Halcyon Bet Your Security Stack Will Fail. Its Payoff Is a $1 Billion Ransomware Safety Net

The most revealing sentence Halcyon CEO Jon Miller has said about security is also the least comforting: the company assumes every defensive layer will fail eventually, including Halcyon. This is not the language of a vendor selling an invincible shield. It is the premise behind a focused enterprise business: if antivirus misses the payload, if endpoint detection gets switched off, and if backups are corrupted, can you still keep a ransomware operator from owning the clock?

Halcyon's answer is a lightweight software agent, a cloud management platform and a round-the-clock team dedicated to ransomware. It is designed to run beside the tools customers already bought. Before execution, models trained on ransomware signals look for malicious files. During an attack, behavioral and deception engines watch what programs do, not only what they are called. Data Exfiltration Protection looks for unusual movement that can feed a double-extortion threat. If encryption begins, Halcyon attempts to capture the key material created on the endpoint and use it to help decrypt affected files.

That last move is the party trick, but the positioning is the business. Halcyon does not ask a chief information security officer to declare CrowdStrike, Microsoft Defender or a backup contract a mistake. It argues that general endpoint tools and backups do necessary jobs, while ransomware specialists deliberately target both. Halcyon sells the missing layer between prevention and reconstruction.

A pipeline shutdown becomes a product brief

Miller and co-founder Ryan Smith came from offensive security, consulting and established vendors including Boldend, Cylance, Accuvant and IBM's ISS X-Force. The 2021 Colonial Pipeline incident sharpened their frustration. Companies were spending more on modern protection, yet a ransomware event could still stop fuel delivery and drag a technical failure into public life. They formed Halcyon that year around a blunt reframing: ransomware is not merely malware. It is a business-continuity attack.

That distinction changed what they built. A broad endpoint product optimizes across many kinds of threats. Halcyon narrowed its models to ransomware samples, tactics and incident-response evidence. It added tricks that exploit assumptions inside ransomware code, behavioral checks for living-off-the-land activity, alerts when an endpoint tool is tampered with, and a Last Gasp signal if its own agent stops unexpectedly. The platform also watches for data leaving the network, because modern extortion can work even when encryption fails.

In July 2026, Halcyon extended the idea with File Resilience, or FiRe. It operates at the Windows kernel level and watches file operations so it can identify encryption as it starts and prevent modified data from being written. The release also brought native macOS protection and deeper work with Microsoft Defender and Sentinel, joining existing Windows and Linux coverage. The arc is visible: what began as a ransomware-specific agent is becoming an operating layer across endpoints, telemetry and recovery.

“We assume first that all security layers will fail at some point, including our own.”Jon Miller, CEO and co-founder

What failed first - and what Halcyon changed

The cleanest answer appears in Halcyon's published recovery cases. In one Akira attack, both antivirus and EDR had been disabled. The victim was inoperable and faced an $800,000 demand. Halcyon says it entered on day five, restored critical telephony in four hours, recovered more than 90 percent of files and returned the company to normal operations by day 12 without a ransom payment. Prevention was already gone; the first useful product was recovery.

Another case is almost comically compressed. Across roughly 1,000 deployed endpoints, Halcyon says all but one attack was blocked. On the lone machine where encryption occurred, captured key material enabled recovery in five minutes. A county case carried a $700,000 demand, halted operations, and ended with virtual infrastructure restored without payment, according to the company. These are vendor-selected results rather than a neutral benchmark, but they show what Halcyon wants buyers to measure: time to usable systems, files restored and ransom avoided.

Customers describe a similar change of mind. A director at an Am Law 200 firm said attackers' “low-and-slow” methods made relying only on traditional controls look insufficient. OceanAir Federal Credit Union reported cutting mean response time from 90 minutes to under 45. An unnamed financial group got executive approval after its CISO described Halcyon as an insurance policy. The phrase is imprecise, but it is excellent internal sales language: an extra layer that buys options when the ordinary plan has stopped working.

What does the safety net cost?

There is no public sticker price. Halcyon quotes according to the size of the environment, number of protected endpoints and desired level of resilience, usually under annual or multi-year agreements. That opacity makes clean comparisons difficult. It also fits an enterprise sale where deployment shape, channel partner and support scope matter more than a $19-per-seat webpage.

The warranty deserves careful nouns. It is not a $50,000 cash payout and it is not broad cyber insurance. It is a promise to provide Halcyon professional services up to the annual cap. Coverage requires a currently supported agent running on affected endpoints, blocking posture and anti-tamper settings, timely notice, payment compliance and customer cooperation. Pre-existing incidents, uncovered systems and certain failures involving customer negligence or third-party technology can fall outside it.

This service layer matters because recovery is not a button. Halcyon's Ransomware Operations Center monitors alerts, investigates activity, helps reverse-engineer encryption material and leads recovery. The company promises an initial response within 120 minutes and recovery initiation within 12 hours under its warranty program. Bundling people with software moves the sale away from alert volume and toward an operational outcome.

The narrow wedge grew into a unicorn

Investors bought the category argument quickly. In April 2023 Halcyon announced $44 million in Series A equity plus $6 million in debt, led by SYN Ventures and Corner Ventures with Dell Technologies Capital participating. Bain Capital Ventures led a $40 million Series B eight months later. Evolution Equity Partners led the $100 million Series C in November 2024, joined by Bain, SYN, Harmony Group, Corner Capital Management, Dropbox Ventures and ServiceNow Ventures. The round valued Halcyon at $1 billion and brought publicly announced financing to $190 million.

The money funded more than detection code. Halcyon built research around threat actors and ransomware economics, expanded a partner channel and hired for global distribution. It is available through AWS Marketplace. Distology supports its U.K. channel; Climb Channel Solutions connects it to North American resellers and managed service providers. In February 2026, Dell began offering Halcyon as an add-on for commercial PCs through Dell Trusted Workspace. In May, Halcyon launched full-scale operations in Japan.

Those deals reveal the market. The buyer is an enterprise or mid-market organization where downtime is expensive: insurers, credit unions, healthcare providers, manufacturers, universities, logistics operators, law firms and governments. Named users include OceanAir Federal Credit Union, Delaware Valley University, Industrial Refrigeration Pros and CACC Cargolinx. Other case studies anonymize large organizations, a reminder that cybersecurity customers like proof but rarely enjoy becoming the proof.

What to copy - and where the copy breaks

The stealable lesson is not “train an AI model.” It is a sequence. Pick a catastrophic failure that general platforms handle as one feature among hundreds. Make incumbent products allies, so adoption does not require a rip-and-replace fight. Build for the whole incident, including the ugly recovery work after detection. Then tie value to a metric the finance team understands: hours of downtime, systems restored or ransom avoided.

Key capture is clever, not magic. It is most useful when a supported, active agent can observe usable cryptographic material on the protected endpoint. If the attacker encrypts data remotely, uses a scheme that keeps keys elsewhere, attacks an unsupported or unprotected system, or simply steals data without encrypting it, recovery needs other defenses. DXP addresses part of the theft problem, but identity security, segmentation, patching, EDR, tested backups and an incident plan remain necessary.

Halcyon also carries the ordinary risks of a focused category. Large endpoint vendors can deepen ransomware features. Backup companies can push closer to prevention. A kernel-level agent must coexist with other security software without creating instability or noisy conflicts. The company's own warranty makes correct deployment and configuration explicit. This approach works best for organizations with enough endpoints and downtime exposure to justify another control, and enough operational discipline to run it properly.

Still, the founding bet has aged well. Ransomware crews do not need to defeat every defense forever. They need one window long enough to steal data, disable protection or encrypt something the business cannot ignore. Halcyon built a company around shrinking that window and preserving an exit. Its real product is not immunity. It is the ability to refuse the attacker's timetable.