Stage 01
Unknown file isolated
The endpoint flags the file and sends it for cloud analysis. Until a verdict is determined, kernel-level virtualization keeps the file isolated.
Output: File awaiting analysis in an isolated environment
← Products
Xcitium offering
Verdict Cloud
Cloud classification for unknown files. An unknown file is analyzed in Verdict Cloud using cloud machine learning and behavioral sandboxing.
Discuss your requirements ↗
Cloud analysis for unknown files
Analyze unknown files in isolation while the cloud determines their verdict
The endpoint flags an unknown file and sends it to Verdict Cloud. While cloud analysis runs, kernel-level virtualization keeps the file isolated; the endpoint applies policy after the verdict returns.
Stage 02
Cloud analysis
Machine learning, behavioral sandboxing, and global threat intelligence assess the file while isolated execution separates its activity from the environment.
Output: Analysis signals and trust assessment
Stage 03
Verdict returned
The endpoint receives a Safe, Suspicious, or Malicious classification; the Zero Trust policy determines the appropriate action.
Output: File classification for policy action
Stage 04
Endpoint policy enforced
The endpoint applies the appropriate Zero Trust action and records the verdict for visibility and audit.
Output: Applied policy and decision record
Endpoint deviceUnknown file · isolated
Verdict Cloud
ML + behavior analysisGlobal threat intelligence
VerdictSafeSuspiciousMalicious
Verdict returned to endpointZero Trust policyRecord and visibility
Capabilities
Capabilities with a specific purpose
Cloud analysis of an unknown file
An unknown file goes to Verdict Cloud for cloud analysis. The endpoint isolates it during analysis and applies policy when the verdict returns.
Machine learning and behavioral analysis
Verdict Cloud analyzes unknown files with cloud machine learning, behavioral sandboxing, and global threat intelligence.
Clear verdict categories
Verdict Cloud returns Safe, Suspicious, or Malicious. Define the endpoint policy action for each outcome.
Endpoint policy enforcement
The analysis result returns to the endpoint, where Zero Trust policy applies. Test allow, isolation, and block behavior for Safe, Suspicious, and Malicious in your configuration.
UZT and EDR integration
Verdict Cloud integrates with Xcitium UZT and EDR. Check how an unknown file verdict connects to the policy action and log record.
Compare approaches
From reputation lookup to endpoint action
| Consideration | Reputation lookup | Verdict Cloud and endpoint policy |
|---|---|---|
| Starting signal | A known file is checked against reputation data. | An unknown file can be sent for cloud analysis. |
| Further analysis | An unknown file needs further analysis. | Cloud machine learning, behavioral sandboxing, and global threat intelligence. |
| Outcome | A known reputation result or no available result. | Safe, Suspicious, or Malicious returns to endpoint policy. |
Before you start
Pilot unknown-file analysis
Pilot an unknown file with endpoint policy. Before production, check isolation, Safe/Suspicious/Malicious outcomes, policy actions, and logs.
- 01
How is an unknown file sent to the cloud and isolated during analysis?
- 02
Which policy applies to Safe, Suspicious, and Malicious outcomes?
- 03
How does the verdict appear in Xcitium UZT and EDR workflows?
- 04
Where are verdicts, policies, and exceptions retained for audit?
Evidence for your evaluation
In practice
Reviewing an unknown file
An employee downloads a new file that the endpoint does not recognize. Verdict Cloud sends it for analysis instead of treating it as trusted; the security team can review the verdict and the endpoint policy applied.
What your team gains
- 01
Evidence-based classification for unknown files.
- 02
Cloud machine learning and behavioral sandboxing.
- 03
A verdict returned to endpoint policy and recorded for visibility.
Before you decide
Questions, answered
How does Verdict Cloud assess a file?
Verdict Cloud analyzes an unknown file with cloud machine learning, behavioral sandboxing, and global threat intelligence, then returns Safe, Suspicious, or Malicious.
What does the endpoint do after a verdict?
The result returns to the endpoint, where configured Zero Trust policy applies. Test allow, isolation, and block rules for each outcome.
How does Verdict Cloud work with Xcitium UZT and EDR?
Verdict Cloud adds file classification to Xcitium UZT and EDR workflows; verify how the verdict connects to endpoint policy and logs.
Next step
Discuss your requirements
Tell us about your environment and priorities to discuss the right solution, pilot scope and rollout in Azerbaijan.