---
# source: src/content/solutions/en/endpoint-security.md
# route:  /en/solutions/endpoint-security/
title: Endpoint Security
tags: [endpoint-security, security]
vendors: [crowdstrike, microsoft, halcyon]
summary: Devices left the company network faster than they were secured. Two EDR products cover this, plus one layer against ransomware alone.
photoNeed: A security console on screen with real alerts in it, being triaged
stub: false
draft: false
kind: vendor
addon: false
status: current
---

## Attacks through permitted tools

Devices left the company network, and not everywhere was securing them thought through
first. Most attacks now use techniques like lateral movement and island hopping: they do
damage through tools that are already permitted on the machine. A scanner comparing files
against a list sees none of it.

## What these products do differently

CrowdStrike Falcon and Microsoft Defender read system events to learn what normal activity
looks like in an estate. What stands out is then a sequence that does not fit, such as an
Office document starting PowerShell.

Much of the value is in the recording. After an incident you can use it to reconstruct
what happened.

Halcyon stands beside them and fights ransomware alone. It adds the layer that intercepts
encryption and takes the leverage out of extortion.

## Licensing and responsibility

Which of the two EDR products fits is usually settled by existing licensing. EDR needs a
team assigned to it.