Key takeaway
Evaluate each layer’s role, policy alignment and measurable outcomes separately.
The limits of detection
Xcitium argues that traditional antivirus and EDR rely on known malicious samples and observed behavior. Treating an unknown file as safe before verification can leave a gap in protection.
Three protection layers
Xcitium’s model combines signature checks, behavioral monitoring and execution of unknown code in a kernel-virtualized environment. These layers address file recognition, observed actions and restrictions on execution while trust is being established.
Layers working together
In Xcitium’s model, antivirus, EDR and Zero Trust complement one another across different layers. An architecture review can identify each tool’s role and the gaps that remain.
Use in an evaluation
Security leaders can examine how unknown code is handled, how normal workflows are affected and how policies align across layers. The paper also includes a table of Xcitium device observations for periods in October and November 2024.