Ransomware Protection

• Stop file encryption attacks instantly and automatically.
• Deploy once and protect forever — no ongoing configuration needed.
• Autonomous on‑device detection using a single, signature‑less algorithm — no cloud, sandbox, or decoys needed.
• Automatic file recovery ensures no data loss — encrypted files are instantly restored.
• Flexible deployment with choice of user‑mode or kernel‑mode protection based on your resiliency requirements.
• Protects against both local and remote ransomware, including attacks originating from unmanaged or under-protected outdated machines.

Data Exfiltration Protection

• Block unauthorized file exfiltration to any destination, including hidden archive transfers.
• Preserve legitimate cloud storage sync while blocking unknown attacker‑controlled accounts.
• Patent-pending on‑device algorithm operates without signatures or cloud reputation.
• Outperforms traditional DLP (Data Loss Prevention) without the complexity of policies and maintenance.
• Zero-touch deployment — no ongoing management required.
• Flexible user‑mode or kernel‑mode deployment based on resiliency requirements.

Security hardening

• Strengthens Windows kernel architecture to prevent BYOVD attacks.
• Autonomous on‑device protection without signatures or cloud dependencies.
• Blocks vulnerable driver attacks through design — no reliance on blocklists.
• Prevents kernel‑mode attacks that evade EDR tamper protection.
• Enhance third-party tamper protection of solutions from CrowdStrike, Cylance, Microsoft Defender, SentinelOne, Sophos, and Sysmon.
• No performance impact while maintaining full application compatibility.

Presence verification

• Hardware‑enforced authentication that strengthens Windows security architecture.
• Physical security key validation independent of Windows Hello biometrics.
• Autonomous on‑device protection without signatures, AI, or behavior monitoring.
• Prevents remote adversaries from abusing compromised domain admin credentials.
• Enhances UAC with hardware-backed authentication.
• Compatible with industry‑standard FIDO U2F security keys for both workstations and domain environments.
• Transparent to legitimate administrative workflows.

Private Endpoint Detection and Response (EDR)

• Typical EDR solutions send endpoint telemetry to an EDR platform in the cloud where it is correlated and analyzed. This means that this cloud has access to potential sensitive or confidential company information.
• Private EDR leverages existing forensic information readily available on an endpoint for correlation and analysis. Reclaim your privacy and network bandwidth!
• As shown in the screenshot, Private EDR can tap into third party tools like Sysmon to augment forensic information.

Root Cause Analysis (RCA)

• When Ranger triggers an alert you can view the alert and the events associated with it.
• Unlike other solutions that record massive amount of information, the events shown in the RCA screenshot are gathered from various forensic sources readily available on an endpoint like NTFS USN records, Event Log information and Sysmon (if present).

Scan & Clean

Graphical user interface

• Ranger is a Windows application that has a user interface that is based on the Fluent Design System which matches that of Windows for seamless integration.
• Supports dark and light mode.