Halcyon Pro Platform and Pro Platform Plus DXP editions

What Halcyon is, and what it is not

Halcyon is a security company dedicated to defeating ransomware. Its Anti-Ransomware Platform is a lightweight agent and cloud console that you add alongside your existing antivirus or EDR, not instead of it. Halcyon's own words are "supplement your EDR with dedicated anti-ransomware protection", and it names Microsoft Defender, CrowdStrike Falcon, SentinelOne Singularity and Palo Alto Cortex XDR among the products it works beside, along with "any other EDR product".

So Halcyon is not a replacement for business antivirus. You still need endpoint protection for everyday malware, web threats and device control. What Halcyon adds is a second, specialist layer focused on the steps a ransomware attack relies on: disabling security tools, abusing drivers, using built-in admin tools, moving between machines, wiping recovery points, stealing data and finally encrypting it.

Halcyon's published support list covers Windows 10 and 11, Windows Server and a range of Linux distributions on x86_64; macOS is not on the list. We confirm the exact versions and server roles for your estate before you order. For the wider picture of where Halcyon sits among the other layers, see our guide to ransomware protection for business.

Pro Platform and Pro Platform Plus DXP compared

Both editions share the same prevention, tamper protection and recovery engine. Plus DXP adds two defences against data theft.

The edition names above are the ones on our supplier catalogue. Halcyon refers to the data theft features as DXP, Double Extortion Prevention.

Shared capabilities in both editions

Pre-execution prevention. Halcyon's engines are built to detect and block ransomware files, applications and processes before they run, rather than waiting for encryption to begin.

Kernel Guard. Attackers often load a genuine but vulnerable signed driver and use it to switch off security software from inside the operating system kernel, an approach known as bring-your-own-vulnerable-driver. Kernel Guard is designed to block that abuse.

Tamper Guard and EDR Last Gasp. These detect attempts to bypass or disable security products, including the antivirus or EDR you already run. That matters because many attacks spend their first steps blinding the defences.

Living-off-the-land and lateral movement. Ransomware operators use tools that are already on Windows, such as PowerShell and WMIC, because they look legitimate. Halcyon detects and stops ransomware launched this way, and detects attempts to move laterally across your network.

VSS protection. Windows volume shadow copies are a quick route to restoring files, so ransomware usually tries to delete them. Halcyon protects them from being corrupted.

Key capture. If an attack gets as far as encryption, Halcyon is designed to capture the encryption keys and data the attackers use, so that affected files can be recovered without paying.

Ransomware Operations Center. Halcyon includes its own ROC with the platform at no extra charge. Halcyon describes it as expert-led detection, response and recovery, monitored around the clock by Halcyon's staff. It is Halcyon's service rather than ours; we agree with you at quote how alerts are routed between Halcyon, your team and us.

What Plus DXP adds: Double Extortion Prevention

Many ransomware groups now steal data before encrypting it, then threaten to publish it if you restore from backup instead of paying. That second threat is double extortion, and it is what DXP is for.

• Volumetric Detection totals how much data each device sends out over a 24-hour window and flags devices that cross a set threshold. Because it measures volume rather than content, encrypting the transfer does not hide it.
• Nefarious Peer Prevention blocks connections to known-bad infrastructure as soon as it is identified, whichever tool the attacker uses to move the data.

You decide by policy where connections are blocked and where they are only flagged for review, and both flags and blocks go to Halcyon's ROC for investigation.

Who should choose Plus DXP? Organisations whose data would be valuable to an extortionist: client files at legal and accountancy practices, personal and health information, pupil records, designs and contracts. If losing files would hurt but publication would hurt more, Plus DXP is the edition to look at. If your main concern is keeping systems running and you already have strong data loss controls, Pro Platform may be enough to start with, and you can move up later.

When a dedicated anti-ransomware layer makes sense

Halcyon is an extra layer and an extra subscription, so it is worth being clear about when it earns its place. It tends to suit organisations where:

• Downtime is expensive: manufacturers, logistics firms, professional practices and anyone whose work stops when servers are encrypted.
• Data would be valuable to an extortionist: personal, financial, health or pupil data, or commercially sensitive files. This is where Plus DXP comes in.
• Servers matter most: Halcyon's support list covers Windows Server and Linux servers as well as Windows desktops, and servers are where encryption does the most damage.
• You want defence that does not rely on one product: if attackers do manage to disable your main antivirus or EDR, Halcyon is designed to detect that tampering and keep protecting the device.

It is less of a priority for a very small business that has not yet put behaviour-based next-generation antivirus, multi-factor authentication and tested backups in place. Those come first, and our small business antivirus guide is a good place to start. When you are ready to add a dedicated layer, Halcyon can be piloted on a handful of machines first, so you can see how it behaves beside your current tools before committing the whole estate.

Licensing, trial and warranty

Halcyon also offers a ransomware warranty. It is not insurance and does not pay a ransom or your losses; it is a capped limited warranty of incident response and recovery services from Halcyon for protected systems, subject to conditions such as keeping endpoints in a blocking posture with anti-tamper enabled, running a supported version and notifying Halcyon promptly. Halcyon's terms say that outside the US it needs Halcyon's written approval, so we confirm current terms and availability for you at quote.

Prices depend on the number of endpoints and the edition, so ask us for a quote. Our licensing site covers Halcyon licensing in more detail.

How we deploy Halcyon beside your current tools

Halcyon is designed to coexist with your antivirus or EDR, but any two security agents on one machine need a little planning. Our usual approach:

1. Check your current protection and agree any exclusions between Halcyon and your existing agent.
2. Pilot on a representative group of machines, including at least one server.
3. Roll out in waves through your normal software deployment tool, such as Microsoft Intune or your remote management platform.
4. Tune policies, including Volumetric Detection thresholds and block or flag decisions if you have Plus DXP.
5. Agree alert routing between Halcyon's ROC, your team and us.

If you are still choosing the main endpoint product, our vendors page compares the ones we supply, and EPP vs EDR explains whether you need detection and response as well. To ask about a pilot or get a quote, Contact us.