ThreatBreaker today announced it has built that capability into the endpoint agent itself – and pointed it at ransomware, too.
The launch takes place at Black Hat USA 2026, Booth #6001.
The new approach fuses the attack and documents it in the same motion. The agent seeds every machine with a few dozen files named the way real work is named – balance_sheet, cash_flow, vpn_config – that no human ever opens. They’re tripwires. When an encryptor starts chewing through folders, it bites one, then a second, and on the second bite the machine defends itself: the encrypting process is killed, the network cut except for a single line back to the console, the binary locked away so it cannot run twice. Seconds, decided on the endpoint, with no cloud lookup and no analyst on call. It works with the internet down and the network cable already pulled.
And the machine stays on. For years, the only decisive answer to ransomware was shutting the machine down, so the servers that could never be shut down – domain controllers, database servers, the till at the front of the shop – ran in alert-only mode. The endpoints ransomware hurts most were the ones defended least. ThreatBreaker contains the attack while the machine keeps running, leaving the power-button decision to a human with a finished investigation in front of them.
That investigation writes itself. Every tripped file is recorded with its path and hashes before and after; a full forensic package is collected automatically with a documented chain of custody and cryptographic sealing, so nobody can quietly edit the record afterward.
The incident arrives written up in plain English – what ran, where it came from, how far it got – with a risk score, the technique mapped to MITRE ATT&CK, and the reasoning shown on screen. When a cyber insurer interrogates the response before paying a claim, or a European regulator expects a substantiated report within 24 hours under NIS2, the answer already exists.
The market it lands in has never needed it more. The Qilin group became ransomware’s highest-volume operator this year, and its confirmed victims read nothing like the Fortune 500 – regional clinics, specialist practices, a mental-health service, facing median demands around $310,000. A Mississippi health system spent February on paper across 35 clinics. A county in Washington State just finished its third straight week running public services by hand. None of them lacked alerts. They lacked the seconds between the first encrypted file and the ten-thousandth – and afterward, the record of what those seconds contained.
The disguises are getting better, too. This year’s wave of compromised open-source software reached major companies through tools their own developers installed on purpose. At the same time, ransomware crews route through PowerShell and system binaries every file scanner trusts by design. ThreatBreaker’s behavioral engine was built for that terrain – reading sequences and context, the reconnaissance chain before the strike, the legitimate tool doing an illegitimate thing.
ThreatBreaker is unusually plainspoken about the edges, in its launch material and not just its fine print: deception-based detection is an established technique, the capability doesn’t stop encryption before it begins – it stops it seconds in – and it doesn’t decrypt or roll back files; restoration stays the job of backups.
The capability ships now on Windows, Linux and macOS, across cloud, on-premise and fully air-gapped deployments, at no extra cost. At Booth #6001, Black Hat in Vegas – all week, visitors can watch a live encryptor walk into the tripwires, lose, and get written up by the machine it attacked.
ThreatBreaker is endpoint detection and response with a built-in investigator, made for small and mid-sized organizations and the MSSPs that serve them. One lightweight agent detects attacks – including those hiding inside legitimate tools – investigates them automatically with evidence-grade forensics, and hands over finished, explained incidents with automation that a human can always overrule. ThreatBreaker is a MACH37 Cyber Accelerator company.
Media Contact
Contact, Threat Breaker, 1 8384832749, [email protected], https://www.threatbreaker.com/
SOURCE Threat Breaker
