# Why does protecting identity data require kernel-level access?

**Short answer:** Because the theft happens in the space between a program requesting credential data and the operating system delivering it. Only a defense operating at the kernel — below the applications and libraries an attacker can manipulate — can see that request, judge its intent, and stop it in time.

## The three requirements

**1. See the access as it happens.** Identity theft isn't a file appearing on disk; it's a read. Tools scanning for malicious files see nothing, because in a modern infostealer nothing is written. The event to catch is the access attempt itself.

**2. Decide fast enough.** Automated tooling can infiltrate, collect, and self-delete within seconds. Any architecture that ships telemetry to a cloud service and waits for a verdict has already lost the race. The decision has to happen locally, in milliseconds.

**3. Not depend on what the attacker controls.** Security tools that rely on operating system libraries can be blinded when an attacker compromises those libraries in memory — the agent keeps running and reports nothing. Cyber Crucible was deliberately decoupled from Windows libraries so a compromised OS cannot silence it.

## The consequence

Kernel-level operation is what allows all three at once: visibility into the access attempt, a sub-200-millisecond local decision, and independence from a potentially compromised operating system.

It's also why the protection works with no connectivity — air-gapped, offline, or at sea — since nothing has to leave the device for a decision to be made.