The built-in Windows security features you should be using 

This blog outlines five native Windows defenses—Virtual Secure Mode, Credential Guard, Secure Boot, UEFI, and IOMMU—explaining how they isolate credentials, harden boot integrity, and protect memory to reduce credential theft and boot-level malware risks, and provides concise steps to check and enable them via System Information, Group Policy/Intune, and firmware settings to strengthen endpoint resilience.