ZeroDwell: unknown software runs isolated until the verdict is in
Most attacks succeed in the time between a new file arriving and the moment security recognises it. Xcitium's patented ZeroDwell containment brings that time down to zero.
Isolate first, then trust
Detection-based security has to know a threat to stop it. New ransomware, zero-day exploits and fileless malware are unknown by definition. A file without a known malicious signature is therefore not yet trustworthy. ZeroDwell does let such a file start, so your work continues, but only in a virtualised environment on the endpoint itself.
How it works
- 01
Classify
At launch, the agent determines whether the file is known good, known bad or unknown.
- 02
Run isolated
Unknown files run in containment. Writes to files, registry and network shares are held back.
- 03
Analyse
The Verdict Cloud assesses the file automatically and, where needed, with analysts.
- 04
Apply the verdict
Safe files are released, malicious files are removed. The real system is untouched either way.
Capabilities
Runtime virtualisation
Unknown executables get a copy of files and registry, not access to the real system.
Keep working during analysis
Users can use the program while it is being assessed.
Verdict Cloud integration
Processes are checked by hash against the Verdict Cloud.
Lightweight agent
Cloud-native updates that, according to Xcitium, hardly affect endpoint performance.
Layered protection
Works together with antivirus, host firewall, HIPS, VirusScope behaviour analysis and application control.
Policy per group
Define trusted applications and exceptions centrally per group of devices.
ZeroDwell and EDR complement each other
| ZeroDwell | EDR | |
|---|---|---|
| Role | Prevent unknown code from doing damage | Make visible and investigate what happens |
| Moment | At the moment of execution | During and after an event |
| Decision | May this file change the system? | Is this behaviour suspicious and what is the impact? |
| Together | Containment buys time without damage | EDR provides the evidence and the response |
Before you start: questions for the pilot
- Which custom or industry applications write to system locations and need to be on the trusted list?
- Who may release or block files, and who may reverse that?
- How does containment behave on devices that are often offline?
- Which groups of devices take part in the trial?
ZeroDwell in the Netherlands
As the official Xcitium distributor for the Netherlands, Spiredesk arranges the demo, a trial, licences, implementation and local support. You buy through us or through a certified Xcitium partner near you; we put you in touch.
- ✓ Demo and trial (pilot) on your own devices
- ✓ Advice on package and licences
- ✓ Tailored implementation and policies
- ✓ Local support with direct lines to Xcitium
Complete your coverage
EDR
Full insight and fast response per device, with containment as a safety net.
ViewVerdict Cloud
Cloud analysis that classifies unknown files as safe, suspicious or malicious.
ViewManaged EDR
24/7 SOC that monitors your endpoints, investigates and acts immediately.
ViewPackages (Essential, Pro, Enterprise)
Three bundles: Zero Trust protection, plus IT management, plus XDR and SIEM.
ViewFrequently asked questions
Does ZeroDwell block every unknown file?
No. Unknown files may start, but only isolated. That way work continues while the verdict is determined.
Will employees notice containment?
Hardly. Programs in containment remain usable while they are being assessed, and according to Xcitium the cloud updates put hardly any load on the endpoint.
Is a good backup not enough?
A backup only restores afterwards. Containment prevents it from getting that far, and also prevents data from being stolen before it is encrypted.
ZeroDwell containment in your environment?
In a short demo we show you how it works, discuss your situation and make a proposal. No obligation, in English or Dutch.
Product information: xcitium.com. Xcitium, ZeroDwell, OpenEDR and related logos are trademarks of Xcitium Inc.