Halcyon Anti-Ransomware Platform
An endpoint platform dedicated to ransomware, designed to add a specialised layer on top of existing EDR rather than replace it.
Partner solutions
Halcyon anti-ransomware in Australia, from an authorised partner
Halcyon is an anti-ransomware platform that runs alongside your EDR to block ransomware, flag data theft and help recover encrypted files. TOM SHAW is an authorised Halcyon partner that supplies, implements, integrates and supports Halcyon across Australia.
Anti-ransomware and extortion prevention
What Halcyon does
Halcyon is a platform built specifically to stop ransomware and data extortion. It runs alongside an organisation's existing endpoint detection and response, blocks the behaviours ransomware depends on, flags attempts to steal data, and gives a path to recover encrypted files without relying solely on backups.
- Behaviour-based blocking of ransomware at the point of execution
- Kernel-level protection that stops malicious encryption before files are written
- Detection of data theft used for double-extortion attacks
- Capture of encryption key material to support decryption and recovery
- Tamper protection for EDR tools and the Halcyon agent itself
- Expert-led investigation and response through the Ransomware Operations Center
More about the platform on the Halcyon website.
Buy on AWS Marketplace Implement and Support Halcyon on AWS Marketplace
Halcyon products we supply and implement
File Resilience
Kernel-level capability that watches for the sequence of actions encryption malware must perform and ends the process before files are encrypted (Block Encryption).
Encryption Detection and Key Capture
Intercepts encryption key material during an attack so affected files can be decrypted and restored if encryption does occur.
Double Extortion Prevention (DXP)
Detects and blocks attempts to exfiltrate data, which ransomware groups use to pressure victims into paying.
EDR Tamper Protection
Guards EDR tools and the Halcyon agent against attempts to disable them, including bring-your-own-vulnerable-driver techniques.
Ransomware Operations Center (ROC)
Halcyon's expert team that investigates alerts, isolates hosts, evicts attackers and leads recovery, included with the platform.
What Halcyon helps with
Adding a ransomware layer to existing EDR
Halcyon runs alongside the EDR already in place and focuses on ransomware behaviours, including attempts to disable security tools first.
Stopping encryption in progress
File Resilience terminates malicious encryption processes before files are written, and Halcyon's team begins response at the same time.
Preventing data theft and extortion
Double Extortion Prevention flags and blocks data exfiltration so attackers have less leverage even if they get a foothold.
Recovering without paying a ransom
Captured key material gives a way to decrypt affected files, reducing reliance on backups that attackers often target.
Implement Halcyon in Australia with TOM SHAW
From licensing to long-term support, one Australian partner looks after your Halcyon deployment.
Supply and licensing
Buy Halcyon through an Australian partner, with licensing sized to what you actually need.
Implementation
We plan and deploy Halcyon in your environment, configured for your risks rather than left on defaults.
Integration
We connect Halcyon with the rest of your security stack.
Support
After go-live we support Halcyon: tuning, upgrades, health checks and help when you need it.
Related services
Halcyon in Australia: common questions
What is Halcyon anti-ransomware?
Halcyon is a dedicated anti-ransomware platform. It stops ransomware from executing and encrypting files, detects data theft used for extortion, and can help decrypt files using captured key material.
Does Halcyon replace my EDR?
No. Halcyon is designed to work alongside existing endpoint detection and response tools, adding ransomware-specific prevention and protecting those tools from tampering.
Can Halcyon recover encrypted files?
Halcyon's Encryption Detection and Key Capture capability intercepts encryption key material, which its team can use to decrypt affected data without depending only on backups.
Does Halcyon support Linux?
Yes. Halcyon has announced general availability of anti-ransomware protection for Linux, in addition to Windows.
How does Halcyon stop ransomware before it encrypts files?
Halcyon's endpoint agent uses behavioural engines to look for what ransomware groups do early in an attack, such as privilege escalation, credential harvesting and lateral movement. The agent can kill malicious processes, isolate an endpoint and block command-and-control traffic. Kernel Guard interrupts attempts to escalate privileges through vulnerable kernel drivers, a technique known as bring your own vulnerable driver.
Which EDR tools does Halcyon work with?
Halcyon names Microsoft Defender, CrowdStrike Falcon, SentinelOne Singularity and Palo Alto Cortex XDR, and says it works alongside any other EDR product. It also watches EDR activity for signs of tampering and defends against attempts to bypass or disable security tools.
Which Windows and Linux versions does Halcyon support?
Halcyon lists Windows Server 2012 x64 through 2025, including Core editions of 2022 and 2025, plus Windows 10 and 11. On Linux it lists x86_64 only: versions of Red Hat Enterprise Linux and compatible distributions such as Oracle Linux, AlmaLinux and Rocky Linux, CentOS Stream, Debian, Ubuntu, AWS Linux and SUSE Linux Enterprise Server. Check Halcyon's current list for exact versions.
Does Halcyon protect backups?
Halcyon shields the Windows Volume Shadow Service from tampering so recovery points stay intact, and lists integrations with backup products from Veeam, Cohesity, Acronis and Commvault. If backups are compromised, Halcyon says its captured key material can help decrypt them.
Does Halcyon integrate with SIEM and SOAR tools?
Yes. Halcyon connects to SIEM, SOAR and XDR tools through what it calls a universal API, and names Google SecOps, Microsoft Sentinel, Sumo Logic, Splunk and Exabeam.
What is the Halcyon Ransomware Warranty?
It is a recovery commitment from Halcyon, included with its anti-ransomware platform. If an attack gets past Halcyon's protections on systems it protects, Halcyon's experts lead incident response and recovery, up to a limit Halcyon sets. Halcyon describes it as a service commitment rather than cyber insurance, and the terms are Halcyon's own.
Is TOM SHAW a Halcyon partner in Australia?
Yes. TOM SHAW is an authorised Halcyon partner in Australia. We supply, implement, integrate and support Halcyon for Australian organisations.
Can TOM SHAW implement Halcyon for us?
Yes. We plan, deploy and configure Halcyon in your environment and integrate it with your existing security tools.
Do you support Halcyon after it is deployed?
Yes. We support Halcyon after go-live, including tuning, upgrades, health checks and help when you need it.
Can I buy Halcyon implementation through AWS Marketplace?
Yes. TOM SHAW's Halcyon implementation and support offering is listed on AWS Marketplace, so you can buy it through your AWS account.
Talk to us about Halcyon
Licensing, implementation, integration or support: tell us what you need and the TOM SHAW team will get back to you.
Talk to us about HalcyonOr call 1800 845 211 or email info@tomshaw.com.