Securely and efficiently providing user notifications about security actions

A computing device comprising:

• an output device;
• a processor;
• and
• memory storing computer-executable instructions that, when executed by the processor, cause the processor to:
• execute a software security agent in kernel mode of the computing device to:
• perform a security action with respect to a malicious data object or a malicious activity detected on the computing device;
• and
• provide a token to one or more user mode components, the token associated with a user session in which the malicious data object or the malicious activity was detected;
• execute the one or more user mode components to receive, based at least in part on the token, a pointer to one or more Component Object Model (COM) interfaces;
• and
• output a notification via the output device and using the pointer to the one or more COM interfaces, the notification indicating that the security action was performed.

A non-transitory computer-readable medium storing computer-executable instructions that, when executed by one or more processors of a computing device, cause the computing device to:

• execute a software security agent in kernel mode of the computing device to:
• perform a security action with respect to a malicious data object or a malicious activity detected on the computing device;
• and
• provide a token to one or more user mode components, the token associated with a user session in which the malicious data object or the malicious activity was detected;
• execute the one or more user mode components to receive, based at least in part on the token, a pointer to one or more Component Object Model (COM) interfaces;
• and
• output a notification via an output device of the computing device and using the pointer to the one or more COM interfaces, the notification indicating that the security action was performed.