Benchmarked: Do Windows 11’s Security Features Really Hobble Gaming Performance?

Intel AMD Windows 11 performance
(Image credit: Shutterstock, AMD, Intel, Microsoft)

Update 10/9/21 7:00am PT: AMD and Microsoft have announced a performance problem with AMD processors that results in up to 15% less performance in some games. The newly-reported issue is separate from the gaming tests below, which outline the impact of security features, and merely serve to set a lower baseline for our tests. That means the performance deltas measured below remain accurate. 

Original Article:

Microsoft is taking yet more backlash over its Windows 11 launch, as recent reports indicate that buyers of new pre-built systems could purportedly lose up to 28% of their gaming performance due to frame-rate-crushing security measures. That has gamers up in arms, so we did several rounds of testing in our labs with some of the best CPUs for gaming from Intel and AMD.

We found that the security mechanisms do reduce gaming performance, with the average impact on an 11th-gen Intel chip being in the 5% range (7% peak in one title). That may not seem like much to the untrained eye, but that's roughly an Intel CPU generation's worth of disappearing performance. We recorded a slightly smaller impact on AMD Ryzen systems, with a 4% average for a Ryzen 5000 chip (and an outlier 8% loss in one title). We also have tons of other gaming and desktop PC applications benchmarks, which you can see below.

The performance impact we measured wasn't nearly as severe as we've seen reported by other outlets. Still, we don't like to compromise, and taking a step back on gaming performance isn't acceptable if you don't need the added security — especially when this is an optional feature that OEMs can simply opt out of.

Luckily for enthusiasts, these security mechanisms won't be enabled by default if you update your own system from Windows 10 to Windows 11, or if you do a clean install. However, Microsoft does suggest that OEMs enable these features on some new pre-built systems. After some digging, it's clear that Microsoft explicitly does not recommend one of the security settings for gaming PCs, while the status of another remains unclear. Here's the rundown.

What is VBS and HVCI?

The issue begins with Microsoft's Virtualization-Based Security (VBS) feature, which enables an umbrella of different security services. This feature uses hardware virtualization to create a secure area in memory for use by other security features, like Trusted Platform Modules (TPM) and Hypervisor-Protected Code Integrity (HVCI). Think of VBS as a platform that enables other security features. As you'll see below, both VBS and HVCI can result in reduced performance in gaming and many common PC applications.

Microsoft has suggested shipping Windows with VBS enabled by default on OEM systems that support the feature since Windows 10 version 1903 9D in October 2019. However, Microsoft has bulked up its security features in Windows 11 and now suggests that OEMs also enable HVCI by default on some systems. This feature adds additional protections for kernel memory allocations, thus improving malware resistance.

HVCI (commonly known as Memory Integrity) has a bigger performance impact than VBS, but Mode Based Execution Control (MBEC) steps in to reduce it. MBEC requires hardware support, and it is baked into all processors starting with 7th-gen Intel and AMD's Zen 2. Without this feature, HVCI's performance impact can be quite severe. MBEC basically blunts the blow on newer hardware, so you'll see a smaller impact. Our tests imply that MBEC support reduces the impact of HVCI to nearly the same level as VBS alone.

The requirements for default HVCI enablement are simple from a CPU perspective: You'll need an Intel 11th-gen, AMD Zen 2, or Qualcomm Snapdragon 8180 chip (or newer), a minimum of 8GB of RAM and 64GB of SSD storage, along with HVCI-compatible drivers.

Microsoft acknowledges HVCI's performance reduction, and OEMs can opt-out of HVCI for certain types of machines:

"Some devices that are especially sensitive to performance (e.g. gaming PCs) may choose to ship with HVCI disabled. Given the impact to the overall device security, we recommend you thoroughly test these scenarios before doing so." -Microsoft

We're still digging up the details of whether or not OEMs can opt out of VBS enablement for gaming laptops and PCs, but MSI tells us that it doesn't enable HVCI on its gaming systems. We'll follow up with more information as we learn more.

You can do a quick check to see if VBS is enabled by checking the summary in your System Information pane. The "Virtualization Based Security" entry will tell you if the service is running. Head here for a deeper explanation of how to enable or disable VBS and HVCI.

Also, be aware that we're testing with CPUs that support MBEC, which seems to reduce the overall impact of HVCI. That means older chips will suffer more from this added level of protection than you'll see below. 

Swipe to scroll horizontally
Microsoft Windows 11 VBS and HVCI Impact on Intel and AMD Gaming (Geomean)
Baseline = VBS and HVCI OffCore i7-11700KCore i7-10700KRyzen 7 5800XRyzen 7 3800X
VBS-4.9%-5%-4%-4.1%
HVCI-5.6%-5.7%-3.3%-4.1%

Here's a quick summary of the overall geometric mean of our gaming tests. We have far more in-depth testing and analysis below. Overall, we're looking at around a 5% loss in performance, give or take 1%. That's not a huge drop, and not something most people would generally notice, but it is relatively significant when you think about the difference in performance between various processors. Core i9-11900K for example costs about 35% more than Core i7-11700K, and the only real difference is higher clocks speeds that improve performance by—wait for it!—about 7%. So you're giving up nearly a full speed step in performance on Intel CPUs.

Windows 11: Security Impact on Intel Gaming Performance

You'll find more detailed test notes at the end of the article. We tested five different game titles, two of them with different APIs, with both the Core i7-11700K and i7-10700K. We then used those results to generate a geometric mean of gaming performance for the Intel and AMD platforms. As always, performance deltas vary by title, with some showing little impact from VBS/HVCI while others suffer more. Be sure to check out the full tests for the breakdown.

We tested with Windows 11 Pro 23000.194 (the version Microsoft provided for review) and the Windows 11-compatible Nvidia 472.12 graphics driver. As always for CPU testing, we used an Nvidia GeForce RTX 3090 to minimize the graphics bottleneck. We also stuck with the 1920x1080 resolution, so be aware that the impact of VBS and HVCI will vary with higher resolutions and lesser graphics cards.

  • VBS Off - Virtualization-Based Security (VBS) Disabled
  • VBS On - Virtualization-Based Security (VBS) Enabled
  • VBS On HVCI - Virtualization-Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI) Enabled

With VBS enabled and running, the Core i7-11700K was 4.9% slower in the geometric mean of our test suite while the i7-10700K was 5.7% slower. It's pretty easy to see that enabling VBS causes the newer 11700K to fall below its prior-gen counterpart, which definitely isn't encouraging. 

Enabling HVCI results in a slight decline in performance below the 'VBS On' results, but performance will vary based on the game title tested. Also, even though we tested for it, Microsoft doesn't recommend enabling HVCI by default on the 10th-gen processors. The album below has the test results for all of our Intel gaming testing, and we also have a table that shows the percentage decrease in performance for both the Intel and AMD systems a bit further below. 

Due to Intel's small gaming performance increase as it moved from its 10th-gen to 11th-gen chips, we had to separate the Core i7-11700K and 10700K slides — the two chips often overlap, and these charts can be confusing due to the similar chip naming and configurations.

We cycled through DX11, DX12 and Vulkan APIs where applicable to see if they impact performance with the security features. Vulkan was faster than DX12 in Red Dead Redemption 2 after enabling VBS. Red Dead Redemption 2 was 7.3% slower with DX12 and VBS, while Vulkan reduced that to 4.4%. We only tested one title with Vulkan, so this delta may be due to the game engine rather than a specific Vulkan/VBS tendency.

Shadow of the Tomb Raider has been cited as suffering the most from VBS (to the tune of a whopping 28%), but our results were far more muted, with the biggest slowdown measuring -7.2% with DX12 on the Core i7-10700K. We also tested DX11 with both Core i7 chips, and almost all of the tests (see table below) suffered an average ~6% slowdown.

Grand Theft Auto V seems mostly immune to VBS, as it only lost roughly 1% of its performance after activating the feature. Far Cry 5 lost about 5% on both chips, and Project Cars 3 lost about 6% on each chip.

UL Benchmarks first issued a warning to the press about the VBS feature, so we included three of the company's benchmarks. The 3DMark tests show little variance, but the VRMark benchmark takes a 3% haircut with the 11700K, and loses 7.5% with the 10700K.

Windows 11: Security Impact on AMD Gaming Performance

We recorded slightly smaller performance reductions with the AMD processors than we did with the Intel models, but the delta is so slight between the chips as to be inconsequential. You certainly shouldn't base an AMD vs Intel buying decision on a chip's ability to handle VBS/HVCI — at least for the last two generations.

Based on our geometric mean, the Ryzen 7 5800X was 4% slower after we enabled VBS. Compared to the 'VBS On' configuration, the HVCI result falls within the standard variance we expect in our benchmarks. That means we see no real noticeable difference between the 'VBS On' and 'VBS+HVCI' configurations.

The Ryzen 7 3800X is 4.1% slower after we turn on the security features. The 3800X also provides essentially the same level of performance with either the 'VBS On' or 'VBS+HVCI' configurations.

Unlike Intel's small jump from its 10th to 11th-gen chips, AMD's transition from Zen 2 to Zen 3 resulted in dramatically higher gaming performance. That means the impact of the Windows 11 security feature isn't enough to drop you a generation's worth of performance as we saw with the Intel Core i7-11700K.

Three game titles (listed below) suffered less than a 2% performance reduction with VBS enabled on the Ryzen 7 5800X, while Project Cars 3 suffered the highest performance loss at 8.1%. Notably, Shadow of the Tomb Raider lost 4.3% with DX12 and 1.9% with DX11.

The Ryzen 7 3800X had a scattered showing, with an overall 4.1% slowdown that varies widely by title.

Overall VBS Impact on Gaming Performance for AMD and Intel

Swipe to scroll horizontally
FPS With VBS Active
Baseline = VBS Offi7-11700Ki7-10700KRyzen 7 5800XRyzen 7 3800X
Shadow of the Tomb Raider - DX11-6.2%-6.1%-1.9%-4.5%
Shadow of the Tomb Raider - DX12-6.1%-7.2%-4.3%-3.7%
Project Cars 3 - DX11-5.7%-6.4%-8.1%-0.8%
Far Cry 5 - DX11-4.6%-4.9%-1.1%-6.4%
Grand Theft Auto V - DX11-0.9%-1.1%-1.6%-0.1%
Red Dead Redemption 2 - DX12-7.3%-5.4%-5.6%-8.6%
Red Dead Redemption 2 - Vulkan-4.4%-4.4%-2.6%-4.6%

Here's a quick look at the differences we recorded in each title after we enabled VBS. Naturally, this could be a few percent slower with HVCI also active, but it varies drastically by title. Be aware that anything within a 2% delta can simply be chalked up to run-to-run variability. 

Windows 11: Security Impact on Intel Desktop PC Application Performance

Swipe to scroll horizontally
Microsoft Windows 11 VBS and HVCI Impact on Intel and AMD Application Benchmarks (Geomean)
Baseline = VBS and HVCI OffCore i7-11700KCore i7-10700KRyzen 7 5800XRyzen 7 3800X
VBS Single/Multi-threaded-0.4% / -0.6%-2.2% / -4%Even / -0.6%-1% / -3.8%
HVCI Single/Multi-threaded-0.4% / -0.6% -2.4% / -4.1%Even / -0.8%-0.5% / -3.2%

Decreases in gaming performance tend to grab all the attention, but the impact on desktop PC applications is arguably more important, as productivity-focused devices are the most likely to see these security features fully enabled by default. We'll provide a brief rundown here, but there are plenty of benchmarks to chew over below if you're looking for more fine-grained details of the impact in specific types of work.

The geometric mean of desktop PC application benchmarks (listed in the chart) gives us a good overall measure of the impact to single- and multi-threaded performance. Here we can see that the 11700K's single-threaded performance is largely unaffected by VBS/HVCI, while the Core i7-10700K loses 2.2%.

The Core i7-11700K takes a ~1% haircut in threaded work, while the 10700K loses a more appreciable 4%. However, this average value doesn't include all of the benchmarks below, so you should thumb through the album to see other differences.

We recorded a fairly large 14% reduction in the Corona benchmark for the 10700K in this series of tests, but that threaded workload isn't included in our geometric mean in the prior section. We also saw a ~5% loss in the threaded POV-Ray and Cinebench tests, along with a 6% loss in the Blender classroom render. We also see a big drop for both processors in UL Benchmark's PCMark 10 application startup test.

Overall, it's clear that the security features impact the 10700K far more than the 11700K in both single- and multi-threaded applications. 

Windows 11: Security Impact on AMD Desktop PC Application Performance

The Ryzen 7 5800X's single-threaded performance is largely unaffected by VBS/HVCI, while the 3800X loses a mere 1%. That means the difference probably isn't noticeable in most single-threaded work.

The Ryzen 7 5800X takes a ~1% haircut in threaded work, while the 3800X takes a more noticeable 3.2% to 3.8% loss. Again, this average measurement doesn't include all of the benchmarks in the album below. 

Wrapping Up

Microsoft's decision to leave millions of older systems off the Windows 11 upgrade list has earned plenty of criticism, and much of that decision hinged on the performance impact of these types of security features. As a byproduct of targeted hardware-level optimizations, like MBEC, newer chips can handle these types of security measures without as much of a performance loss.

However, our tests show that you will still see an impact in both gaming and application performance due to the heightened security, and that's even with the newer chips. Now, the performance hit we've seen surely isn't as profound as the ~28% numbers we've seen bandied about, but losing 5% of your gaming performance isn't acceptable if you don't need the added security — especially when that represents a full CPU generation's worth of performance improvement.

Luckily, these measures aren't employed by default with clean installs or upgrades. Instead, they'll only be in effect with newer systems purchased directly from OEMs, and savvy users can simply switch the feature off with a minimum of fuss.

We know that HVCI is specifically not recommended for gaming machines, but we're still digging for more information on Microsoft's policy for VBS enablement. Our tests show that the impact of enabling HVCI is roughly the equivalent of simply enabling VBS, at least with newer processors. We'll update as we learn more. 

MORE: Best CPUs for Gaming

MORE: CPU Benchmarks Hierarchy

MORE: AMD vs Intel

Swipe to scroll horizontally
Windows 11 Gaming and Application Benchmarks - Test System Configurations
Intel Socket 1200 (Z590)Core i7-11700K, Core i7-10700K
Row 1 - Cell 0 MSI MEG Z490 Godlike
Row 2 - Cell 0 2x 8GB Trident Z Royal DDR4-3600 - 10th-Gen:DDR4-2933 - 11th-Gen: Gear 1, DDR4-2933
AMD Socket AM4 (X570)AMD Ryzen 7 5800X, Ryzen 7 3800X
Row 4 - Cell 0 ASRock X570 Taichi
Row 5 - Cell 0 2x 8GB Trident Z Royal DDR4-3600
All SystemsGigabyte GeForce RTX 3090 Eagle - Gaming and ProViz applications
Row 7 - Cell 0 Nvidia GeForce RTX 2080 Ti FE - Application tests
Row 8 - Cell 0 2TB Intel DC4510 SSD
Row 9 - Cell 0 EVGA Supernova 1600 T2, 1600W
Row 10 - Cell 0 Open Benchtable
Row 11 - Cell 0 Windows 10 Pro version 22000.194
CoolingCorsair H115i
Paul Alcorn
Managing Editor: News and Emerging Tech

Paul Alcorn is the Managing Editor: News and Emerging Tech for Tom's Hardware US. He also writes news and reviews on CPUs, storage, and enterprise hardware.

  • NightHawkRMX
    Interesting article. ~5% for games isn't very significant to me, however if I were someone using an application like corona often I would definitely make sure these features are disabled. Overall I'm not bothered by these features being enabled since they are able to be disabled, unlike a lot of the other requirements for Windows 11.

    Some things that I would have liked to see included would have been a comparison to Windows 10. Additionally, as I fear a lower end CPU might not fair quite as well with these features enabled, a test on weaker hardware would also have been a nice inclusion.

    There are plenty of lower end CPUs capable of running Windows 11, after all.
    Reply
  • USAFRet
    NightHawkRMX said:
    Additionally, as I fear a power end CPU might not fair quite as well
    Did you mean "lower end"?
    Reply
  • wifiburger
    *edit
    if I understand correctly, in settings / device security

    VBS is core isolation
    HVCI is memory integrity
    ?
    Reply
  • NightHawkRMX
    USAFRet said:
    Did you mean "lower end"?
    Edited
    Reply
  • PapaCrazy
    It would be nice if these features could become dynamic, turning themselves off when DirectX, Direct3D or OpenGL APIs are triggered, and then turning back on again for productivity or web browsing.
    Reply
  • korekan
    up to 15% on i7 how about i3? will it be up to 30%? or even better atom?
    Reply
  • bolski
    I've definitely seen the effects of it when enabled. I've also done various benchmarking across Unigen Heaven, CPU-Z and Cinebench and there is definitely a decrease in the performance. Also, Doom Eternal runs smooth for me on Ultra, but when I enable VBS (just by enabling the Virtual Machine Platform feature) Doom Eternal starts hitching no matter what detail setting I set it at and it's pretty persistent (about every 30 seconds or so) no matter what I'm doing. Once I remove the Virtual Machine Platform feature, my performance returns.

    But with Cinebench I saw about a 3% decrease in performance. Unigen didn't show much difference. (0.78%). CPU-Z had a 2.37% difference.

    So I would say overall, I saw a small decrease in speed on my AMD Ryzen 5 360 and GTX 1660, but it wasn't until I tried to play games that ran smooth with no VBS enabled that I saw the effects in performance. Even though my FPS stayed at 60, the hitching in games, like Doom Eternal, were evident. Trying to turn v-sync from on, to triple buffer to off didn't fix the hitching. And once I turned Virtual Machine Platform off, the problem went away.

    Also, going to Settings->Privacy & Security->Windows Security->Device Security->Core isolation, I saw that Memory integrity was already off so I couldn't turn it off completely. But going into the System Information->System Summary section, it shows the VBS is enabled.

    So overall, it definitely can affect people but how much it affects people may depend on their hardware. For me, I could definitely see the effects on many games. Others not so much.
    Reply
  • PiranhaTech
    289 FPS vs 301 FPS? 96 vs 103 FPS? This doesn't look that bad. I'm not sure if we'll notice it that much. Considering how invasive game DRM can be, I might prefer the extra security features. Now, if it were something like 96 FPS vs 120 FPS, I'd be saying something different.

    It's still a good service to everyone to benchmark, track, and report on. I would like to see things like frame rate consistency, and systems that are under 60 FPS benchmarked.

    bolski said:
    enabling the Virtual Machine Platform feature) Doom Eternal starts hitching no matter what detail setting I set it at and it's pretty persistent (about every 30 seconds or so) no matter what I'm doing. Once I remove the Virtual Machine Platform feature, my performance returns.

    This is exactly what I want to hear about.
    Reply
  • bolski
    PiranhaTech said:
    289 FPS vs 301 FPS? 96 vs 103 FPS? This doesn't look that bad. I'm not sure if we'll notice it that much. Considering how invasive game DRM can be, I might prefer the extra security features. Now, if it were something like 96 FPS vs 120 FPS, I'd be saying something different.

    It's still a good service to everyone to benchmark, track, and report on. I would like to see things like frame rate consistency, and systems that are under 60 FPS benchmarked.



    This is exactly what I want to hear about.

    Correct. It's not that much, but what the article was stating was that a 5% decrease in overall performance, at least in the CPU, is a equal to a whole generation step back. That 5% loss in performance means you are using your current CPU as if it was an entire generation back. Is it really worth it if you don't need VBS? That's the entire point.

    For me, I want to use WSL 2 over WSL 1. I've done some more tweaks on my system with VBS enabled and I was able to get the hitching almost completely gone now. Basically, turned off some more background apps that were starting up. I'm also going to try and completely wipe my video card driver and install the latest version fresh and clean because I have installed the updates on-top of the previous version for over a year now, so that could possibly also be causing my issues as well.

    UPDATE (10/12/2021):
    Well, I've been switch back and forth between enabling the VMP feature and disabling it and every time I turn it on, Doom Eternal hitches like crazy. What I started to see though was after switch it off, DE would still hitch, but just not as bad, whereas before with no VMP, it was running just fine. I then forgot that I had the game installed on a mechanical hard drive.

    I defragged it, etc but nothing fixed the hitching. Not sure why VMP would cause the hitching AFTER turning it off. I could see possibly why VMP would cause it because of the extra layer possibly it provides even though Hyper-V is not installed nor enabled?

    In any case, I had to clear off space on my SSD drive (it's only a 250GB but I'm getting ready to fill my empty m.2ee slot with a 1TB Nvme drive hopefully soon that I'll install all my games on), but now the hitching has disappeared, both with and without VMP on. Again, this is without Hyper-V.

    So with my original test, I forgot that Doom Eternal was on a mechanical hard drive as opposed to an SSD. But still, this might still be some proof that if you have a mechanical hard drive, VMP can more than likely affect the performance there. I'm just not sure if VMP is actually causing it or something else? Really hard to determine. It doesn't appear to affect it if I'm on an SSD. Also, my HDD is about 10 years old but hasn't been exhibiting any signs of failure (no clicking noises, etc and health shows it's 100% good but you never know). There does seem to be other games that run fine with VMP enabled and I'm not sure if it's due to Vulcan that could be causing the issues with DE on the HDD with VMP enabled?
    Reply
  • jasonkaler
    I think windows should have "game mode" where all non-essential services and functions are disabled.
    I don't need virtual machine security features if I'm not running any virtual machines at that time
    Nor do I need windows update, or telemetry or about 100 other things while gaming
    Reply