Runtime virtualization
Unknown execution is directed into a contained layer, separating potentially harmful interactions from the working environment.
Platform
XCITIUM / ZeroDwell™
Unknown execution is contained during analysis.
Run unknown executables in an isolated virtual environment while they are analysed. Applications keep working while host resources remain behind the containment boundary.
ZERO TRUST CONTAINMENT
INSIDE THE TECHNOLOGY
Contain first. Establish trust next.
An unknown file is not trusted simply because it does not match a known signature. Runtime virtualization works together with Verdict Cloud classification.
ZeroDwell™HOW IT WORKS
Host system: files · registry · memory
01Classify the file
Reputation checks distinguish trusted, malicious and not-yet-classified files.
Unknown → containment02Execute in containment
Unknown applications run in a virtual environment, separating their interaction with files, registry and memory from the host system.
Separated from the host OS03Analyse with Verdict Cloud
Automated analysis, threat intelligence and expert review help classify the file using its behaviour and characteristics.
Informed verdict04Apply the verdict
The classification informs endpoint policy: normal execution for trusted files, blocking and response for malicious files.
Allow or blockFOR THE SECURITY TEAM
The capabilities behind the architecture.
Cloud-backed classification
Verdict Cloud combines automated analysis with human expertise and distributes classification results to client agents.
Threat intelligence
Internal and external intelligence supports indicator checks, alerts and blocking decisions.
MEET THE PLATFORM
Manage endpoint protection from a shared console.
Centralized management brings security policies, endpoint status and alerts into one working environment.
Xcitium product referenceCapabilities
Capabilities with a specific purpose
Endpoint protection layers
In Xcitium’s endpoint stack, antivirus scans and quarantines files while the host firewall and security profiles control inbound and outbound traffic. ZeroDwell directs unknown application execution into a separate containment layer.
Behavior and script activity
VirusScope examines process behavior. Script analysis and operating-system activity monitoring provide additional signals for investigating fileless attack scenarios; findings are connected to endpoint events.
Agent deployment and updates
Protection is deployed to devices through the Client Security agent. Cloud-delivered updates bring malware signatures and classification results to the agent. Compare Advanced for EPP and EDR, Managed for managed response and Complete for extended coverage.
Internal and external threat intelligence
Internal and external threat-intelligence feeds support alerting and blocking on indicators of compromise.
Integrating organization-owned intelligence
Organizations can incorporate their own threat intelligence into Xcitium and use indicators in security policies.
Verdict Cloud MD5 hash checks
Verdict Cloud checks the MD5 hash at process execution to help assess file reputation.
Automated and expert analysis
Verdict Cloud combines multiple AI environments with specialist analysis. Classification results are published globally in real time.
Compare approaches
Runtime containment and endpoint detection
| Consideration | ZeroDwell | EDR |
|---|---|---|
| Primary role | Keep an unclassified executable in a virtual environment while it is analysed. | Investigate suspicious activity through endpoint events and telemetry. |
| Main input | File reputation, execution events, Verdict Cloud, and connected threat feeds. | Process, file, and behaviour telemetry collected by the agent. |
| Primary decision | Apply an execution policy to a trusted, malicious, or still-unknown file. | Classify an event and guide investigation and response. |
| How they complement each other | Limits risk from unknown execution in the containment layer. | Provides endpoint event context and a response workflow. |
Before you start
Pilot unknown-execution containment
Choose representative supported devices and an approved benign test executable with unknown reputation. Check application compatibility, contained writes and the policy for release or block. Then assess offline Verdict Cloud behavior, MD5 reputation lookup and threat feeds; agree on alerting and recovery ownership.
- 01
Do test-executable writes stay contained while required applications remain compatible?
- 02
Which policy releases a file assessed as safe for normal execution or blocks a malicious file?
- 03
What happens to execution, alerts, and logging when Verdict Cloud cannot be reached?
- 04
Who may block a threat indicator, create an exception, or reverse the decision?
Evidence for your evaluation
Before you decide
Questions, answered
Does ZeroDwell block every unknown file?
No. Unknown executable workloads can run in an isolated environment during analysis; it is not a blanket ban.
Does ZeroDwell replace EDR?
No. ZeroDwell containment complements EDR telemetry, investigation and response.
What threat intelligence can ZeroDwell use?
ZeroDwell can use internal and external threat-intelligence feeds, as well as an organization’s own indicators.
How does Verdict Cloud use an MD5 hash?
At process execution, the MD5 hash is submitted to Verdict Cloud to check file reputation.
What can ZeroDwell do with threat indicators?
Indicators are used in policies for alerting and blocking. Exceptions and decision authority follow the organization’s rules.
Are Verdict Cloud results applied to all customers immediately?
Classification results are published globally in real time. Application in your environment follows connectivity and configured security policies.
Xcitium
How will this architecture work in your environment?
Define integrations, pilot scope and an implementation plan for Azerbaijan.