Virtualization-based security, or VBS, uses hardware virtualization features to create and isolate a secure region of memory from the normal operating system. Windows can use this "virtual secure mode" to host a number of security solutions, providing them with greatly increased protection from vulnerabilities in the operating system, and preventing the use of malicious exploits which attempt to defeat protections.

One such example security solution is Hypervisor-Enforced Code Integrity (HVCI), commonly referred to as Memory integrity, which uses VBS to significantly strengthen code integrity policy enforcement. Kernel mode code integrity checks all kernel mode drivers and binaries before they're started, and prevents unsigned drivers or system files from being loaded into system memory.

VBS uses the Windows hypervisor to create this virtual secure mode, and to enforce restrictions which protect vital system and operating system resources, or to protect security assets such as authenticated user credentials. With the increased protections offered by VBS, even if malware gains access to the OS kernel the possible exploits can be greatly limited and contained, because the hypervisor can prevent the malware from executing code or accessing platform secrets. UL benchmarks, the creator of popular 3DMark and more, has noted that there can be an impact on the performance, especially related to gaming tasks, due to VBS. It has stated:

In our testing with pre-release builds of Windows 11, a feature called Virtualization-based Security (VBS) causes performance to drop. VBS is enabled by default after a clean install of Windows 11, but not when upgrading from Windows 10. This means the same system can get different benchmark scores depending on how Windows 11 was installed and whether VBS is enabled or not.

So clearly it's a feature mainly intended for enterprise customers to be able to lock down the corporate PCs they drop into their offices and make sure they don't get compromised. And if you're upgrading from Windows 10 to Windows 11 then you don't have to worry about VBS being enabled, unless you were already running an enterprise version of the older OS, that is. The issue comes if you're receiving a machine which has had an OEM build of Windows 11 installed on it. You can quickly check whether it is on or off yourself by hitting the 'Win' key and typing 'MSInfo32', then down at the bottom of the system report it will show whether VBS is enabled.