CylanceENDPOINT - Detailed Review

Cylance Endpoint Security Overview

Cylance Endpoint Security, now part of Arctic Wolf’s Aurora platform as Aurora Endpoint Security, is a sophisticated AI-driven security solution that offers a range of key features to protect endpoints from various threats. Here are the main features and how they work:

Detect and Block Malware, Ransomware, and Other Threats

CylancePROTECT Desktop uses machine learning and mathematical approaches to identify and block malware, ransomware, viruses, bots, and future variants on Windows, macOS, and Linux devices. This method does not rely on traditional signatures, trust-based systems, or sandboxes, allowing for real-time protection against new and unknown threats. The system analyzes potential file executions in the OS and memory layers to prevent the delivery of malicious payloads.

Mobile Device Protection

CylancePROTECT Mobile provides comprehensive threat defense for iOS, Android, and Chrome OS devices. It detects malware, sideloaded apps, malicious URLs in text messages, and other security risks. The app recommends specific actions to eliminate these threats, ensuring mobile devices remain secure.

Attack Detection and Response

CylanceOPTICS monitors devices to detect and respond to attacks in real time. It collects information from devices, aggregates it using cloud services, and alerts on malicious events. CylanceOPTICS can stop attacks before they execute and automate the investigation and response to attacks, reducing the time and effort required for incident response.

Secure Access to Network and Cloud-Based Services

CylanceGATEWAY implements Zero Trust Network Access (ZTNA) for secure user access to the extended network perimeter. It blocks connections to unauthorized Internet destinations, even when devices are not connected to the corporate network. This ensures that only authorized users can access the network and cloud-based services, enhancing overall network security.

Sensitive Data Protection

CylanceAVERT identifies, categorizes, and inventories sensitive data on Windows devices. It notifies specified users when sensitive data is involved in an exfiltration event and can scan files copied to USB devices, uploaded to network drives, or included in email messages. CylanceAVERT recommends remediation actions to prevent unauthorized data exfiltration.

Integration with UEM and MDM Platforms

Cylance Endpoint Security can be integrated with Unified Endpoint Management (UEM) or Mobile Device Management (MDM) platforms such as BlackBerry UEM or Microsoft Intune. This integration allows for better endpoint management and security, enabling features like device risk level reporting and mitigation actions based on detected threats.

AI-Driven Threat Prevention

Cylance Endpoint Security leverages AI and machine learning algorithms trained on billions of files to distinguish between benign and malicious programs. This predictive technology identifies and neutralizes malware, ransomware, and zero-day attacks before they can execute, providing real-time protection without the need for traditional signature-based approaches.

Automated Incident Response and Compliance

The solution automates incident response workflows, isolating infected endpoints and initiating remediation processes quickly. It also streamlines threat intelligence gathering by correlating Cylance alerts with external threat data, enhancing decision-making and response strategies. Automated compliance reporting aggregates and analyzes security data to ensure regulatory requirements are met with minimal manual effort.

Continuous Evaluation of Network Destinations

CylanceGATEWAY uses machine learning, IP reputation, and risk scoring to maintain a list of malicious Internet destinations. It blocks devices from connecting to known and unknown phishing domains, ensuring continuous protection against emerging threats.

Conclusion

In summary, Cylance Endpoint Security integrates AI and machine learning to provide a proactive and predictive security model. This approach ensures real-time threat detection and prevention, reduces the need for manual intervention, and enhances overall endpoint security across various devices and networks.