In short: The Halcyon Anti-Ransomware Platform is an endpoint agent and cloud console that runs beside your EDR to stop ransomware before it executes, protect security tools and Windows recovery points, and capture encryption keys so data can be recovered. The Pro Platform Plus DXP edition also blocks data exfiltration. Both include Halcyon's 24/7 ROC and are licensed per endpoint.
What the Halcyon Anti-Ransomware Platform is
The Halcyon Anti-Ransomware Platform pairs a lightweight endpoint agent with a cloud console and a 24/7 human team. It is built to break the ransomware attack chain at several points rather than relying on one detection:
- Before execution: an AI engine built for ransomware detects and blocks malicious files, applications and processes, including new variants.
- During the attack: Kernel Guard blocks attackers abusing trusted but vulnerable drivers (bring-your-own-vulnerable-driver attacks), Tamper Guard flags attempts to sabotage EDR and security services, living-off-the-land attacks through tools such as PowerShell and WMIC are stopped, and lateral movement is interrupted.
- Protecting recovery: Volume Shadow Service (VSS) protection stops Windows recovery points being corrupted.
- If encryption starts: Halcyon captures the encryption keys and data used in the attack, so affected files can be recovered without paying the ransom.
Detections are shared across your estate, so a threat stopped on one machine is blocked on the others.
What is included in each edition
| Capability | Pro Platform | Pro Platform Plus DXP |
|---|---|---|
| Pre-execution ransomware prevention | Yes | Yes |
| Kernel Guard and EDR tamper protection | Yes | Yes |
| Living-off-the-land and lateral movement protection | Yes | Yes |
| Volume Shadow Service (VSS) protection | Yes | Yes |
| Key capture and recovery of encrypted data | Yes | Yes |
| 24/7 Ransomware Operations Center | Included | Included |
| Double extortion prevention (DXP) | - | Yes |
DXP adds two defences against data theft. Volumetric Detection totals how much data each device sends out over a 24-hour window and flags devices that cross a threshold; because it measures volume rather than content, encrypting the transfer does not hide it. Nefarious Peer Prevention blocks connections to known-bad infrastructure, whatever tool the attacker uses. You decide by policy in the console where connections are blocked and where they are flagged for review, and flags and blocks are routed to Halcyon's ROC for investigation.
How it is licensed
| Option | How it works |
|---|---|
| Unit | Per protected endpoint (workstations and servers) |
| Billing | Monthly through Forever Systems |
| Editions | Pro Platform, or Pro Platform Plus DXP |
| Upgrades | Move from Pro Platform to Plus DXP when you need data theft protection |
| Trial | Available for the Plus DXP edition |
| Services | The 24/7 ROC is included; Halcyon's emergency ransomware recovery for an active incident is a separate service |
Halcyon also offers a ransomware warranty. It is not cyber insurance, and we share its current terms before you order. Prices depend on endpoint numbers and edition, so ask us for a quote.
Requirements and deployment
The platform is managed from Halcyon's cloud console, which is available in regional instances including the EU, and it can be deployed and managed through an API. We confirm support for your specific operating system versions and server roles before ordering.
Deployment is an agent install through your existing tools, such as Microsoft Intune or your remote management platform. Halcyon is designed to coexist with EDR and antivirus, so we:
- Check your current endpoint protection and agree any exclusions.
- Pilot on a representative group, including at least one server.
- Roll out in waves and tune policies, including DXP thresholds if you have that edition.
- Confirm alert routing between Halcyon's ROC, our team and yours.
Who it suits and how we help
Halcyon suits organisations that have endpoint protection in place but want a specialist layer against ransomware and the data theft that now often comes with it. It is particularly useful where downtime is costly or sensitive data could be published: manufacturing, legal and accountancy practices, education, healthcare suppliers and logistics. Choose Plus DXP if your data would be valuable to an extortionist.
Forever Systems supplies the licences, deploys and tunes the agent beside your current tools, and keeps an eye on alerts alongside the ROC. Endpoint changes and renewals sit on your single Forever Systems account. Compare with Actifile Dynamic Data Security for data-centric protection, or browse anti-ransomware products.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between Halcyon Pro Platform and Pro Platform Plus DXP?
Both include ransomware prevention, tamper protection, VSS protection, key capture and the 24/7 ROC. Pro Platform Plus DXP adds double extortion prevention, which detects and blocks data being exfiltrated for extortion.
Can Halcyon decrypt files after a ransomware attack?
On protected endpoints, Halcyon is designed to capture the encryption keys and data used during an attack, so encrypted files can be recovered without paying the ransom.
Will Halcyon conflict with my existing EDR?
Halcyon is built to run alongside EDR and antivirus, and its Tamper Guard protects those tools from being disabled. We pilot it on a group of machines first to confirm it runs cleanly with your current setup.
Is Halcyon licensed per user or per device?
Per protected endpoint, so each workstation or server running the agent needs a licence, billed monthly.