{"id":"FR2629158373","name":"Halcyon","provider":"Halcyon Tech, Inc.","providerSlug":"halcyon-tech-inc","status":"FedRAMP Ready","impact":"Moderate","authType":"Agency","serviceModel":[""],"deployment":"Government Community Cloud","businessFunctions":["Cybersecurity & Risk Management"],"assessor":"Securisea, Inc.","assessorId":"200865","smallBusiness":true,"website":"https://halcyon.ai","description":"Halcyon's Anti-Ransomware Platform is an agent-based Software as a Service (SaaS) deployment that provides multiple layers of protection against ransomware attacks while complementing existing Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) solutions. The platform leverages machine learning (ML) models trained specifically to identify and disrupt ransomware activity. The solution consists of a lightweight endpoint agent that combines multiple proprietary prevention engines with ML models designed exclusively to detect ransomware throughout the attack lifecycle. The SaaS platform provides centralized policy management, security event visibility, reporting, administrative functions, and APIs, and is designed to integrate with existing security technologies and operational workflows.\n\nHalcyon incorporates a capsule network-based machine learning architecture with the following characteristics:\n\nCollaborative decision-making in which individual ML models communicate with one another and provide weighted decisions to improve detection accuracy.\nThe ability to learn and make highly accurate detection decisions using less training data than traditional convolutional neural network approaches.\n\nTelemetry collected from protected endpoints is analyzed through multiple detection engines to evaluate process behavior over time, enabling the identification of suspicious or malicious ransomware activity. The platform supports automated response actions, including endpoint isolation, to contain ransomware activity and captures ransomware encryption key material, when available, to support recovery of encrypted data.\n\nHalcyon Data Exfiltration Protection (DXP)\n\nThe Halcyon Data Exfiltration Protection (DXP) module extends the Anti-Ransomware Platform by detecting ransomware-related data exfiltration activity associated with double-extortion attacks. DXP analyzes network communications and process behavior to identify suspicious data movement that may indicate active ransomware operations.\n\nDXP Capabilities:\n-Detects ransomware-related data exfiltration activity before sensitive information is transmitted outside the environment.\n-Supports detection and disruption of ransomware-related data theft associated with extortion campaigns.\n-Provides early indication of active threat actor activity to support investigation and containment.\n-Analyzes process behavior to improve detection accuracy while reducing false positives.\n-Integrates with supported EDR and XDR platforms to enhance response and investigation workflows.\n\nRansomware Operations Center (ROC)\n\nAs part of the Halcyon Anti-Ransomware Platform, the Ransomware Operations Center (ROC) provides continuous monitoring and operational support for ransomware-related activity. The ROC reviews platform-generated detections, validates ransomware events, supports investigation, containment, recovery, and response coordination with authorized customer personnel. The ROC leverages telemetry generated by the Halcyon platform to support ransomware monitoring, response, and recovery operations on a 24x7x365 basis.\n\n","inMarketplace":true,"agencies":[],"reuseCount":0,"leverages":[],"leveragedBy":[],"timeline":[{"date":"2026-07-31","to":"FedRAMP Ready","certType":"Rev5"}],"cr26":{"type":"Rev5","ocrOverdue":false,"valid":true,"findings":[{"level":"warning","message":"no business category listed","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no trust center link; CR26 requires one with access instructions","rule":"CDS-CSO-UTC"},{"level":"warning","message":"no link to secure configuration guidance","rule":"SCG-CSO-RSC"},{"level":"warning","message":"no next Ongoing Certification Report date","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no service list; CR26 requires the services in scope","rule":"CDS-CSO-SVC"},{"level":"warning","message":"no documentation overview (repositories) listed","rule":"CDS-CSO-PUB"}],"assessor":"Securisea, Inc."},"trustCenterCheck":null}