A system comprising: one or more processors; and memory storing: an operating system kernel configured to be operated by the one or more processors to invoke a security callback function in response to execution of a process on the system; a serviceable kernel-mode component configured such that its code can be easily modified; an unserviceable kernel-mode component configured such that its code cannot be easily modified; and computer-executable instructions, wherein: the unserviceable kernel-mode component is configured to be operated by the one or more processors to: hook the security callback function so that the security callback function points to the unserviceable kernel-mode component in a first level of indirection; and forward a security callback query received from the OS kernel to the serviceable kernel-mode component in a second level of indirection; the serviceable kernel-mode component is configured to be operated by the one or more processors to: receive the security callback query forwarded from the unserviceable kernel-mode component; and return a response to the security callback query indicating whether the execution of the process is permitted to continue; and the computer-executable instructions, when executed by the one or more processors, cause the system to install a software upgrade to upgrade the serviceable kernel-mode component. one or more processors; and memory storing: an operating system kernel configured to be operated by the one or more processors to invoke a security callback function in response to execution of a process on the system; a serviceable kernel-mode component configured such that its code can be easily modified; an unserviceable kernel-mode component configured such that its code cannot be easily modified; and computer-executable instructions, an operating system kernel configured to be operated by the one or more processors to invoke a security callback function in response to execution of a process on the system; a serviceable kernel-mode component configured such that its code can be easily modified; an unserviceable kernel-mode component configured such that its code cannot be easily modified; and computer-executable instructions, wherein: the unserviceable kernel-mode component is configured to be operated by the one or more processors to: hook the security callback function so that the security callback function points to the unserviceable kernel-mode component in a first level of indirection; and forward a security callback query received from the OS kernel to the serviceable kernel-mode component in a second level of indirection; the serviceable kernel-mode component is configured to be operated by the one or more processors to: receive the security callback query forwarded from the unserviceable kernel-mode component; and return a response to the security callback query indicating whether the execution of the process is permitted to continue; and the computer-executable instructions, when executed by the one or more processors, cause the system to install a software upgrade to upgrade the serviceable kernel-mode component. the unserviceable kernel-mode component is configured to be operated by the one or more processors to: hook the security callback function so that the security callback function points to the unserviceable kernel-mode component in a first level of indirection; and forward a security callback query received from the OS kernel to the serviceable kernel-mode component in a second level of indirection; hook the security callback function so that the security callback function points to the unserviceable kernel-mode component in a first level of indirection; and forward a security callback query received from the OS kernel to the serviceable kernel-mode component in a second level of indirection; the serviceable kernel-mode component is configured to be operated by the one or more processors to: receive the security callback query forwarded from the unserviceable kernel-mode component; and return a response to the security callback query indicating whether the execution of the process is permitted to continue; and receive the security callback query forwarded from the unserviceable kernel-mode component; and return a response to the security callback query indicating whether the execution of the process is permitted to continue; and the computer-executable instructions, when executed by the one or more processors, cause the system to install a software upgrade to upgrade the serviceable kernel-mode component.