigid implementation of SAC with malware misusing this like current UAC on default), people wished they had still SRP to set a deny execute in userland
A benefit of H_C (on default) for people using a third-party AntiVirus would be to run it in SWH like setting with sponsor blocking for standard users. I think SAC (or WDAC ISG) has more value to people running a 3p AntiVirus (you get two for the burden/price of one) than people already running Defender on MAX.
