The Proofpoint endpoint agent runs in user mode, leveraging standard Windows and macOS. Applications running in user mode are isolated. This means that they cannot modify or damage critical operating system (OS) data. If an application crashes while in this mode, the OS remains unaffected.