RansomShield

Protection begins close to the activity*
RansomShield works close to the activity, on the computers and servers you choose to protect. Its local agent observes supported file, process and network activity. Your team uses the desktop console to see the findings and investigate a warning. During setup, we agree which devices and folders are covered, which signals to collect, and which protective actions are permitted. You get a clearer picture without handing over unrestricted control.

Recognize suspicious file behavior*
Imagine a process suddenly changing large numbers of files. RansomShield collects the supported observations and connects them to an incident, so your team can see what changed, when it happened, and which process information is available. Behavioral clues help bring suspicious activity to attention, including attacks that deserve investigation beyond a familiar virus name. From the alert, you can follow the timeline and choose a response suited to that device.

Understand where data may be going*
Data theft can be quieter than ransomware. An unusual destination, an unexpected upload, or small transfers repeated over time can all deserve attention. The Data movement view brings the available network observations together, with their source and timing. Your team can inspect the record and compare it with expected activity. Encrypted content and missing signals remain visible limits, so a suspected transfer stays distinguishable from confirmed receipt by an outside party.

Approve one specific protected export*
For selected supported transfers, Protected export gives the team a controlled route out. Review the prepared file, destination account, purpose and expiry, then approve one specific permission. Content checks still apply to that release. The result records whether it was refused, attempted or reported. This is useful when legitimate work requires sharing information: the permission follows a defined file and purpose, with a record your team can review afterward.

Contain activity within agreed limits*
When suspicious activity needs to be contained, the response stays specific. On a supported setup, a permitted operation can pause the identified process on the affected machine. That gives the team a controlled way to interrupt the activity while preserving the incident evidence. The console tracks the request and its reported effect, including any uncertainty. Resuming the process is a separate controlled step, with the same attention to permissions and outcome.

Separate a clean point from an incident copy*
Recovery needs both a clean starting point and a record of what happened. A clean point comes from before the incident and is checked for the selected target. A separate incident copy preserves the damaged or suspect state for investigation. During an authorized recovery, RansomShield preserves that evidence, checks the chosen recovery source, and validates the restored result. Your team can review those steps instead of relying on a snapshot name alone.

Keep the alert and the evidence together*
The console keeps the story together. Start with the overview, open an incident, and inspect the recorded file activity. Then move to Data movement to check the destination, timing and source record behind a network warning. Observation age and source coverage also help your team notice interrupted monitoring, giving the next person a clear path for follow-up.

Connect local protection to the wider picture*
With the agreed connection to Governor Server Sentinel, RansomShield contributes its local findings to the wider investigation. Server Management then brings those observations into the fleet view alongside other security and health signals. Local controls use that device's own agreed permissions. Central response is issued through Sentinel and LawGuard. The benefit is a coordinated service: better context for the warning, deliberate containment and export decisions, and recovery backed by evidence.

* Currently in final R&D.
