Getting a kernel driver through Microsoft certification as a bootstrapped startup

Part of the Kernel-Native Kubernetes Security series. Friday's post explained why Nyx's Windows enforcement runs as a Windows Filtering Platform callout driver in the kernel. This one is about what it took to make that driver legitimate — the certification gauntlet Microsoft requires before a production Windows Server kernel will load your code. It's a story about walls, and about the tool we built and open-sourced when we hit the last one.