In short: Anti-ransomware software detects the behaviour of ransomware, such as mass file encryption, and stops it before it spreads. Some products also roll files back or capture encryption keys to aid recovery. It is sold as a feature of endpoint protection or as a dedicated add-on, usually licensed per device, and works best combined with immutable backups.
What is anti-ransomware software?
Ransomware encrypts your files and systems and demands payment for the key, often after first stealing data to threaten publication. The NCSC regards it as one of the most serious cyber threats facing UK organisations.
Anti-ransomware software focuses on the moment an attack starts. Instead of relying on recognising a known file, it watches for the behaviour of encryption: a process rapidly opening, altering and renaming many files, or tampering with shadow copies and backups. When it sees that pattern it stops the process and, depending on the product, restores the affected files from a protected cache.
You will find this capability in three forms:
- Built into endpoint protection, for example Sophos Intercept X's CryptoGuard or SentinelOne's rollback
- Dedicated anti-ransomware platforms such as Halcyon, designed to sit alongside your existing endpoint product
- Backup with built-in protection, such as Acronis Cyber Protect, which combines anti-ransomware with backup and recovery
Anti-ransomware: vendors and products we supply
- Acronis: Backup, disaster recovery, EDR, email security, RMM and protected servers on one platform.
- Acronis Cyber Platform (Cyber Protect Cloud): Backup, anti-ransomware and management in one agent, per workload or on storage used.
- Actifile: Sensitive data discovery, risk scoring and automatic file encryption.
- Actifile Dynamic Data Security: Discovery, risk scoring, monitoring and automatic encryption in one platform.
- Bitdefender: GravityZone endpoint protection, EDR, email security, patching and encryption from one console.
- Bitdefender GravityZone Cloud MSP Security: Cloud-managed endpoint protection for PCs, Macs, Linux and servers, billed monthly.
- Check Point: Endpoint, email, SASE, mobile, browser, WAF and MDR licences in one Check Point Portal tenant.
- Check Point Harmony Endpoint: Endpoint protection, anti-ransomware and EDR in one agent, licensed per device.
- CrowdStrike: Falcon endpoint protection, managed threat hunting, Falcon Complete MDR, identity, SIEM and AI security.
- CrowdStrike Falcon Complete Defend: Falcon endpoint protection with CrowdStrike's 24/7 managed detection, response and remediation.
- CrowdStrike Falcon Defend: Next-gen antivirus, USB control and firewall management, with OverWatch threat hunting in Advanced Defend.
- Cynet: One-agent security platform with EDR, XDR, deception and 24x7 CyOps MDR, licensed per endpoint.
- Cynet All-in-One platform: Protect, Elite and All-in-One packages compared, licensed per endpoint.
- Halcyon: Dedicated anti-ransomware beside your EDR: prevention, key capture and data theft blocking.
- Halcyon Anti-Ransomware Platform: Pro and Pro Plus DXP: prevention, key capture, recovery and data theft blocking.
- SentinelOne: Singularity endpoint, cloud and identity security with Purple AI and managed detection and response.
- SentinelOne Singularity Endpoint: Control and Complete editions: AI prevention, rollback, device control and full EDR.
- Sophos: Endpoint, EDR, XDR, MDR, firewall, email and mobile security licences, managed in Sophos Central.
- Sophos Endpoint: Next-gen antivirus and anti-ransomware, licensed per user, with separate server licences.
- ThreatDown: Malwarebytes business security: endpoint protection, EDR, MDR, patching and more, billed monthly.
- ThreatDown EDR: Detection and response with isolation and ransomware rollback, per endpoint, monthly.
- ThreatDown Endpoint Protection: Next-gen antivirus for PCs, Macs, Linux and servers, with application block, billed monthly.
- Todyl Endpoint Security: EDR and NGAV in one agent, with isolation, quarantine and ATT&CK mapping.
- Trend Micro: TrendAI Vision One endpoint, email, XDR and ZTSA, plus Worry-Free for smaller businesses.
- Trend Micro Endpoint Security: Core, Essentials and Pro endpoint and server protection, with EDR included from Essentials.
- WatchGuard: Firebox firewalls, endpoint security, MDR, AuthPoint MFA and FireCloud SASE.
- WatchGuard Endpoint Security: Endpoint protection and EDR per endpoint: Basic, Prime, 360 and Elite.
What to look for
- Behavioural detection that works on new ransomware families, not just known samples
- Protection of network shares: stopping a compromised laptop encrypting files on a server
- Recovery: automatic rollback of changed files, or key capture to support decryption
- Anti-tamper: attackers try to disable security tools first, so the agent must protect itself
- Compatibility: dedicated tools should co-exist with your current endpoint protection without conflicts
- Backup protection: immutable or isolated backup copies that ransomware cannot delete
It also helps to ask how the product behaves when an attacker has already gained admin rights, because that is how most serious ransomware incidents unfold. Look for protection against attempts to uninstall the agent, stop its services or delete Windows shadow copies, and for alerts that reach someone quickly, out of hours as well as during the working day. Products that pair automatic blocking with a managed response service can contain an attack before it spreads to servers and backups.
How anti-ransomware is licensed
When anti-ransomware is part of an endpoint product, it is included in the per-device or per-user licence, sometimes only in higher editions. Dedicated platforms are usually licensed per endpoint, with servers at a different rate, on annual or monthly terms. Backup-based products are typically licensed per workload plus storage. We can quote for each so you can see which combination gives you the cover you need without duplication.
How to choose
- Check what your current endpoint protection already does against ransomware; you may have more than you think.
- Make sure backups are separate from your normal admin accounts and ideally immutable; see backup software.
- Decide whether a dedicated layer is worth it for your risk, for example if you hold sensitive data or cannot tolerate days of downtime.
- Test recovery, not just protection: run a restore exercise at least once a year.
The NCSC's guidance on mitigating malware and ransomware is a good, vendor-neutral checklist to work through with your IT team.
How we help
We review the protection you already have, recommend where an extra layer is justified and supply the licences on your existing account. Our engineers can deploy and tune the software and help plan backup and recovery. Contact us to ask for a quote or a second opinion.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does antivirus stop ransomware?
Modern endpoint protection stops much ransomware, but determined attackers often disable or evade security tools first. Behavioural anti-ransomware, MFA, patching and immutable backups together give much better protection.
Can anti-ransomware software recover encrypted files?
Some can. Products with rollback restore files that were changed before the attack was stopped, and some dedicated platforms capture encryption keys. Reliable backups remain essential.
Should we pay a ransom?
The NCSC and law enforcement do not encourage paying. Payment does not guarantee recovery and may fund further crime. Prepare instead with backups, a response plan and good protection.