DE · EN

Call us

build 6ddc7a35 | content blog-content@417154f · 338 posts | profiles 32 · corpus 315 | ● 0 skipped | built 2026-10-21 12:35 UTC format run

$ soultec get solution/endpoint-security/halcyon-anti-ransomware -o yaml$ soultec get solution/endpoint-security/halcyon-anti-ransomware -o json$ soultec get solution/endpoint-security/halcyon-anti-ransomware -o toml$ soultec get solution/endpoint-security/halcyon-anti-ransomware -o xml$ python3 endpoint-security/halcyon-anti-ransomware.pyPS> ./endpoint-security/halcyon-anti-ransomware.ps1$ go run endpoint-security/halcyon-anti-ransomware.go$ node endpoint-security/halcyon-anti-ransomware.js

apiVersion: soultec.ch/v1kind: Solutionmetadata: name: endpoint-security/halcyon-anti-ransomware locale: en labels: vendor: Halcyon Anti-Ransomware Platform capability/endpoint-security: 2.73 capability/security: 1.91 capability/backup-recovery: 2.14 vendor/halcyon: 5.07 annotations: source: src/content/solutions/en/endpoint-security/halcyon-anti-ransomware.md route: /en/solutions/endpoint-security/halcyon-anti-ransomware/ schema: /nerd/schema/solutions.json markdown: /en/solutions/endpoint-security/halcyon-anti-ransomware.mdspec: title: Halcyon Anti-Ransomware tags: [endpoint-security, security, backup-recovery] vendors: [halcyon] summary: >- A platform against exactly one class of attack: ransomware. It runs beside the EDR, captures key material, and takes the leverage out of extortion. photoNeed: A security console on screen with real alerts in it, being triaged stub: false draft: false kind: product addon: false vendorName: Halcyon Anti-Ransomware Platform status: current practice: >- We sell and implement Halcyon. With us it complements the EDR; it does not replace it. practiceReview: false sections: - heading:

What it is

body: | Halcyon is a platform against exactly one class of attack: ransomware. The vendor's argument is that ransomware is its own category, with sequences an EDR was never tuned for, and it calls its product the first defence dedicated to it. The agent runs beside the existing EDR. - heading:

How it works

body: | It watches for ransomware-typical behaviour across the stages of an attack. If encryption starts anyway, the platform captures the key material, which is what lets encrypted data be restored within hours. Added to that are protection against data exfiltration, meaning the extortion built on stolen data, and a guard for the EDR itself, so an attacker cannot simply switch it off. Behind the product sits the vendor's Ransomware Operations Center: detection, response and recovery, around the clock and included in the price. - heading:

What to watch

body: | Halcyon replaces neither the EDR nor the backup. The three layers answer different questions: the EDR spots the attacker, Halcyon keeps an incident from becoming extortion, and the backup remains the last line of defence.status: corpus: 315 services: - {ref: services/managed-security, score: 0.42} - {ref: services/modern-workplace, score: 0.38} - {ref: services/security, score: 0.35} - {ref: services/academy, score: 0.29} neighbours: - {ref: solutions/endpoint-security, relation: parent} - {ref: solutions/igel/addon/90meter, score: 0.48} - {ref: solutions/endpoint-security/crowdstrike-falcon, score: 0.48} search: /en/search.json

{ "apiVersion": "soultec.ch/v1", "kind": "Solution", "metadata": { "name": "endpoint-security/halcyon-anti-ransomware", "locale": "en", "labels": { "vendor": "Halcyon Anti-Ransomware Platform", "capability/endpoint-security": 2.73, "capability/security": 1.91, "capability/backup-recovery": 2.14, "vendor/halcyon": 5.07 }, "annotations": { "source": "src/content/solutions/en/endpoint-security/halcyon-anti-ransomware.md", "route": "/en/solutions/endpoint-security/halcyon-anti-ransomware/", "schema": "/nerd/schema/solutions.json", "markdown": "/en/solutions/endpoint-security/halcyon-anti-ransomware.md" } }, "spec": { "title": "Halcyon Anti-Ransomware", "tags": [ "endpoint-security", "security", "backup-recovery" ], "vendors": [ "halcyon" ], "summary": "A platform against exactly one class of attack: ransomware. It runs beside the EDR, captures key material, and takes the leverage out of extortion.", "photoNeed": "A security console on screen with real alerts in it, being triaged", "stub": false, "draft": false, "kind": "product", "addon": false, "vendorName": "Halcyon Anti-Ransomware Platform", "status": "current", "practice": "We sell and implement Halcyon. With us it complements the EDR; it does not replace it.\n", "practiceReview": false, "sections": [ { "heading": "

What it is

", "body": "Halcyon is a platform against exactly one class of attack: ransomware. The vendor's\nargument is that ransomware is its own category, with sequences an EDR was never tuned\nfor, and it calls its product the first defence dedicated to it. The agent runs beside\nthe existing EDR." }, { "heading": "

How it works

", "body": "It watches for ransomware-typical behaviour across the stages of an attack. If\nencryption starts anyway, the platform captures the key material, which is what lets\nencrypted data be restored within hours. Added to that are protection against data\nexfiltration, meaning the extortion built on stolen data, and a guard for the EDR\nitself, so an attacker cannot simply switch it off.\n\nBehind the product sits the vendor's Ransomware Operations Center: detection, response\nand recovery, around the clock and included in the price." }, { "heading": "

What to watch

", "body": "Halcyon replaces neither the EDR nor the backup. The three layers answer different\nquestions: the EDR spots the attacker, Halcyon keeps an incident from becoming\nextortion, and the backup remains the last line of defence." } ] }, "status": { "corpus": 315, "services": [ { "ref": "services/managed-security", "score": "0.42" }, { "ref": "services/modern-workplace", "score": "0.38" }, { "ref": "services/security", "score": "0.35" }, { "ref": "services/academy", "score": "0.29" } ], "neighbours": [ { "ref": "solutions/endpoint-security", "relation": "parent" }, { "ref": "solutions/igel/addon/90meter", "score": "0.48" }, { "ref": "solutions/endpoint-security/crowdstrike-falcon", "score": "0.48" } ], "search": "/en/search.json" }}

apiVersion = "soultec.ch/v1"kind = "Solution"[metadata]name = "endpoint-security/halcyon-anti-ransomware"locale = "en"[metadata.labels]vendor = "Halcyon Anti-Ransomware Platform""capability/endpoint-security" = 2.73"capability/security" = 1.91"capability/backup-recovery" = 2.14"vendor/halcyon" = 5.07[metadata.annotations]source = "src/content/solutions/en/endpoint-security/halcyon-anti-ransomware.md"route = "/en/solutions/endpoint-security/halcyon-anti-ransomware/"schema = "/nerd/schema/solutions.json"markdown = "/en/solutions/endpoint-security/halcyon-anti-ransomware.md"[spec]title = "Halcyon Anti-Ransomware"tags = ["endpoint-security", "security", "backup-recovery"]vendors = ["halcyon"]summary = "A platform against exactly one class of attack: ransomware. It runs beside the EDR, captures key material, and takes the leverage out of extortion."photoNeed = "A security console on screen with real alerts in it, being triaged"stub = falsedraft = falsekind = "product"addon = falsevendorName = "Halcyon Anti-Ransomware Platform"status = "current"practice = '''We sell and implement Halcyon. With us it complements the EDR; it does not replace it.'''practiceReview = false[[spec.sections]]heading = "

What it is

"body = '''Halcyon is a platform against exactly one class of attack: ransomware. The vendor'sargument is that ransomware is its own category, with sequences an EDR was never tunedfor, and it calls its product the first defence dedicated to it. The agent runs besidethe existing EDR.'''[[spec.sections]]heading = "

How it works

"body = '''It watches for ransomware-typical behaviour across the stages of an attack. Ifencryption starts anyway, the platform captures the key material, which is what letsencrypted data be restored within hours. Added to that are protection against dataexfiltration, meaning the extortion built on stolen data, and a guard for the EDRitself, so an attacker cannot simply switch it off.Behind the product sits the vendor's Ransomware Operations Center: detection, responseand recovery, around the clock and included in the price.'''[[spec.sections]]heading = "

What to watch

"body = '''Halcyon replaces neither the EDR nor the backup. The three layers answer differentquestions: the EDR spots the attacker, Halcyon keeps an incident from becomingextortion, and the backup remains the last line of defence.'''[status]corpus = 315search = "/en/search.json"[[status.services]]ref = "services/managed-security"score = "0.42"[[status.services]]ref = "services/modern-workplace"score = "0.38"[[status.services]]ref = "services/security"score = "0.35"[[status.services]]ref = "services/academy"score = "0.29"[[status.neighbours]]ref = "solutions/endpoint-security"relation = "parent"[[status.neighbours]]ref = "solutions/igel/addon/90meter"score = "0.48"[[status.neighbours]]ref = "solutions/endpoint-security/crowdstrike-falcon"score = "0.48"

<?xml version="1.0" encoding="UTF-8"?><manifest kind="Solution"> <apiVersion>soultec.ch/v1</apiVersion> <metadata> <name>endpoint-security/halcyon-anti-ransomware</name> <locale>en</locale> <labels> <vendor>Halcyon Anti-Ransomware Platform</vendor> <entry key="capability/endpoint-security">2.73</entry> <entry key="capability/security">1.91</entry> <entry key="capability/backup-recovery">2.14</entry> <entry key="vendor/halcyon">5.07</entry> </labels> <annotations> <source>src/content/solutions/en/endpoint-security/halcyon-anti-ransomware.md</source> <route>/en/solutions/endpoint-security/halcyon-anti-ransomware/</route> <schema>/nerd/schema/solutions.json</schema> <markdown>/en/solutions/endpoint-security/halcyon-anti-ransomware.md</markdown> </annotations> </metadata> <spec> <title>Halcyon Anti-Ransomware</title> <tags> <item>endpoint-security</item> <item>security</item> <item>backup-recovery</item> </tags> <vendors> <item>halcyon</item> </vendors> <summary>A platform against exactly one class of attack: ransomware. It runs beside the EDR, captures key material, and takes the leverage out of extortion.</summary> <photoNeed>A security console on screen with real alerts in it, being triaged</photoNeed> <stub>false</stub> <draft>false</draft> <kind>product</kind> <addon>false</addon> <vendorName>Halcyon Anti-Ransomware Platform</vendorName> <status>current</status> <practice>We sell and implement Halcyon. With us it complements the EDR; it does not replace it. </practice> <practiceReview>false</practiceReview> <sections> <section> <heading>

What it is

</heading> <body>Halcyon is a platform against exactly one class of attack: ransomware. The vendor'sargument is that ransomware is its own category, with sequences an EDR was never tunedfor, and it calls its product the first defence dedicated to it. The agent runs besidethe existing EDR. </body> </section> <section> <heading>

How it works

</heading> <body>It watches for ransomware-typical behaviour across the stages of an attack. Ifencryption starts anyway, the platform captures the key material, which is what letsencrypted data be restored within hours. Added to that are protection against dataexfiltration, meaning the extortion built on stolen data, and a guard for the EDRitself, so an attacker cannot simply switch it off.Behind the product sits the vendor's Ransomware Operations Center: detection, responseand recovery, around the clock and included in the price. </body> </section> <section> <heading>

What to watch

</heading> <body>Halcyon replaces neither the EDR nor the backup. The three layers answer differentquestions: the EDR spots the attacker, Halcyon keeps an incident from becomingextortion, and the backup remains the last line of defence. </body> </section> </sections> </spec> <status> <corpus>315</corpus> <services> <item> <ref>services/managed-security</ref> <score>0.42</score> </item> <item> <ref>services/modern-workplace</ref> <score>0.38</score> </item> <item> <ref>services/security</ref> <score>0.35</score> </item> <item> <ref>services/academy</ref> <score>0.29</score> </item> </services> <neighbours> <item> <ref>solutions/endpoint-security</ref> <relation>parent</relation> </item> <item> <ref>solutions/igel/addon/90meter</ref> <score>0.48</score> </item> <item> <ref>solutions/endpoint-security/crowdstrike-falcon</ref> <score>0.48</score> </item> </neighbours> <search>/en/search.json</search> </status></manifest>

# Code generated by the soultec.ch build. DO NOT EDIT.import jsonPAGE = { "apiVersion": "soultec.ch/v1", "kind": "Solution", "metadata": { "name": "endpoint-security/halcyon-anti-ransomware", "locale": "en", "labels": { "vendor": "Halcyon Anti-Ransomware Platform", "capability/endpoint-security": 2.73, "capability/security": 1.91, "capability/backup-recovery": 2.14, "vendor/halcyon": 5.07, }, "annotations": { "source": "src/content/solutions/en/endpoint-security/halcyon-anti-ransomware.md", "route": "/en/solutions/endpoint-security/halcyon-anti-ransomware/", "schema": "/nerd/schema/solutions.json", "markdown": "/en/solutions/endpoint-security/halcyon-anti-ransomware.md", }, }, "spec": { "title": "Halcyon Anti-Ransomware", "tags": ["endpoint-security", "security", "backup-recovery"], "vendors": ["halcyon"], "summary": "A platform against exactly one class of attack: ransomware. It runs beside the EDR, captures key material, and takes the leverage out of extortion.", "photoNeed": "A security console on screen with real alerts in it, being triaged", "stub": False, "draft": False, "kind": "product", "addon": False, "vendorName": "Halcyon Anti-Ransomware Platform", "status": "current", "practice": ( "We sell and implement Halcyon. With us it complements the EDR; it does not replace it.\n" ), "practiceReview": False, "sections": [ { "heading": "

What it is

", "body": ( "Halcyon is a platform against exactly one class of attack: ransomware. The vendor's\n" "argument is that ransomware is its own category, with sequences an EDR was never tuned\n" "for, and it calls its product the first defence dedicated to it. The agent runs beside\n" "the existing EDR." ), }, { "heading": "

How it works

", "body": ( "It watches for ransomware-typical behaviour across the stages of an attack. If\n" "encryption starts anyway, the platform captures the key material, which is what lets\n" "encrypted data be restored within hours. Added to that are protection against data\n" "exfiltration, meaning the extortion built on stolen data, and a guard for the EDR\n" "itself, so an attacker cannot simply switch it off.\n" "\n" "Behind the product sits the vendor's Ransomware Operations Center: detection, response\n" "and recovery, around the clock and included in the price." ), }, { "heading": "

What to watch

", "body": ( "Halcyon replaces neither the EDR nor the backup. The three layers answer different\n" "questions: the EDR spots the attacker, Halcyon keeps an incident from becoming\n" "extortion, and the backup remains the last line of defence." ), }, ], }, "status": { "corpus": 315, "services": [ { "ref": "services/managed-security", "score": "0.42", }, { "ref": "services/modern-workplace", "score": "0.38", }, { "ref": "services/security", "score": "0.35", }, { "ref": "services/academy", "score": "0.29", }, ], "neighbours": [ { "ref": "solutions/endpoint-security", "relation": "parent", }, { "ref": "solutions/igel/addon/90meter", "score": "0.48", }, { "ref": "solutions/endpoint-security/crowdstrike-falcon", "score": "0.48", }, ], "search": "/en/search.json", },}if __name__ == "__main__": print(json.dumps(PAGE, indent=2, ensure_ascii=False))

# Code generated by the soultec.ch build. DO NOT EDIT.$Page = [ordered]@{ apiVersion = 'soultec.ch/v1' kind = 'Solution' metadata = [ordered]@{ name = 'endpoint-security/halcyon-anti-ransomware' locale = 'en' labels = [ordered]@{ vendor = 'Halcyon Anti-Ransomware Platform' 'capability/endpoint-security' = 2.73 'capability/security' = 1.91 'capability/backup-recovery' = 2.14 'vendor/halcyon' = 5.07 } annotations = [ordered]@{ source = 'src/content/solutions/en/endpoint-security/halcyon-anti-ransomware.md' route = '/en/solutions/endpoint-security/halcyon-anti-ransomware/' schema = '/nerd/schema/solutions.json' markdown = '/en/solutions/endpoint-security/halcyon-anti-ransomware.md' } } spec = [ordered]@{ title = 'Halcyon Anti-Ransomware' tags = @('endpoint-security', 'security', 'backup-recovery') vendors = @('halcyon') summary = 'A platform against exactly one class of attack: ransomware. It runs beside the EDR, captures key material, and takes the leverage out of extortion.' photoNeed = 'A security console on screen with real alerts in it, being triaged' stub = $false draft = $false kind = 'product' addon = $false vendorName = 'Halcyon Anti-Ransomware Platform' status = 'current' practice = @'We sell and implement Halcyon. With us it complements the EDR; it does not replace it.'@ practiceReview = $false sections = @( [ordered]@{ heading = '

What it is

' body = @'Halcyon is a platform against exactly one class of attack: ransomware. The vendor'sargument is that ransomware is its own category, with sequences an EDR was never tunedfor, and it calls its product the first defence dedicated to it. The agent runs besidethe existing EDR.'@ } [ordered]@{ heading = '

How it works

' body = @'It watches for ransomware-typical behaviour across the stages of an attack. Ifencryption starts anyway, the platform captures the key material, which is what letsencrypted data be restored within hours. Added to that are protection against dataexfiltration, meaning the extortion built on stolen data, and a guard for the EDRitself, so an attacker cannot simply switch it off.Behind the product sits the vendor's Ransomware Operations Center: detection, responseand recovery, around the clock and included in the price.'@ } [ordered]@{ heading = '

What to watch

' body = @'Halcyon replaces neither the EDR nor the backup. The three layers answer differentquestions: the EDR spots the attacker, Halcyon keeps an incident from becomingextortion, and the backup remains the last line of defence.'@ } ) } status = [ordered]@{ corpus = 315 services = @( [ordered]@{ ref = 'services/managed-security' score = '0.42' } [ordered]@{ ref = 'services/modern-workplace' score = '0.38' } [ordered]@{ ref = 'services/security' score = '0.35' } [ordered]@{ ref = 'services/academy' score = '0.29' } ) neighbours = @( [ordered]@{ ref = 'solutions/endpoint-security' relation = 'parent' } [ordered]@{ ref = 'solutions/igel/addon/90meter' score = '0.48' } [ordered]@{ ref = 'solutions/endpoint-security/crowdstrike-falcon' score = '0.48' } ) search = '/en/search.json' }}$Page | ConvertTo-Json -Depth 32

// Code generated by the soultec.ch build. DO NOT EDIT.package mainimport ( "encoding/json" "os")var page = map[string]any{ "apiVersion": "soultec.ch/v1", "kind": "Solution", "metadata": map[string]any{ "name": "endpoint-security/halcyon-anti-ransomware", "locale": "en", "labels": map[string]any{ "vendor": "Halcyon Anti-Ransomware Platform", "capability/endpoint-security": 2.73, "capability/security": 1.91, "capability/backup-recovery": 2.14, "vendor/halcyon": 5.07, }, "annotations": map[string]any{ "source": "src/content/solutions/en/endpoint-security/halcyon-anti-ransomware.md", "route": "/en/solutions/endpoint-security/halcyon-anti-ransomware/", "schema": "/nerd/schema/solutions.json", "markdown": "/en/solutions/endpoint-security/halcyon-anti-ransomware.md", }, }, "spec": map[string]any{ "title": "Halcyon Anti-Ransomware", "tags": []any{"endpoint-security", "security", "backup-recovery"}, "vendors": []any{"halcyon"}, "summary": "A platform against exactly one class of attack: ransomware. It runs beside the EDR, captures key material, and takes the leverage out of extortion.", "photoNeed": "A security console on screen with real alerts in it, being triaged", "stub": false, "draft": false, "kind": "product", "addon": false, "vendorName": "Halcyon Anti-Ransomware Platform", "status": "current", "practice": "We sell and implement Halcyon. With us it complements the EDR; it does not replace it.\n", "practiceReview": false, "sections": []any{ map[string]any{ "heading": "

What it is

", "body": "Halcyon is a platform against exactly one class of attack: ransomware. The vendor's\n" + "argument is that ransomware is its own category, with sequences an EDR was never tuned\n" + "for, and it calls its product the first defence dedicated to it. The agent runs beside\n" + "the existing EDR.", }, map[string]any{ "heading": "

How it works

", "body": "It watches for ransomware-typical behaviour across the stages of an attack. If\n" + "encryption starts anyway, the platform captures the key material, which is what lets\n" + "encrypted data be restored within hours. Added to that are protection against data\n" + "exfiltration, meaning the extortion built on stolen data, and a guard for the EDR\n" + "itself, so an attacker cannot simply switch it off.\n" + "\n" + "Behind the product sits the vendor's Ransomware Operations Center: detection, response\n" + "and recovery, around the clock and included in the price.", }, map[string]any{ "heading": "

What to watch

", "body": "Halcyon replaces neither the EDR nor the backup. The three layers answer different\n" + "questions: the EDR spots the attacker, Halcyon keeps an incident from becoming\n" + "extortion, and the backup remains the last line of defence.", }, }, }, "status": map[string]any{ "corpus": 315, "services": []any{ map[string]any{ "ref": "services/managed-security", "score": "0.42", }, map[string]any{ "ref": "services/modern-workplace", "score": "0.38", }, map[string]any{ "ref": "services/security", "score": "0.35", }, map[string]any{ "ref": "services/academy", "score": "0.29", }, }, "neighbours": []any{ map[string]any{ "ref": "solutions/endpoint-security", "relation": "parent", }, map[string]any{ "ref": "solutions/igel/addon/90meter", "score": "0.48", }, map[string]any{ "ref": "solutions/endpoint-security/crowdstrike-falcon", "score": "0.48", }, }, "search": "/en/search.json", },}func main() { enc := json.NewEncoder(os.Stdout) enc.SetEscapeHTML(false) enc.SetIndent("", " ") if err := enc.Encode(page); err != nil { os.Exit(1) }}

// Code generated by the soultec.ch build. DO NOT EDIT.const page = { apiVersion: "soultec.ch/v1", kind: "Solution", metadata: { name: "endpoint-security/halcyon-anti-ransomware", locale: "en", labels: { vendor: "Halcyon Anti-Ransomware Platform", "capability/endpoint-security": 2.73, "capability/security": 1.91, "capability/backup-recovery": 2.14, "vendor/halcyon": 5.07, }, annotations: { source: "src/content/solutions/en/endpoint-security/halcyon-anti-ransomware.md", route: "/en/solutions/endpoint-security/halcyon-anti-ransomware/", schema: "/nerd/schema/solutions.json", markdown: "/en/solutions/endpoint-security/halcyon-anti-ransomware.md", }, }, spec: { title: "Halcyon Anti-Ransomware", tags: ["endpoint-security", "security", "backup-recovery"], vendors: ["halcyon"], summary: "A platform against exactly one class of attack: ransomware. It runs beside the EDR, captures key material, and takes the leverage out of extortion.", photoNeed: "A security console on screen with real alerts in it, being triaged", stub: false, draft: false, kind: "product", addon: false, vendorName: "Halcyon Anti-Ransomware Platform", status: "current", practice: "We sell and implement Halcyon. With us it complements the EDR; it does not replace it.\n", practiceReview: false, sections: [ { heading: "

What it is

", body: "Halcyon is a platform against exactly one class of attack: ransomware. The vendor's\n" + "argument is that ransomware is its own category, with sequences an EDR was never tuned\n" + "for, and it calls its product the first defence dedicated to it. The agent runs beside\n" + "the existing EDR.", }, { heading: "

How it works

", body: "It watches for ransomware-typical behaviour across the stages of an attack. If\n" + "encryption starts anyway, the platform captures the key material, which is what lets\n" + "encrypted data be restored within hours. Added to that are protection against data\n" + "exfiltration, meaning the extortion built on stolen data, and a guard for the EDR\n" + "itself, so an attacker cannot simply switch it off.\n" + "\n" + "Behind the product sits the vendor's Ransomware Operations Center: detection, response\n" + "and recovery, around the clock and included in the price.", }, { heading: "

What to watch

", body: "Halcyon replaces neither the EDR nor the backup. The three layers answer different\n" + "questions: the EDR spots the attacker, Halcyon keeps an incident from becoming\n" + "extortion, and the backup remains the last line of defence.", }, ], }, status: { corpus: 315, services: [ { ref: "services/managed-security", score: "0.42", }, { ref: "services/modern-workplace", score: "0.38", }, { ref: "services/security", score: "0.35", }, { ref: "services/academy", score: "0.29", }, ], neighbours: [ { ref: "solutions/endpoint-security", relation: "parent", }, { ref: "solutions/igel/addon/90meter", score: "0.48", }, { ref: "solutions/endpoint-security/crowdstrike-falcon", score: "0.48", }, ], search: "/en/search.json", },};console.log(JSON.stringify(page, null, 2));

# 67 lines · YAML · validated at build# 92 lines · JSON · validated at build# 99 lines · TOML · validated at build# 113 lines · XML · validated at build# 112 lines · Python · read back at build, equals the JSON record# 110 lines · PowerShell · read back at build, equals the JSON record# 116 lines · Go · read back at build, equals the JSON record# 101 lines · JavaScript · read back at build, equals the JSON record · served at /en/solutions/endpoint-security/halcyon-anti-ransomware.md

Solution · Halcyon

Halcyon Anti-Ransomware

The vendor calls it: Halcyon Anti-Ransomware Platform

A platform against exactly one class of attack: ransomware. It runs beside the EDR, captures key material, and takes the leverage out of extortion.

Topics Endpoint Security 2.73 Security 1.91 Backup and Recovery 2.14

Vendors Halcyon 5.07

04Services

03Capabilities

315Corpus

photograph wantedA security console on screen with real alerts in it, being triaged

What it is

Halcyon is a platform against exactly one class of attack: ransomware. The vendor’s argument is that ransomware is its own category, with sequences an EDR was never tuned for, and it calls its product the first defence dedicated to it. The agent runs beside the existing EDR.

How it works

It watches for ransomware-typical behaviour across the stages of an attack. If encryption starts anyway, the platform captures the key material, which is what lets encrypted data be restored within hours. Added to that are protection against data exfiltration, meaning the extortion built on stolen data, and a guard for the EDR itself, so an attacker cannot simply switch it off.

Behind the product sits the vendor’s Ransomware Operations Center: detection, response and recovery, around the clock and included in the price.

What to watch

Halcyon replaces neither the EDR nor the backup. The three layers answer different questions: the EDR spots the attacker, Halcyon keeps an incident from becoming extortion, and the backup remains the last line of defence.

What we do with it

We sell and implement Halcyon. With us it complements the EDR; it does not replace it.

Who works with it

Do you work with this? Take a look at our open roles.