Endpoint Security is a user framework, that's the point. You can write a driver in macOS. You have to write a driver for Windows, there is literally no other solution for real-time protection.