Bahrain, Saudi Arabia
HalcyonA dedicated layer against ransomware, working alongside your EDR
Halcyon is an endpoint platform built only to stop ransomware. It blocks ransomware before and during execution, detects data theft, and captures encryption keys so files can be decrypted. It runs alongside your existing endpoint detection and response (EDR) tool.
- Windows and Linux
- Lightweight agent for Windows desktops and servers and major x86_64 Linux distributions
- Works with your EDR
- Designed to supplement Microsoft Defender, CrowdStrike, SentinelOne and Cortex XDR
- Key capture
- Copies encryption keys generated during an attack to help decrypt files
- 24/7 operations centre
- Ransomware Operations Center response included with the platform
Problems Halcyon is designed to solve
Ransomware is a sequence of steps: get in, gain privileges, disable defences, steal data, destroy backups, then encrypt. Halcyon targets the steps that do the most damage.
| Topic | What it can lead to | How Halcyon helps |
|---|---|---|
| Attackers disable your EDR first | What it can lead to: Your main endpoint defence goes blind, often using a vulnerable signed driver (a "bring your own vulnerable driver" attack). | How Halcyon helps: Halcyon watches for attempts to tamper with or disable EDR tools and detects vulnerable driver attacks. |
| Ransomware that evades existing tools | What it can lead to: Files are encrypted before anyone sees an alert, and operations stop. | How Halcyon helps: Behavioural AI models flag ransomware as it arrives, and File Resilience is designed to make malicious encryption very difficult. |
| Backups encrypted or deleted | What it can lead to: Recovery depends on paying the ransom or rebuilding from scratch. | How Halcyon helps: Key material captured during the attack can be used to decrypt affected files, and also encrypted backups. |
| Data stolen before encryption | What it can lead to: Threats to leak the data continue even after systems are restored. | How Halcyon helps: Double Extortion Prevention blocks connections to known-bad infrastructure and flags unusually high outbound data volumes. |
| A small team and attacks out of hours | What it can lead to: Nobody is available to isolate hosts while the attack spreads. | How Halcyon helps: Halcyon’s Ransomware Operations Center works around the clock to isolate hosts and evict attackers. |
What Halcyon does
Halcyon covers the ransomware sequence from prevention through recovery, using an endpoint agent, cloud analysis and its own response team.
Prevention before and during execution
Behavioural models flag ransomware as it lands on an endpoint, and a new variant blocked on one device is blocked across the fleet.
EDR tamper protection
Detects attempts to disable your EDR, including vulnerable driver attacks, so your primary defences stay running.
Encryption blocking
File Resilience is designed to make it very difficult for ransomware to encrypt your files.
Key capture and decryption
Captures encryption key material generated during an attack; the agent applies recovered keys to decrypt affected files.
Data exfiltration detection
Blocks connections to known malicious infrastructure and flags devices sending unusual volumes of data, even when the transfer is encrypted.
Ransomware Operations Center
A 24/7 team that investigates alerts, isolates hosts and evicts attackers, included with the platform.
Where Halcyon sits next to your other controls
Halcyon is a supplementary layer, not a replacement. This is how it relates to tools you probably already have.
| Topic | Its main job | How Halcyon relates to it |
|---|---|---|
| Endpoint detection and response (EDR) | Its main job: Detects and responds to a broad range of endpoint threats. | How Halcyon relates to it: Runs alongside it, catches ransomware designed to evade EDR, and watches for attempts to disable it. |
| Backup | Its main job: Restores data and systems after loss. | How Halcyon relates to it: Captured keys give a recovery path that does not depend only on backups. Halcyon lists integrations with Veeam, Cohesity, Acronis and Commvault. |
| Data loss prevention (DLP) | Its main job: Inspects content to stop sensitive data leaving. | How Halcyon relates to it: Double Extortion Prevention works on destination and volume, not content, so it complements DLP. |
| SIEM and SOAR | Its main job: Collect alerts and automate response across tools. | How Halcyon relates to it: Halcyon alerts can be streamed through its API to tools such as Microsoft Sentinel, Splunk and Google SecOps. |
Halcyon also offers a Ransomware Warranty, provided as professional services and capped from US$50,000 a year. For customers outside the United States it applies only with Halcyon’s written approval. Read its full terms, scope and exclusions before relying on it, and do not treat it as a substitute for cyber insurance.
Ransomware readiness self-check
Nine controls that reduce ransomware impact, whatever tools you use. Tick what is already in place: nothing you select is saved or sent.
How VirtuThinko helps you adopt Halcyon
- 01
Requirements
We can help you define what you need Halcyon to solve, which environments are in scope and how success will be judged.
- 02
Demo or proof of concept
We can arrange a demonstration or a proof of concept on a representative group of Windows and Linux endpoints, alongside your current EDR.
- 03
Design and deployment
We can help plan agent rollout in phases, choose the regional console, set policies, and connect alerts to your SIEM or SOAR.
- 04
Tuning and handover
We can help review alerts and policy settings after rollout, agree escalation paths with the Ransomware Operations Center, and hand over documentation to your team.
- 05
Ongoing support
Where you want it, we can support Halcyon after go-live, including health checks, upgrades and changes as your environment grows.
No. Halcyon positions itself as a ransomware-specific layer that supplements EDR. It names Microsoft Defender, CrowdStrike Falcon, SentinelOne Singularity and Palo Alto Networks Cortex XDR among the EDRs it works alongside.
Halcyon lists Windows 10 and 11, Windows Server 2012 x64 to 2025 (including Server Core 2022 and 2025), and x86_64 Linux distributions including RHEL 8.5 and later, Debian, Ubuntu LTS, Amazon Linux and SLES. Check the current list with us for your exact versions.
Halcyon is managed through regional cloud consoles. It lists US, EU, UAE and Asia-Pacific regions, which is relevant if you have data residency requirements.
Ransomware generates encryption keys while it runs. Halcyon says it captures copies of this key material, its operations centre reverse engineers them, and the agent applies them to decrypt affected files, including backups, without paying the ransom.
It is a 24/7 team that investigates detections, isolates hosts, evicts attackers and leads recovery. Halcyon says it is included with the platform at no additional charge.
Explore Halcyon for your organisation
Share roughly how many Windows and Linux endpoints you have, the EDR and backup tools you use, and any recent ransomware concerns. A member of our team will contact you to arrange an initial conversation.