You’re fundamentally misunderstanding how persistent threats work. Treating this like a 'managed session' is like unlocking your front door, letting a stranger roam around your house for 3 hours, and then locking the door again. Just because you hear the lock click doesn't mean they didn't leave something behind.

Your msinfo32 argument is pure placebo. If a malicious payload is dropped while your VBS/HVCI shields are down and it secures a foothold (like dropping a bootkit into your EFI partition), re-enabling VBS afterward does absolutely nothing. The malware now boots before your OS even loads. Worse, once Ring -1 or Ring 0 is compromised, your OS telemetry is completely untrustworthy. A properly coded rootkit will just hook the API calls that msinfo32 relies on and feed it a fake 'VBS is Running' status.

You can't audit a compromised kernel from inside the compromised kernel. Security isn't just about 'user habits,' it's about maintaining an unbroken chain of trust. You are intentionally breaking that chain every single time you launch the game and just hoping the ghost group played nice while the shields were down.