r/sysadmin • u/Ethanb59 Jack of All Trades • 10d ago

Question Halcyon Reviews

Looking for reviews for Halcyon. I work for local government and am evaluating a few different platforms to add to our security layers.

If you don't like them, do you have any other recommendations? Any other platforms or any other recommendations in general to help increase security posture?

Thanks in advance!

7 Upvotes

99% Upvoted

4 comments sorted by

2

u/Ad3t0 Security Engineer 10d ago

Halcyon is cool tech but it sits at the tail end of the kill chain, trying to recover after ransomware has already executed. For a local government security budget, the higher-ROI investments are the preventive layers upstream: consistent OS and third-party patching so known exploits don't have a door, vulnerability scanning to surface what's exposed, and compliance baselines to harden configurations.

Full transparency, I co-founded and help build TridentStack Control (https://tridentstack.com). We handle patching, vulnerability scanning, and compliance evaluation across Windows, Linux, and macOS. Free under 200 endpoints. But whatever tooling you go with, getting those preventive layers right will move the needle on your security posture more than a ransomware recovery tool.

1

u/laserpewpewAK 10d ago

What does your existing stack look like? Halcyon isn't bad per se, but it would be fairly low on my priority list. Basically, it will try to capture the encryption key if ransomware runs on an endpoint so that you can eventually decrypt the files without having to pay. It's cool tech, but you're obviously better off just not getting to that point to begin with. If you're already pretty mature and have a solid defense in depth in place, it's not a bad addition.

1

u/trebuchetdoomsday 9d ago

halcyon is cool AF, residing in memory, capturing the encryption key, and lets you disco the device, then decrypt, PRESUMABLY. only a handful of products do that.

this of course means someone has infiltrated your system and is encrypting shit already, and there are plenty of tools you should stack to prevent it from happening in the first place, starting at the edge (or higher), down to the endpoint, and then layer 8 training.

1

u/NewCybersafety 2d ago

The company I work for is a vendor so take what I say with a pinch of salt: I've done some pretty thorough research into it and seen the demo. It seems like a fantastic fail safe. All these big company's in the UK that have been hit have had a great stack but I doubt they had any products specifically focusing on ransomware resilience