Technology 04 · Halcyon · Anti-ransomware
Ransomware: block encryption, recover without paying
Ransomware has become an organised industry: attackers disable the EDR, steal data before encrypting it and move ever faster. Halcyon adds a dedicated layer, independent of the EDR, that stops the attack and captures the encryption keys to restore data without paying a ransom.
AI-powered attacks, AI-powered defence
An attack run at AI speed leaves no time for human analysis
When an attack plays out in a few dozen minutes, a defence that waits for an analyst's approval comes too late. Protection has to recognise the early signs of ransomware and act on its own, at machine speed, with an expert team in support.
78%Of security leaders believe AI mainly helps attackers; 6% that it truly helps defenders
Halcyon · Method Survey 2026
25%Only trust their EDR to stop ransomware, while 98% use one
Halcyon · Method Survey 2026
77%Of ransomware intrusions in 2024 included data theft
Google · M-Trends
2025
What AI changes on the attacker side
- Automated attack chains, from initial access to encryption
- “EDR killer” tools that exploit vulnerable signed drivers (BYOVD) to blind protection
- Hijacked legitimate tools, targeted hypervisors and double extortion as the norm
How AI strengthens defence
- An AI engine trained exclusively on ransomware: real tactics, live samples, attacker scenarios, more accurate than a general‑purpose model
- Behavioural detection of early signs: reconnaissance, credential targeting, backup discovery, shadow copy deletion
- Autonomous protections that block and capture keys at machine speed
- A dedicated 24/7 operations centre whose findings feed the models in near real time
FEATURES
Prevent, contain, recover
Prevention
- Known threats blocked before execution
- Malicious processes and hijacked legitimate tools stopped
- Protection against bypass through vulnerable drivers
EDR resilience
- Independent kernel layer, active even if the EDR is disabled
- Monitoring of EDR tampering attempts
- Deployed alongside the existing EDR and backups, as a complement
Anti-exfiltration
- Detection of connections to risky destinations
- Monitoring of outbound volumes per process
- Comparison with the normal behaviour of each endpoint
Key capture
- Encryption keys intercepted the moment they are generated
- Works even if detection has failed
- Local files, network shares and OneDrive
Decryption and recovery
- Decryptor built from the captured keys
- Recovery in hours rather than weeks
- With zero ransom paid, whatever the state of the backups
Coverage
- Windows and Linux endpoints and servers
- Endpoint isolation and blocking of command‑and‑control traffic
- Protection extended to the whole estate as soon as a threat is identified
HOW IT WORKS
From alert to recovery
- CollectThe agent reports events from endpoints and servers
- AnalyseAI and behavioural engines qualify and prioritise
- BlockAttack stopped, isolation, capture of encryption keys
- Restore24/7 investigation, attacker eviction, decryption and guided remediation
HOW WE SUPPORT YOU
An anti-ransomware layer integrated into the existing defence
Set‑up
- Scoping with the teams and the existing EDR
- Agent deployment on endpoints and servers
- Configuration of blocking policies
Operations
- Coordination with the 24/7 ransomware operations centre
- Alert follow‑up and guided remediation
- Regular reports
Orchestration
- Signals shared with Identity Guard
- Isolation of the compromised identity and endpoint
- Gradual return to normal after an incident