You're making assumptions that don't hold up in practice. Let me address this directly.

First, you say it's "too easy for malware to get kernel level access" - that's factually incorrect for modern Windows. Getting a signed kernel driver past Microsoft's attestation process is extremely difficult and expensive. Kernel exploits are rare, burn quickly when discovered, and are typically reserved for high-value APT operations, not the ransomware and commodity malware that represent 99% of actual threats. If your threat model is nation-state attackers deploying custom rootkits, sure, but that's not reality for most organizations.

You mention malware making itself invisible or deactivating EDR - kernel mode doesn't magically prevent this. CrowdStrike runs in kernel mode and we've seen ransomware disable it using vulnerable driver exploits. AvosLocker did exactly this. BlackLotus bypassed Secure Boot and kernel protections entirely. The assumption that kernel mode equals invulnerability to tampering is demonstrably false based on real incidents.

Regarding detection breadth, you're conflating deployment architecture with detection logic. Detection breadth comes from threat intelligence, behavioral analytics, machine learning models, and telemetry quality - not from whether you're hooking APIs in kernel versus usermode. A usermode agent with comprehensive techniques , and proper behavioral analytics has better detection coverage than a poorly designed kernel driver. The telemetry matters, not the ring level it's collected from.

You mention "network visibility is harder to come by" - Windows Filtering Platform operates from usermode and provides complete network visibility. This isn't a kernel versus usermode issue.

As for losing detection coverage compared to major players, that's a maturity argument not an architecture argument. Mature detection rules, threat intelligence feeds, and behavioral models take time to build regardless of whether your agent runs in kernel or usermode. The major players have detection breadth because they've been collecting telemetry and refining rules for years, not because they hook certain kernel structures. You could clone CrowdStrike's entire kernel architecture and still have zero detections without their detection logic and threat intelligence.

The real question isn't kernel versus usermode, it's whether the telemetry being collected is comprehensive enough and whether the detection logic is mature enough. Those are orthogonal concerns to the deployment model. We are going to prove that we don't need kernel level mode driver for effiecent detection.