Halcyon launches File Resilience as ransomware defence shifts from recovery to stopping encryption

Halcyon has launched File Resilience, or FiRe, a ransomware-protection capability designed to stop files from being encrypted rather than relying primarily on detection, backups or post-attack recovery. The technology operates at the Windows kernel level and monitors file activity so that suspected ransomware encryption can be interrupted as it begins. Halcyon is positioning the release as a change in cybersecurity architecture because the company is attempting to remove the mechanism through which ransomware operators create operational disruption and payment pressure. The launch also includes native macOS support and deeper integrations with Microsoft Defender and Microsoft Sentinel, broadening Halcyon’s ability to operate alongside established enterprise security platforms. The central question is whether the privately held cybersecurity company can prove that kernel-level prevention remains accurate and stable across complex corporate environments while converting its $1 billion valuation into sustained commercial scale.

How does Halcyon File Resilience attempt to stop ransomware before files are encrypted?

File Resilience is designed to observe activity at the Windows kernel level, where the operating system manages fundamental interactions involving files, memory, hardware and software processes. Halcyon said the capability detects encryption behaviour when it begins and terminates the responsible process before widespread file modification can occur. This approach differs from security tools that wait for a known malware signature, suspicious file or completed behavioural sequence before generating an alert.

The distinction matters because ransomware can cause significant damage during the period between initial execution and a security team’s response. Modern attacks may encrypt multiple systems rapidly, particularly after the attacker has already obtained administrative access, mapped the network and disabled defensive controls.

Halcyon’s strategy is to treat unauthorised encryption itself as the final activity that must be blocked. Even when an attacker successfully enters the environment, obtains credentials or deploys previously unseen malware, File Resilience is intended to prevent the file transformation that makes systems and information unusable.

That model does not make earlier security controls unnecessary. Organisations still need identity security, vulnerability management, endpoint detection, network monitoring and controls designed to prevent data theft. However, it introduces another line of defence at the moment when a ransomware intrusion becomes an operational crisis.

The product’s commercial proposition is therefore based on resilience rather than perfect prevention. Halcyon assumes that some attackers will bypass conventional layers and reach an endpoint. Its platform is designed to reduce the business consequences after that failure occurs.

Why is preventing encryption strategically different from recovering data after an attack?

Traditional ransomware resilience frequently depends on maintaining backups and restoring systems after an attack. Backups remain essential, but recovery can require rebuilding devices, validating data, restoring applications, reconnecting infrastructure and confirming that attackers have been removed.

The existence of a backup does not guarantee rapid restoration. Attackers commonly search for backup systems, delete recovery copies or compromise the credentials used to manage them before activating encryption. Halcyon’s research has argued that modern ransomware campaigns increasingly target recovery infrastructure before the visible attack begins.

Preventing encryption could reduce the scale of that recovery exercise. Files that remain intact may allow employees and systems to continue operating while security teams isolate the attacker and investigate the intrusion.

This has implications beyond the information technology department. Ransomware can interrupt manufacturing lines, hospital services, transport operations, retail transactions and government processes. The financial loss may come from business downtime, missed production and service disruption rather than the ransom itself.

Halcyon’s File Resilience therefore competes for budgets traditionally allocated across endpoint security, backup, disaster recovery and incident response. The platform does not necessarily replace those categories, but it could change how enterprises calculate the value of each layer.

The limitation is that ransomware operators increasingly use data theft and extortion without depending entirely on encryption. An attacker may steal sensitive customer, employee or commercial information and threaten to publish it even when encryption fails. Blocking file modification reduces one source of leverage, but it does not automatically prevent exfiltration.

Halcyon has separately developed Data Exfiltration Protection and recovery capabilities, indicating that the company recognises ransomware as a multi-stage threat rather than a single encryption event. File Resilience should therefore be assessed as one component of a broader platform, not as a complete answer to every extortion scenario.

Can kernel-level ransomware protection operate safely across complex enterprise systems?

Kernel-level access gives security software a powerful position from which to observe and interrupt activity. It also increases the importance of engineering quality because errors at this level can affect system stability, application performance and compatibility.

Corporate endpoints run a wide range of approved applications that legitimately encrypt files. These can include backup systems, databases, collaboration tools, document-security applications and software that compresses or transforms information. File Resilience must distinguish malicious encryption from approved business activity without blocking routine operations.

A high false-positive rate could be costly. Stopping a legitimate process on an employee laptop may cause inconvenience. Interrupting a database, industrial application or production workflow could create a wider operational problem.

Halcyon therefore needs to demonstrate that its behavioural analysis can identify ransomware-like activity with sufficient context. Factors may include the speed and volume of file changes, the process performing the operation, the pattern of extensions being modified, the source of the executable and whether the behaviour matches approved software.

The company has not publicly released independent test results covering every application environment or attack family. Its statement that File Resilience makes successful encryption virtually impossible remains a company claim that will need to be tested through customer deployments, independent laboratories and real incident outcomes.

Security teams will also consider whether attackers can disable the product, exploit vulnerable drivers or operate below the point at which File Resilience intervenes. Halcyon introduced Kernel Guard in 2025 to address the use of legitimate but vulnerable drivers that attackers deploy to disable security software. That earlier launch shows that the company is already working within the same defensive layer where attackers may attempt to neutralise endpoint controls.

The strength of Halcyon’s architecture will depend not only on whether it can recognise encryption, but also on whether the protection itself can remain active during a determined attack.

Why do Microsoft Defender and Microsoft Sentinel integrations matter for Halcyon’s growth?

Halcyon is not attempting to persuade every customer to replace its existing security platform. The latest launch includes deeper integration with Microsoft Defender and Microsoft Sentinel, allowing the anti-ransomware capability to operate within security environments already used by large enterprises.

Microsoft Defender provides endpoint and broader threat-protection capabilities, while Microsoft Sentinel is used for security information and event management and security operations. Integrating Halcyon alerts and response data into those systems can help customers avoid creating a separate workflow that analysts must monitor independently.

This is commercially important because security teams are under pressure to reduce product fragmentation. Enterprises may own dozens of security tools, each generating alerts and requiring specialised administration. A product that integrates with the existing security operations centre is generally easier to adopt than one requiring a new operational model.

Halcyon can position itself as a specialised ransomware layer that complements general-purpose endpoint protection. That differentiation may be more credible than claiming to replace broader platforms that already cover malware, identity, cloud activity, email and network threats.

The strategy also creates dependence on major ecosystem providers. Microsoft can continue adding anti-ransomware features to its own products, potentially reducing the need for a specialist vendor. Halcyon must therefore show that its ransomware-specific models, kernel controls, recovery capabilities and expert response produce a meaningful improvement over features bundled into a larger licence.

A specialist platform can succeed when the threat is financially important enough for customers to pay for an additional layer. Ransomware remains a board-level operational concern, giving Halcyon a strong commercial argument. The company must still prove that the incremental reduction in risk justifies the added cost and deployment complexity.

How do native macOS support and broader endpoint coverage strengthen the platform?

The launch adds native macOS support, extending Halcyon beyond Windows environments. This matters because many enterprises operate mixed endpoint fleets, particularly across technology, media, professional services and executive teams.

Attackers may use any compromised device as an entry point into the wider environment. A ransomware strategy that protects only one operating system can leave gaps where credentials, cloud applications or shared storage remain exposed.

Native support is generally preferable to a lightly adapted version of a Windows product because macOS uses different security controls, file-system behaviours and operating-system frameworks. Halcyon will need to show that its macOS protection offers equivalent visibility and resilience without affecting device performance or user experience.

The broader endpoint coverage also supports Halcyon’s distribution strategy. In February 2026, the company announced an arrangement under which its protection could be added to Dell Technologies commercial personal computers. Halcyon described this as an out-of-the-box ransomware-resilience option available during enterprise hardware purchasing.

Bundling software with commercial devices can lower acquisition costs and place Halcyon in front of organisations during hardware refresh cycles. It also creates an opportunity to protect endpoints before they are distributed to employees.

However, hardware distribution alone does not guarantee activation, renewal or wider platform adoption. Halcyon must convert device-level introductions into longer-term enterprise subscriptions covering servers, cloud workloads, security operations and incident response.

Does Halcyon’s $1 billion valuation raise the financial standard for File Resilience?

Halcyon raised $100 million in a Series C funding round in November 2024 at a valuation of $1 billion. The round increased total funding to $190 million and included Evolution Equity Partners, Bain Capital Ventures, SYN Ventures, Dropbox Ventures, ServiceNow Ventures and other investors. Halcyon said the funding would be used to accelerate growth and strengthen its anti-ransomware platform.

That valuation gives Halcyon significant private-market credibility, but it also increases expectations. Investors backing a cybersecurity company at unicorn status are generally assuming that it can build a substantial recurring-revenue business, expand internationally and either reach the public market or become a strategically valuable acquisition target.

File Resilience could strengthen that thesis because it offers a simple commercial message. Customers understand the damage caused by encrypted systems, and a product claiming to prevent that outcome can be easier to explain than a broad platform built around numerous overlapping security features.

The financial model remains difficult to assess because Halcyon does not publicly disclose annual recurring revenue, customer count, gross margin or cash consumption. Statements about funding, product expansion and office openings show investment and growth ambition, but they do not reveal whether the company is approaching operating profitability.

Halcyon opened an approximately 10,000-square-foot office in Austin in April 2026 to support engineering, product and security research teams. This indicates continued investment in development capacity, although it also adds operating costs that must eventually be supported by recurring subscriptions.

The company’s ability to monetise File Resilience will depend on packaging. Halcyon could use the capability to attract new customers, increase prices, improve renewal rates or expand deployments across more devices. Management has not disclosed whether the product will be sold separately or included within existing subscriptions.

How does Halcyon compete against broader endpoint and ransomware platforms?

Halcyon operates in a market containing some of the world’s largest cybersecurity vendors. CrowdStrike Holdings, Palo Alto Networks, Microsoft, SentinelOne, Sophos and other companies offer endpoint protection, managed detection, incident response and ransomware-related capabilities.

These competitors benefit from large installed customer bases and broad platforms. A customer may prefer to use one strategic vendor rather than purchase a separate tool focused on one threat category.

Halcyon’s defence is specialisation. The company was created around ransomware and has developed prevention, encryption-key capture, data-exfiltration protection, managed response and recovery capabilities specifically for that threat.

Its Ransomware Detection and Recovery service, launched in 2025, provides continuous monitoring and expert investigation as part of the platform. Halcyon has also established an incident-response partner programme with organisations including Beazley Security and Booz Allen Hamilton.

This gives the company a layered proposition. Software attempts to block or limit the attack, while internal experts and external incident-response partners support containment and recovery.

The risk is that larger vendors can develop similar functions and bundle them within existing enterprise agreements. Halcyon must maintain a measurable performance advantage rather than relying solely on ransomware-specific branding.

Independent evidence will be central. Customers will look for attack simulations, third-party testing, references from organisations that experienced attempted ransomware events and proof that the platform operated correctly alongside existing endpoint tools.

What does the changing ransomware market mean for Halcyon’s product strategy?

Ransomware operations are becoming faster and more industrialised. Halcyon’s 2025 research said attack dwell times were declining from days to hours, 69% of incidents occurred outside normal business hours and attackers used legitimate remote-management tools in 78% of cases. These are Halcyon research findings and should be considered within the context of the company’s focus on the ransomware market.

Faster attacks increase the value of controls that operate automatically. A security team may not have enough time to review an alert before encryption begins, particularly during nights, weekends or holidays.

Artificial intelligence could increase this pressure by helping attackers automate reconnaissance, write scripts, adapt malware and identify vulnerable targets. Halcyon’s March 2026 survey of 100 chief information security officers and senior security executives found that many respondents believed they were prepared even though nearly half of previous victims said their organisation detected the attack too late to prevent damage. The findings were commissioned and published by Halcyon, but they reinforce the commercial problem the company is attempting to solve.

At the same time, the ransomware business model is changing. Encryption is increasingly combined with stolen-data extortion, harassment and threats directed at customers or employees. A product focused only on file encryption could become less strategically important if attackers can generate payment pressure through data exposure alone.

Halcyon’s wider platform therefore needs to prevent exfiltration and support rapid containment as well as block encryption. File Resilience is strongest when it reduces one major source of disruption while the rest of the platform addresses the remaining stages of the attack.

What measurable evidence will show whether Halcyon File Resilience works at enterprise scale?

The first proof point will be independent testing. Security laboratories should evaluate File Resilience against several ransomware families, custom encryption tools and attacks designed to disable endpoint controls.

The second will be false-positive performance. Halcyon must show that legitimate backup, database, document and enterprise applications can operate without frequent interruption.

The third will be customer incident data. Organisations using File Resilience should be able to demonstrate that attempted ransomware attacks were stopped before material file encryption occurred.

The fourth will be platform expansion. Growth across Windows, macOS and Dell Technologies commercial-device deployments would indicate that the capability can be applied across heterogeneous endpoint environments.

The fifth will be commercial disclosure. Halcyon should eventually provide stronger evidence regarding customer growth, recurring revenue, retention and the contribution of new products.

File Resilience represents a meaningful change in how Halcyon describes ransomware defence. The company is no longer speaking only about faster detection or better recovery. It is attempting to prevent the file-encryption outcome on which many ransomware campaigns depend.

What has improved is the directness of the proposition, the expansion into macOS and the integration with Microsoft security workflows. What remains unresolved is whether the kernel-level approach can maintain accuracy, compatibility and resistance against sophisticated attackers across thousands of enterprise applications.

The product thesis would strengthen through independent validation, production case studies and customer growth. It would weaken if blocking encryption creates operational disruption, proves easy to bypass or addresses only one part of an extortion model increasingly built around stolen information.

What are the key takeaways from Halcyon’s File Resilience ransomware launch?

• Halcyon launched File Resilience on July 28, 2026.
• The capability is designed to stop ransomware encryption at the Windows kernel level.
• File Resilience interrupts suspicious encryption before widespread file modification occurs.
• Halcyon also introduced native macOS support and deeper Microsoft Defender and Microsoft Sentinel integrations.
• Preventing encryption could reduce downtime and recovery requirements after an intrusion.
• The technology does not automatically eliminate data theft or non-encryption extortion risk.
• Kernel-level access creates potential advantages but also raises reliability and compatibility requirements.
• Halcyon was valued at $1 billion after raising $100 million in Series C funding in 2024.
• The company has raised $190 million in total disclosed funding.
• Independent testing, low false-positive rates and customer incident results will determine whether File Resilience creates durable commercial value.