Anti-ransomware built on the Halcyon platform
Dedicated ransomware defence — pre-execution prevention, exfiltration and extortion blocking, encryption-key capture for automated decryption, and EDR tamper protection — backed by 24/7 monitoring.
Passeca delivers dedicated anti-ransomware protection built on the Halcyon platform — preventing ransomware pre-execution, blocking data exfiltration and extortion, capturing encryption keys for automated decryption, and protecting EDR agents from tampering — backed by 24/7 monitoring.
Why EDR isn't enough against ransomware
Endpoint detection and response was designed for general malware and intrusion detection. Ransomware operates differently — and operators have adapted to defeat generic EDR.
Today's ransomware operators do not rely on novel malware that an EDR signature will catch. They use valid credentials and legitimate administrative tools — PowerShell, PsExec, RDP — to move laterally, escalate privilege, and deploy encryptors across an estate in minutes. They launch in safe mode to bypass agents, abuse signed kernel drivers to disable them, and exfiltrate data before a single file is encrypted.
EDR was not designed for this specific kill chain. It is excellent at recognising known-bad files and common attack patterns, but it struggles with malware-free intrusion, living-off-the-land abuse, and the deliberate anti-EDR techniques built into modern ransomware. The result is a detection gap that dedicated anti-ransomware exists to close.
What is anti-ransomware?
Anti-ransomware is a distinct security category, not a feature of EDR.
Anti-ransomware is a dedicated layer of protection engineered specifically for the behaviours and techniques of the ransomware kill chain. Where EDR provides broad endpoint detection and response across all threat types, anti-ransomware focuses on the five things that make ransomware uniquely destructive: execution before encryption, anti-evasion, agent tamper protection, key capture for reversal, and exfiltration blocking.
It exists as its own category precisely because ransomware has become a specialised, well-funded discipline on the attacker side. Generic tooling, however good, was not built for the specific behaviours that turn a network outage into a board-level crisis.
The five layers of anti-ransomware
Halcyon defends the ransomware kill chain across five layers. Each closes a gap that generic EDR leaves open.
- 01
Pre-execution prevention
Ransomware is identified and blocked before it can run — stopping the attack at the earliest possible point, before any encryption or exfiltration begins.
- 02
Bypass and evasion protection
Modern ransomware is built to evade generic EDR — safe-mode launches, kernel drivers, and signed-tool abuse. Halcyon detects the evasion techniques themselves, not just known malware signatures.
- 03
EDR tamper protection
A common first move for ransomware operators is to disable or blind the endpoint agent. Halcyon protects itself against tampering so it cannot be switched off mid-attack.
- 04
Encryption-key capture and automated decryption
If encryption begins, Halcyon can capture the encryption keys as they are generated and reverse the encryption automatically — undoing the attack in minutes rather than restoring from backup over days.
- 05
Data-exfiltration and extortion prevention
Double-extortion ransomware steals data before encrypting, then threatens to publish it. Halcyon blocks the exfiltration channels, removing the extortion leverage that backups cannot address.
Halcyon + your existing EDR
The first objection every buyer raises is 'we already have CrowdStrike.' Halcyon complements it — a supplement, not a replacement.
Halcyon is designed to run alongside your existing EDR — including CrowdStrike Falcon, which is part of Passeca's own stack. The two address different parts of the problem: CrowdStrike provides broad endpoint detection and response, while Halcyon adds the ransomware-specific prevention, evasion detection, key capture and exfiltration blocking that generic EDR does not.
Deploying Halcyon alongside CrowdStrike gives you layered defence: the breadth of a leading EDR plus the depth of dedicated anti-ransomware. You are not ripping and replacing — you are closing the gap.
Halcyon + your backups
Your backups won't save you — at least, not the way you hope.
Backups are essential, but they address encryption, not extortion. Modern double-extortion ransomware steals your data before it encrypts, then threatens to publish it. Restoring from backup recovers your files — it does nothing about the stolen data the attacker now holds.
Backups also have a time problem. Restoring thousands of servers and endpoints from backup is measured in days, during which the business is down. Halcyon's encryption-key capture can reverse an attack in minutes, and its exfiltration blocking removes the extortion leverage in the first place.
| Challenge | Backups alone | Backups + Halcyon |
|---|---|---|
| Recovers encrypted files | ||
| Prevents exfiltration / extortion | ||
| Reverses encryption in minutes | Days to restore | |
| Prevents the attack pre-execution |
The Passeca ransomware bundle
Halcyon
Pre-execution prevention, evasion detection, key capture and exfiltration blocking.
Passeca Deception
Decoys that detect the lateral movement and credential abuse that precede encryption.
PassIRP + PassAI-Guard
The SIEM and AI triage layer that correlate signals and run automated containment playbooks.
Incident Response retainer
Pre-negotiated response that mobilises immediately when ransomware is confirmed.
Business Continuity & DR
BCP/DR aligned to ISO 22301 so the organisation survives and recovers from disruption.
Ransomware Negotiation
Negotiation support, decryption and recovery when prevention has failed.
One partner across the entire ransomware lifecycle: Halcyon stops the attack, Deception catches the intrusion that precedes it, PassIRP and PassAI-Guard correlate and automate the response, the IR retainer contains a live incident, BCP/DR gets you back to operations, and ransomware negotiation is there if all else fails.
Industries where ransomware is existential
Any organisation can be hit, but in these sectors the cost of downtime — operational, financial, or human — makes dedicated anti-ransomware a necessity.
Manufacturing
Production line downtime costs thousands per hour; OT environments are a prime target.
Healthcare
Encrypted clinical systems directly endanger patient safety and care delivery.
Logistics
A frozen warehouse or routing system halts the entire supply chain.
Education
Schools and universities hold sensitive data and often lean security postures.
Public sector
Government and municipal services face both disruption and reputational damage.
Retail
Peak-trading downtime and POS encryption are catastrophic for revenue.
Ransomware protection, answered
Ransomware generates the highest-volume question set in the category. Here are the answers buyers need.
Should we pay the ransom?
Is paying a ransom legal in Germany?
How long does ransomware recovery take?
Does cyber insurance require anti-ransomware protection?
Will anti-ransomware slow my endpoints?
Do we still need backups if we have anti-ransomware?
Does Halcyon replace our EDR (CrowdStrike)?
What does the Passeca ransomware bundle include?
Who needs ransomware protection most?
See Halcyon on your estate.
Request a Halcyon demo. We will show you the five layers in action and scope the Passeca ransomware bundle — prevent, detect, contain, recover — for your environment.
Related