Encryption
Monitors suspicious file operations and detects ongoing encryption.
Where the module helps during an attack
The module primarily acts during impact, when ransomware attempts to encrypt data. This is an indicative view, not a measurement.
| Area | Level |
|---|---|
| Reconnaissance | no direct role |
| Initial access | no direct role |
| Execution and persistence | context |
| Escalation and lateral movement | no direct role |
| Impact | primary role |
| Investigation and recovery | additional protection |
Stop encryption before it spreads through your data
Ransomware is often discovered only after files are encrypted. REP X monitors file reads, writes, renaming and deletion for malicious encryption patterns, then blocks the process.
The vendor redesigned REP X around four complementary engines, each detecting a different attack behaviour.
Renaming
Detects mass file renaming and extension changes.
Decoys
Decoy files at selected locations provide early ransomware alerts.
Shadow copies
Blocks attempts to delete or alter Windows shadow copies used for recovery.
Runs in the agent alongside antivirus
The module runs in the Heimdal agent and is enabled through policy. It can work alongside another vendor's antivirus or Heimdal Next-Gen Antivirus.
On detection, it blocks the process and records process and file operation details in the console, showing administrators what happened and where.
The vendor also describes extended protection for Microsoft 365, SharePoint, OneDrive and Teams, monitoring file changes in real time.
For businesses where encryption would halt operations
REP suits organisations where encrypted data would stop production, accounting or customer work. It also suits those retaining antivirus while adding ransomware protection.
The module does not address how attackers entered the network. We recommend combining it with DNS and email protection, updates and access control.
Operations
Lower risk of endpoint data encryption halting work.
Recovery
Protected shadow copies help restore previous file versions.
Investigation
Process and file operation records help establish attack scope.
Deployment with APPSEC
Heimdal provides detection engines. APPSEC provides design, deployment and support as agreed. You remain responsible for backups, recovery tests and incident decisions.
Compatibility
We verify operating systems, device architectures and existing antivirus.
Pilot
We enable the module on selected devices and observe its response to applications handling many files.
Detection response
We agree who receives alerts and what happens when a process is blocked.
Backups
We review backup and recovery integration. REP does not replace backups.
Things to consider
- The vendor lists Windows and macOS support. Windows on ARM is not supported.
- Backup and synchronisation tools handle many files. The pilot checks whether exclusions are required.
- Licensing counts devices with the module enabled.
- Shadow copies are not backups. Separate backups that an attack cannot overwrite remain essential.
