Endpoint security
Contain unknown execution away from host resources
ZeroDwell routes unknown-file execution into a protected virtual environment that limits access to host resources. Kernel-level control begins with the first instruction; analysis can allow normal execution for a file assessed as safe or block a malicious file.
Discuss your requirements↗
A file flow: isolate, analyze, decide
An unknown file runs in a protected virtual environment with limited access to host resources. Based on analysis, policy can allow a file assessed as safe to run normally or block a malicious file.
Kernel virtualization and the system boundary
ZeroDwell uses kernel-level virtualization to limit unknown execution’s access to host resources. Control begins at execution rather than relying solely on a later detection signal.
Unknown and zero-day threats
Running unknown files in a protected environment can limit the effect of malicious behavior, including ransomware encryption, on the host.
Reduce security-team workload
Automatic isolation of unknown activity can reduce alerts requiring investigation and manual handling. EDR separately provides telemetry, investigation and response.
Protection that considers user workflows
Protection can operate in the background while unknown objects are analyzed and allow users to keep working. Prompts and application behavior depend on the selected policy.
Evaluate deployment in your environment
On a representative group, check supported devices and file types, application compatibility and performance. With the policy owner, test containment, normal execution for a safe file, EDR evidence and rollback.
Find the right solution
ZeroDwell
Learn more about isolating unknown execution and running it in a protected environment.
EDR
Review endpoint telemetry, threat detection and response needs.
Verdict Cloud
Explore file reputation classification and cloud verdict capabilities separately.
XDR
Review XDR for correlating endpoint, network and cloud signals.
Questions and answers
How is an unknown file handled?
The file is isolated in a protected environment and analyzed. After assessment, a file considered safe can be allowed to run normally and a malicious file can be blocked.
Does ZeroDwell replace EDR?
ZeroDwell contains unknown execution, while EDR provides endpoint telemetry, investigation and response actions.
Xcitium
A plan for your environment
Share your environment, current tools and priorities. Define the scope of the solution and the stages of deployment.