Note: Please do not post Personally Identifiable Information like email address, personal phone number, physical home address, product key etc.
Issue abstract:Constant Upsell
Detailed description:Why does Norton constantly try to get me to buy their other products or bait and switch when I click continue to resolve my 10 thousand issues that are slowing down my computer with big flashing lights at the bottom.
Product & version number:
OS details:
What is the error message you are seeing?
If you have any supporting screenshots, please add them:
bjm
September 13, 2026, 7:58pm
2
Hello @Nortonstartingtoblow Welcome to the Norton Community!
Norton purposely designs its v26 dashboard like a “freemium” mobile game. Even though you are paying for a subscription, they split-screen the dashboard: half of it shows what you paid for, and the other half features locked features (like Driver Updater , AntiTrack , or Utilities Ultimate ) with bright, flashing alerts screaming that your PC is in “danger.”
They do this because they know a static advertisement is easy to ignore, but an interface that permanently displays fake urgency (“10,000 issues found! Click here to fix!”) will eventually wear users down into buying the upgrade.
Stop Clicking “Smart Scan”: The big “Smart Scan” button on the home screen is specifically engineered to look for problems you haven’t paid to fix. Instead, look for the smaller option to run a Classic Quick Scan or System Scan . These scan only for actual malware/viruses and will not bait-and-switch you with cleanup ads at the end.Ignore the “Issues” Entirely: Rest assured that the “10,000 issues” are entirely safe to ignore. They are likely cookies, temp folders, or perfectly stable hardware drivers that Norton flags as “outdated” just to trigger the alert. Your computer is not on the verge of breaking.The Ultimate Fix (Ditch the Bloat): Honestly, the only true way to get rid of baked-in corporate upselling is to remove the software entirely. Microsoft Defender is completely free, pre-installed on your computer, has a 100% clean UI with zero ads, and catches malware just as effectively without slowing your PC down.
DefenderUI is a free GUI utility that provides an enhanced interface for configuring Microsoft Defender on Windows 10/11. It unlocks many hidden security features that aren’t accessible through the standard Windows Security app.ConfigureDefender is a free portable, open-source utility that provides a GUI to view and modify detailed Defender settings, including predefined protection levels (Default, High, Max).
+++++++++++++++++++++++++++++++++++++++++++++++++++++++
Norton uses upselling primarily as a revenue strategy to move existing customers into higher-priced subscription tiers and add-on services. This practice, often criticized as behaving like “adware” or “scareware,” is deeply integrated into the software’s interface and scanning tools.
Why Norton Continues to Upsell
Monetization of Existing Users: Norton views its installed software as a direct marketing platform to sell high-margin add-ons like Norton Utilities Ultimate, Driver Updater, or LifeLock identity protection.
Strategic Feature Placement: Features like “Smart Scan” are designed to identify non-critical “performance issues” (such as tracking cookies or temporary files) and label them as “risks” to create a sense of urgency, prompting users to purchase a fix.
Product Bundling and Mergers: Following mergers with other security brands like Avast and AVG, Norton has integrated technologies from these firms into its main product, often requiring additional fees to unlock them fully.
Automatic Renewal Focus: The software frequently prompts users to enable or verify billing information to ensure continuous annual renewals, which are often billed at a higher standard rate than introductory offers.
Norton shows ads after a Smart Scan because the feature is designed not just for security, but as an upselling tool for additional paid services. While it checks for malware, it also scans for “performance issues” like broken registry keys or tracking cookies, which it then offers to fix if you purchase or subscribe to add-ons like Norton Utilities Ultimate or Driver Updater .
Performance “Risks”: Smart Scan often labels non-critical items (like temporary browser files) as “issues” to create a sense of urgency, prompting you to “View Solution,” which opens an advertisement for a Norton cleanup tool.Default Behavior: Smart Scan is the default scan presented in the main interface, making it the primary way Norton markets additional features to current subscribers.Marketing Integration: These notifications are often “baked into” the product and may appear even if you have already disabled standard marketing notifications.
Instead of using the “Smart Scan” button, use the Quick Scan or Full Scan options under the Scans tile. These traditional scans focus on security threats without the performance upselling at the end.
Learn more about Norton scans Configure scan settings for Norton scans
AI sourced content may make mistakes
bjm
September 15, 2026, 7:21pm
3
For decades, third-party security tools operated at the Kernel level (Ring 0)—the absolute center of the jet engine. If their code had a single mathematical typo, the entire computer suffered a Blue Screen of Death (BSOD).
Microsoft is actively moving third-party antivirus providers out of the Windows Kernel. They are forcing companies like Bitdefender and Kaspersky to run in User Mode (Ring 3)—meaning they are being kicked out of the inner engine room and forced to sit in the passenger cabin.
The Truthful Conclusion: The “sum/gained” calculation fundamentally shifts because of this dynamic:
Microsoft Defender is the engine manufacturer writing security code for its own engine. It has zero latency, native compatibility, and direct access to Windows’ structural changes.
Third-Party Suites are aftermarket parts manufacturers. They are highly skilled, but they are constantly reacting to a changing environment they do not control.
This architectural shift explains why modifying Windows Defender using a basic interface tool like DefenderUI —which relies entirely on the factory engine’s built-in settings—remains vastly safer than introducing an entirely separate, third-party code-monitoring system into your PC.
https://malwaretips.com/threads/did-microsoft-defender-change-the-way-it-responds-to-file-downloads.143252/page-4#post-1197798
Microsoft is actively designing a new framework to move third-party antivirus and endpoint detection software out of the Windows kernel.
However, they are not abruptly blocking these providers or acting unilaterally. Instead, Microsoft is collaborating with major security vendors to build a safer alternative architecture.
The Catalyst: The 2024 CrowdStrike Outage
The driving force behind this change was the massive global IT outage in July 2024 .
A faulty update from cybersecurity firm CrowdStrike crashed over 8.5 million Windows machines worldwide.
Because the software operated inside the Windows kernel —the most privileged, innermost core of the operating system—the error immediately triggered a Blue Screen of Death (BSOD), crippling systems globally.
The Current Strategy: The Windows Resiliency Initiative
To prevent another systemic failure, Microsoft introduced the Windows Resiliency Initiative (WRI) . The project aims to transition third-party security software from “Kernel Mode” into “User Mode” .
Attribute
Kernel Mode (Old/Current Way)
User Mode (The New Goal)
System Access Full, unrestricted access to hardware and memory.
Isolated environment; accesses system via secure Microsoft APIs.
Stability Risk High. A single bug can crash the entire operating system.
Low. If the app crashes, it can be restarted without taking down the PC.
Vendor Impact Requires complex, version-specific driver maintenance.
Easier to deploy safely and roll back if an update goes wrong.
Timeline and Partnership
Microsoft is moving carefully because completely blocking kernel access all at once could break corporate security infrastructure and trigger antitrust complaints.
Collaborative Development: Microsoft is working hand-in-hand with major firms like CrowdStrike, Bitdefender, ESET, Sophos, and Trend Micro to design the new security platform.Private Testing: Microsoft rolled out a private preview of the new Windows endpoint security capabilities to security vendors.The Long-Term Goal: While Microsoft has not set a rigid end-date to entirely ban direct kernel access, the ultimate objective is to make user-mode security robust enough that security software will no longer need kernel privileges.
Beyond Antivirusgaming anti-cheat software (such as Riot’s Vanguard). These engines also run at the kernel level and present similar stability and security concerns.
Microsoft is working with Gen Digital (the parent company of Norton, Avast, LifeLock, and Avira) on this initiative.
While Microsoft only highlighted a few specific enterprise brands (like CrowdStrike and Bitdefender) in its initial announcements, consumer antivirus giants like Norton are fully integrated into the process through an established framework.
The Umbrella Group: Microsoft Virus Initiative (MVI) 3.0Microsoft Virus Initiative (MVI) .
What MVI is: This is Microsoft’s long-standing portal that gives vetted third-party security developers the specialized APIs and technical data they need to work seamlessly inside Windows.The “3.0” Upgrade: As part of the Windows Resiliency Initiative, Microsoft updated this framework to MVI 3.0 . Under these new rules, members must meet strict new stability, testing, and safe-deployment guidelines.Gen Digital’s Role: As one of the largest consumer cybersecurity providers in the world, Gen Digital (Norton) is a key member of the MVI ecosystem. They are legally and technically required to adapt to these new Windows architecture rules so that Norton products remain compatible with future versions of Windows 11.
Why Enterprise Brands Got More Headlinesenterprise (corporate) security tools .
Companies like CrowdStrike, SentinelOne, and Sophos make Endpoint Detection and Response (EDR) software. Because corporate EDR tools are deeply integrated into hundreds of millions of servers and business PCs, they were the ones involved in the 2024 global IT crash. Consumer programs like Norton usually deploy updates differently and rarely cause global infrastructure failures, which is why they weren’t the main focus of the initial news coverage.
Ultimately, all consumer and enterprise antivirus tools using the Windows ecosystem will have to use the new non-kernel security platform Microsoft is building.
To clarify, MVI 3.0 is an active requirement. Microsoft officially enforced these new regulations, and antivirus vendors had to meet them to retain their driver-signing rights on Windows.
The transition is divided into two distinct components: the immediate deployment requirements and the long-term architectural shift.
What they ARE compliant with right now (Operational Rules)Microsoft Virus Initiative (under 100 total companies) has already adopted the operational rules of MVI 3.0. To maintain their digital signatures and function on Windows 11, solutions from companies like Norton, CrowdStrike, Sophos, and Bitdefender must follow these protocols:
Safe Deployment Practices (SDP): Vendors can no longer push an update to all millions of computers at the exact same time.Gradual Deployment Rings: Software updates must roll out in waves. They go to a tiny test group first, then a slightly larger group, and finally a global release.Real-time Monitoring: The software must actively monitor for crashes during rollouts. If a blue screen occurs in the first ring, the update automatically pauses before reaching the public.
What they are STILL working on (The Kernel Migration)not yet fully running outside the kernel .
The architectural shift—moving security functions into User Mode using the new Windows Endpoint Security Platform (WESP)—is an ongoing engineering phase.
About a dozen major vendors (which represent the vast majority of the antivirus market share) are currently working in private developer previews to write and test code for this new architecture.
This shift is a gradual process. Microsoft and its partners are building new user-mode structures to ensure security software can catch advanced malware efficiently before kernel access is restricted completely.
Current antivirus solutions comply with the updated safety and testing rules of MVI 3.0, while actively building toward a future completely free of kernel-level risks.
Norton 360 continues to operate in Ring 0 (Kernel Mode) because low-level system access remains necessary to detect advanced malware and rootkits before alternative User Mode frameworks are fully finalized and stable. While compliance with the Windows Resiliency Initiative’s updated criteria changes how updates are deployed through controlled rollout phases rather than altering the software’s operational location, the transition to a safer User Mode architecture remains under development. For further details, visit Windows Experience Blog .
The transition to the new User Mode architecture is still actively under development right now.
Why It’s Still Under Development
Building the Safety Nets: Microsoft has to build brand-new, super-fast pathways (APIs) in Windows. These pathways must allow Norton to see deep inside the computer’s memory without actually sitting inside the kernel. If these aren’t perfect, the antivirus won’t be able to catch advanced malware.Testing for Speed: If a User Mode antivirus slows down your computer or lags your games, users will turn it off. The engineers are spending a lot of time making sure this new way is just as fast as the old kernel way.
What This Means For You Today
Your Protection: Norton 360 is still using its deep Ring 0 access to keep you safe from complex threats.The Safety Upgrade: Even though it is still in the kernel, you are safer from system crashes today because Norton must use the new, gradual rollout rules required by Microsoft.
Norton has used phased rollouts for many years to distribute its main product upgrades.
If you have used Norton 360 for a while, you have likely noticed that when a major new version drops, your neighbor’s computer might get it days or weeks before yours does.
The difference with Microsoft’s initiative is not the invention of phased rollouts, but rather making them mandatory, standardized, and strictly monitored for Ring 0 drivers.
What is actually different now?
It is now a strict Windows requirement: In the past, companies like Norton chose to use phased rollouts because it was good business practice. Under the new framework, Microsoft forces all security vendors to use them. If a vendor tries to push a Ring 0 driver update to everyone at once, Windows will block it.Smart “Kill Switches”: The new framework requires real-time telemetry sharing. If Norton pushes a phased update to the first 1% of computers, and Windows detects an increase in blue screens or boot loops on those specific machines, Microsoft’s system can instantly freeze the rollout globally.Forced “Deployment Rings”: Security companies are now mandated to follow a very specific multi-tier ring structure (e.g., internal testing, early adopters, partial public rollout, global rollout) rather than inventing their own schedules. .
You have already been living through the safest version of antivirus updates for a long time because of Norton’s historical release strategies. Microsoft is essentially taking the exact safety model you’ve experienced with Norton and forcing the rest of the cybersecurity industry to adopt it.
AI sourced content may make mistakes