In short: Halcyon is a dedicated anti-ransomware platform that runs alongside existing EDR or antivirus. It blocks ransomware before it executes, protects security tools and recovery points from tampering, captures encryption keys so files can be decrypted without paying, and with its DXP module detects the data theft behind double extortion. A 24/7 Ransomware Operations Center is included.
Why a dedicated anti-ransomware layer?
Modern EDR is good at catching ransomware, but ransomware groups study EDR closely. Before they encrypt anything, they typically try to switch off or blind security tools, abuse legitimate but vulnerable drivers to gain kernel access, use built-in tools such as PowerShell to avoid detection, delete Windows recovery points and copy data out for extortion. If any one of those steps succeeds, the EDR may never get the chance to act.
Halcyon is built around that attack chain. Instead of being a general-purpose endpoint platform, it adds a second, specialist agent focused on the behaviours ransomware depends on, and on recovery if prevention fails. It is designed to supplement the EDR you already run, and Halcyon names Microsoft Defender, CrowdStrike Falcon, SentinelOne and Palo Alto Networks Cortex among the security tools it protects from being tampered with. For the wider picture of endpoint options see our endpoint security and XDR hub.
How Halcyon works
Halcyon breaks the attack at several points rather than relying on one detection:
| Stage | What Halcyon does |
|---|---|
| Before execution | An AI engine trained specifically on ransomware detects and blocks malicious files, applications and processes, including new variants |
| Driver abuse | Kernel Guard blocks bring-your-own-vulnerable-driver attacks that use trusted but flawed drivers to gain kernel access |
| Security tool tampering | Tamper Guard protects EDR and other security agents from being disabled or sabotaged |
| Living off the land | Detects and stops ransomware launched through built-in tools such as PowerShell and WMIC, and attempts to move laterally between machines |
| Recovery points | Protects Windows Volume Shadow Copy Service (VSS) snapshots from being deleted or corrupted |
| If encryption starts | Captures the encryption key material used in the attack so affected files can be decrypted without paying the ransom or relying only on backups |
The platform is managed from Halcyon's hosted console, with regional instances, and can be deployed and managed through an API, which suits organisations and IT providers that automate deployment.
DXP: stopping double extortion
Many ransomware groups now steal data before they encrypt it, then threaten to publish it. That means good backups no longer remove the leverage: even if you restore everything, the stolen data is still out there.
Halcyon's DXP module addresses this. It watches outbound data flows and raises an alert when unusual volumes of data move or when transfers head for known ransomware command-and-control infrastructure, so the Ransomware Operations Center can investigate and respond early. It focuses on the volume and destination of data movement rather than reading file contents, which is how it differs from a traditional data loss prevention tool.
| Capability | Halcyon Pro Platform | Halcyon Pro Platform Plus DXP |
|---|---|---|
| Pre-execution ransomware prevention | Yes | Yes |
| Kernel Guard and EDR tamper protection | Yes | Yes |
| Key capture and recovery of encrypted data | Yes | Yes |
| 24/7 Ransomware Operations Center | Included | Included |
| Data exfiltration and double extortion prevention (DXP) | Optional add-on | Included |
If you hold data that would be valuable to an extortionist, such as client files, health information or pupil records, the Plus DXP edition (or Pro Platform with the DXP add-on) is usually the right choice. For data-centric controls on what staff can share, see data loss prevention.
The Ransomware Operations Center and recovery
Halcyon includes its 24/7 Ransomware Operations Center (ROC) at no extra charge. The ROC provides expert-led monitoring, detection, response and recovery focused on ransomware, so a Halcyon alert at night is not left waiting for your IT team.
For help during an active incident, Halcyon also offers a separate Emergency Ransomware Recovery professional service, delivered with its incident response partners. Halcyon also publishes a ransomware warranty; it is not cyber insurance, and we share its current terms before you order.
The ROC is specialist rather than general-purpose. If you also need 24/7 cover for identity attacks, phishing and other threats, pair Halcyon with a broader managed detection and response service, or check whether your existing MDR provider will work alongside it.
Halcyon alongside EDR, MDR and backup
Halcyon is a layer, not a replacement. This is how it fits with the rest of your defences:
| Layer | Main job | What Halcyon adds |
|---|---|---|
| EDR or XDR | Broad threat detection, investigation and response | Specialist ransomware prevention and protection of the EDR itself from tampering |
| MDR | 24/7 people watching and responding | A ransomware-focused ROC and key capture for recovery |
| Backup | Restoring data after loss | A faster route back for encrypted endpoints, plus DXP against data theft that backup cannot undo |
You still need immutable, tested backups: see cloud backup and disaster recovery. Halcyon shortens recovery for protected endpoints; it does not remove the need for a backup you can rely on.
Who Halcyon suits and how we deploy it
Halcyon suits organisations that already have endpoint protection but where ransomware downtime or a data leak would be especially damaging: manufacturers and logistics firms, legal and accountancy practices, schools and multi-academy trusts, healthcare suppliers and any business holding sensitive personal data. Because it complements your EDR, you do not need to replace tools that are working.
- Review your current endpoint protection, server estate and backup, and agree which machines need cover.
- Pilot the agent on a representative group, including at least one server, and confirm it runs cleanly beside your EDR.
- Roll out in waves through Microsoft Intune or your management tools, then tune policies and DXP thresholds.
- Agree alert routing between Halcyon's ROC, our team and yours.
Halcyon is licensed per protected device, and licensing detail is on softwarelicensing.uk. Contact us to arrange a pilot or ask us for a quote.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Halcyon replace my antivirus or EDR?
No. Halcyon is designed to run alongside existing EDR or antivirus as a dedicated anti-ransomware layer. It also protects those tools from being tampered with or switched off by attackers.
Can Halcyon decrypt files after a ransomware attack?
On protected endpoints, Halcyon is designed to capture the encryption keys and data used during an attack, so encrypted files can be recovered without paying the ransom.
What is Halcyon DXP?
DXP is Halcyon's data exfiltration and double extortion prevention module. It is included in the Pro Platform Plus DXP edition and available as an add-on to Pro Platform. It alerts on unusual outbound data volumes and transfers to known ransomware command-and-control infrastructure, so data theft for extortion can be spotted and stopped early.
Is the Halcyon Ransomware Operations Center included?
Yes. Halcyon includes its 24/7 Ransomware Operations Center with the platform at no extra charge. Emergency Ransomware Recovery, for help during an active incident, is a separate professional service delivered with Halcyon's incident response partners.
Do I still need backups if I use Halcyon?
Yes. Halcyon reduces the chance and impact of ransomware on protected endpoints, but you still need immutable, tested backups for servers, SaaS data and anything Halcyon does not protect.