About Halcyon
Halcyon sells an anti-ransomware platform that combines anti-ransomware technology, a 24/7 managed service and a ransomware warranty. Halcyon is built specifically to stop ransomware. Halcyon is a fully remote company operating in North America, with headquarters in San Diego, CA.[3][4]
Halcyon uses behavioral engines trained on indicators of ransomware to detect suspicious activity early in the attack chain. If an attacker gains a foothold, Halcyon prevents execution and detects data exfiltration attempts. Halcyon detects when attackers use malicious executables, brute force attempts or command and control (C2) infrastructure to access an environment. Halcyon alerts on and interrupts an attacker's attempt to escalate user privileges using malicious executables or vulnerable kernel drivers. Halcyon detects and prevents attackers' attempts to move laterally across an environment. Halcyon includes EDR Last Gasp and Tamper Guard features that protect against attempts to bypass and disable security products in real-time. Halcyon shields the Volume Shadow Service from tampering.[1][3][6]
Halcyon DXP monitors outbound data flows within an organization, automatically detecting anomalous data movement and transfers associated with ransomware attacks. In the Halcyon console, prevention is set by policy, so a customer's team decides where blocking is enforced and where connections are flagged for review.[6]
Halcyon monitors real-time behaviors linked to ransomware encryption and captures encryption key material, such as seed values and copies of symmetric keys, generated during the attack. Halcyon captures a copy of the key as it is generated, giving an extra key to decrypt files without paying ransom. Halcyon connects organizations with incident response partners when ransomware strikes.[7][8]
Halcyon's Ransomware Defense and Recovery (RDR) team monitors every alert and provides real-time response guidance. If an attack bypasses Halcyon's defenses, Halcyon provides incident response and recovery services at no extra charge. The Halcyon Warranty is included in the anti-ransomware platform and covers recovery services scoped to Halcyon-protected systems, valued at up to $50,000 USD. Halcyon states that initial response happens within 120 minutes, with recovery initiated within 12 hours.[3][9][10][13]
Halcyon provides what is known as Halcyon Threat Response. Halcyon analysts escalate to a customer's SOC as arranged. Halcyon Support Services is a 100% in-house, non-outsourced team of Tier-1, Tier-2 and Tier-3 product experts trained in all aspects of the Halcyon Platform. All customers have 24/7 access to the Halcyon Supportal for answers to common questions, how-to articles, troubleshooting and documentation. Halcyon offers phone support for its Enterprise Support customers.
Halcyon's agent can be deployed using a customer's preferred deployment tools across Windows and Linux endpoints and servers. Once the Halcyon agent is deployed, Halcyon automatically monitors agent health and prevents tampering. Halcyon group policies let customers place assets in full protection mode, and Halcyon offers a detection mode for critical systems where visibility is key. Halcyon streams alerts into any SIEM, SOAR or XDR product through its universal API. Halcyon is not a replacement for existing endpoint protection. Halcyon's platform is built with MSSPs and MSPs in mind, and those providers can choose prevention or detection mode based on customer risk tolerance.[1][2][3][4][6][7][8][9][11][12][13]
Halcyon on the record