The troublesome file is the one nobody recognizes. It has arrived on a computer, it wants to run, and the security software has a decision to make. Trust it? Block it? Wait? Xcitium has built its business around a fourth possibility: give the file somewhere to run where it cannot reach the real furniture.
- Unknown software runs in containment while its trust status is checked.
- Endpoint protection sits alongside detection, managed response and IT tools.
- The buying question is operational: who investigates, and what can the file touch meanwhile?
That is the premise of ZeroDwell Containment. Xcitium, the enterprise security company formerly called Comodo Security Solutions, uses virtualization to separate unfamiliar software from production resources. Analysis can continue inside that boundary. The company is selling something surprisingly ordinary beneath the terminology: time to make a decision without giving an intruder the run of the place.
The file gets a room
Consider the sequence. Known malicious software is blocked. Trusted software can proceed. An unknown executable gets virtual resources while automated analysis and human expertise work toward a verdict. Xcitium describes its underlying method as kernel API virtualization. The boundary is meant to prevent the untrusted program from damaging the actual system while still allowing it to operate.
There is a useful distinction here. Running an unknown application and granting it unrestricted access are separate decisions. Xcitium tries to pull them apart. Its commercial pitch emphasizes prevention before identification, although its wider platform also includes detection and response. Those functions still matter: somebody must investigate suspicious behavior, understand its origin and decide what happens next.
The brand arrived in July 2022, when Comodo Security Solutions announced the Xcitium name alongside its Zero Threat positioning. Founder Melih Abdulhayoglu now appears as CEO on the company’s leadership page. The rebrand gave a familiar security business a more concentrated argument: an unfamiliar file should not inherit trust simply because no detector has condemned it yet.
Two people, 130 locations
The practical appeal becomes clearer at Evergreen Life Services. In Xcitium’s January 2023 customer account, the disability-services organization had more than 2,100 employees across 130 locations. Eight people handled IT. Two handled security. For that team, every extra console represented another place to look and another handoff to manage.
Evergreen’s complaint about its earlier collection of platforms was fragmentation. It wanted simpler operations, limited training and one system through which to see the organization. It selected Xcitium’s advanced endpoint protection. CIO Joseph Foran put the attraction plainly: “Everything is integrated, it all just works.” That is a customer endorsement published by the vendor, but it identifies a concrete buying motive.
Evergreen Life Services, as described in Xcitium’s 2023 case study. A workload ratio, not a product performance score.
Gem State Paper & Supply reached the product from a different direction. The distributor had experienced an encryption incident. Its technology leader, Rob Hufstetler, then sought an endpoint detection and response solution and selected Xcitium Advanced. The company’s account emphasizes visibility through one portal. One customer wanted fewer operational seams; another had already encountered the cost of an intrusion.
Healthcare buyers appear, too. Grand Bend Area Community Health Centre’s published case describes more than 112 endpoints serving over 17,000 patients. These examples locate Xcitium in a recognizable market: organizations with consequential systems and finite technical staff, plus the managed service providers that look after businesses like them.
Free code. Paid responsibility.
The catalog follows those different staffing needs. Advanced combines endpoint protection with EDR. Managed adds managed detection and response. Complete extends response across endpoints, networks and clouds. Related offerings include cloud workload protection and IT management. A customer can buy technology to operate or bring in people to operate security alongside it.
OpenEDR supplies another route in: free software with publicly available source code and endpoint telemetry. Free access does not remove the work of deployment, storage or investigation. Xcitium’s paid business sells subscriptions and managed services, directly and through channel partners. A useful quote therefore needs endpoint counts, service coverage and response scope; a single price without those details tells very little.
In March 2026, Xcitium announced ten free hours of certified breach response, which it valued at $3,500. That offer concerns response readiness, rather than the price of endpoint protection. Its operational insight is sensible: commercial arrangements are easier to settle before an emergency.
“Response should never begin with a contract review.”
Bill Barry / Xcitium / March 2026
The fine print matters
Xcitium received AV-TEST’s Best Advanced Protection 2022 award for corporate Windows protection, announced in March 2023. That is a specific external result worth considering. It does not establish that every configuration, operating system or future attack will behave identically. Xcitium’s historical zero-breach claim itself included the qualification “when fully configured.”
The engineering record supplies a useful counterweight to slogans. July 2026 release notes describe fixes involving ransomware encryption on network shares and a health-check action that could change an Office macro setting. Buyers can copy the discipline this suggests: pilot real applications, examine policy changes and establish who approves trust decisions. Containment requires careful boundaries; broad exceptions can weaken the premise.
The endpoint gets a bigger neighborhood
Xcitium’s newer moves widen the buying conversation. Managed EDR for Microsoft Defender, announced in March 2026, adds containment and round-the-clock SOC ownership around an existing Microsoft deployment. Here an alternative security platform becomes the foundation for a service. Managed AI, launched in November 2025, brings agent deployment and governance into the catalog.
On October 5, 2026, Xcitium and Roqos announced commercially available SASE, SD-WAN and zero trust network access capabilities. The company now wants to help connect branches and remote users as well as protect endpoints. The original question survives that expansion: while trust is being decided, what has already been allowed to happen?