Windows Safe Mode is a way to start Windows in a basic state, using a limited set of files and drivers.
Please note, that Safe Mode in Windows enable to start the OS with very limited set of loaded drives:
It can help you troubleshoot problems on your PC by narrowing down the source of a problem
There are two versions of safe mode: Safe Mode and Safe Mode with Networking.
Safe Mode with Networking adds the network drivers and services you’ll need to access the internet and other computers on your network
In Safe Mode, Windows starts with a minimal set of drivers and services, so it’s possible that third-party antivirus software may not run in Safe Mode
The way Safe Mode works is Windows disables all extra services when you start it. Safe mode is a troubleshooting and diagnostic mode and should only be used on a limited basis. For more info on this topic please see the introduction of this article from MS Tech Net: https://social.technet.microsoft.com/wiki/contents/articles/32982.windows-10-safe-mode.aspx
AMP does not run in Safe Mode because Windows disables it. I just tested this configuration in my Lab Windows 10 machine and it will not let me start the service.
Windows will not load the 3rd party software then, including Cisco Secure Endpoint (Formerly AMP).
-----------------------------------------
If you find my reply solved your question or issue, kindly click the 'Accept as Solution' button and vote it as helpful.
You can also learn more about Secure Endpoint through our live Ask the Experts (ATXs) session. Check out Cisco Endpoint Security ATXs Resources [https://community.cisco.com/t5/security-knowledge-base/cisco-endpoint-security-ask-the-experts-resources/ta-p/4394492] to view the latest schedule for upcoming sessions, as well as the useful references, e.g. online guides, FAQs.
