Data Execution Prevention (DEP): What it is, why it matters, and how it protects Windows

Data Execution Prevention

What it is

Data Execution Prevention (DEP) is a Windows safety net that stops code from running in places it shouldn’t—like the stack or heap. If malware tries to execute from those memory areas, Windows blocks it and shuts the app down instead of your system getting owned.

Why it matters

A lot of exploits work by tricking programs into running code from data-only memory. DEP makes that trick much harder, turning many one-click compromises into harmless crashes.

How it works 

  • Windows marks certain memory regions as no-execute.

  • Legit code runs from approved regions; data stays data.

  • If something tries to execute from a data region, Windows stops it and logs the event.

What you might see

  • An app closes with a message about DEP or just crashes once when an exploit is blocked.

  • Event Viewer shows an application error referencing DEP.

Check or adjust it (Windows)

  • DEP is on by default for essential Windows programs and services.

  • To review settings: Control Panel → System → Advanced system settings → Performance (Settings) → Data Execution Prevention.

  • Only make exceptions if you absolutely must—and prefer updating or replacing the app instead.

Tips for admins/devs

  • Keep apps and runtimes updated so they play well with DEP.

  • Pair DEP with ASLR, CFG, and modern compilers for layered defense.

  • Avoid adding global exceptions; fix the root cause or sandbox legacy apps.

    Glossary (A–Z)

    All A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

      • Related Articles

      • Data Exfiltration

        What it is Data exfiltration is the unauthorized transfer of your data out of your device or network—quietly slipping customer records, passwords, designs, or finances to an attacker. It’s the punchline of many breaches: get in, get data out, cash ...

      • Data Breach Prevention

        Why it matters Breaches drain money, trust, and time. Strong basics turn scary “what ifs” into non-events: a phish gets ignored, a stolen password is useless, a lost laptop holds only encrypted gibberish. The short, smart checklist MFA everywhere: ...

      • Code Injection

        What it is Code injection (often leading to remote code execution) is when attackers feed a program the kind of input it never expected—so it runs the attacker’s code instead of safe instructions. That “code” can be a script or DLL dropped after the ...

      • Data Breach

        What it is A data breach is when someone gets into a company’s systems without permission and steals sensitive info—customer names, emails, passwords, payment details, medical records, and more. For overview: see our data breach guide How it happens ...

      • EDR (Endpoint Detection and Response)

        What it is EDR is your always-on security team for laptops and servers. It watches what’s happening on each device, spots attacks in progress, and helps you respond fast - quarantine, investigate, and clean up. For details on capabilities and use ...