A method of creating a protected software program operates upon an executable program that has a number of sections. The sections include an entry section and any number of user sections. An ability set for the executable program is defined that describes allowed behaviors of said executable program and behaviors that are not allowed. The ability set is inserted into the executable program as an ability section. A vaccine code section is inserted into the executable program; the vaccine code section is arranged to monitor behaviors of said executable program for comparison with the allowed and not allowed behaviors of the ability section. A hash value is calculated for the executable program; the hash value is stored in the program itself or in another secure location.