HP Sure Start detected an unauthorized intrusion to the HP runtime system firmware [520]

[--15]

Resurrecting this thread: Message Warning Sure Start Recovery - HP Support Community - 7924980

Problem: after imaging my HP ZBook Fury with our company Window 10 Build, BIOS 1.0.9.11 throws the following error at boot: "HP Sure Start detected an unauthorized intrusion to the HP runtime system firmware executing out of main memory. For more information please visit https://www.hp.com/go/techcenter/startup [520]"

The tech center explanation is

Sure Start RTID (520)

An HP Sure Start Runtime Intrusion detection event was detected. The most common cause of the error is a security issue (such as a hacking attempt). This could indicate a defective memory module. If the issue persists, update the BIOS, and then contact your IT helpdesk or HP Support.

Troubleshooting steps so far that have all failed:

• Verified ZBook Fury is on the latest firmware update.
• Rolled back to previous firmware updates, rolled forward again to latest version.
• Reset BIOS to factory defaults.
• Reset BIOS to custom defaults.
• Following the previous thread, uninstalled the driver and driver package for "Synaptics SMBus Driver" via Device Manager. (The device exited twice: an installed device, a hidden device.)
• Uninstalled anything Synaptics related via Device Manager, including hidden devices.
• Installed all of HP's security software.
• Installed Windows 10 from installation media, not an image.

Interesting notes:

• This issue does not happen on our ZBook Studio 15.6 laptops, with the latest firmware and same BIOS settings.
• This issue only happens to our ZBook Fury laptops purchased after May. Previous purchases of this same model (so far) do not exhibit this security warning behavior.
• When I disable Enhanced HP Firmware Runtime Intrusion Prevention and Detection, the BIOS warning goes away. However, like others have experienced, performing an ACPI shutdown results in the OS shutting down, but the hardware stays powered on, occasionally triggering the fans.

I need to troubleshoot further, but to do that, I need to understand more about HP's security.

1. What does HP's BIOS security consider an intrusion? The white paper is not very specific about the conditions that trigger this BIOS warning.
2. Is the shutdown bug an actual bug, or is this intended behavior when a security feature is disabled?
3. Is HP's security software required to be installed, or is this intrusion feature BIOS-managed only?