Enterprise-grade protection for the price of a coffee
Enterprise-level ransomware containment and integrity assurance, packaged for lean teams and tight budgets. Lightweight by design, so you get strong protection without paying for complexity.
Automatic Ransomware Protection
Built For SMEs & Startups
Click to Play product video
Eliminate the threat of ransomware and keep your business running for less than the price of a coffee per month.
Our Industry Partners
Core Capabilities
Powerful by Design
Built to contain ransomware and enforce trust through cryptographic verification
Simple & Light
Designed to be lightweight and effortless, delivering powerful protection without adding complexity.
Flexible
Runs on Windows 7 and later, macOS (Apple Silicon), with Linux support coming soon
Super Fast
Engineered for speed, without sacrificing security.
Novel
A groundbreaking approach that redefines cyber resilience.
Ransomware Resilience Layer • For SMEs & small IT teams
EDR is necessary.
Resonance makes ransomware response operational.
Resonance complements your existing endpoint stack with ransomware-focused readiness checks, encryption-in-progress detection, and guided response modes, so you can stop ransomware quickly without guesswork or a 24/7 SOC.
Readiness score + Quick FixesDetect encryption behaviourAvailability-first or Containment-firstProtect recovery points
What SMEs typically struggle with
Even with an EDR deployed, ransomware outcomes depend on the full prevent → contain → recover loop. Small teams often face gaps in operationalization, tradeoffs between isolation vs uptime, and inconsistent rollback constraints.
Resonance focus
Stop encryption fast • Preserve recovery • Reduce burden
Purpose-built controls: posture checks, encryption suppression options, file containment, and recovery readiness signals.Three layers that close the ransomware loop
Resonance is designed to help small teams act faster, before encryption spreads, and without relying on deep tuning or constant triage.
1) Readiness
A ransomware posture score across critical hardening, credential protection, remote access exposure, and recovery readiness, plus Quick Fix actions for supported settings.
Defender baselineControlled Folder AccessSMBv1 / RDP NLASystem Restore / VSS checks
2) Detect encryption in progress
Catch ransomware-style damage using file change patterns and content signals, designed to identify the act of encryption, not just a known malware name.
Integrity burst detectionRename/extension “storms”Shannon entropy signals
3) Respond with the right mode
Choose between low-disruption controls that buy time (availability-first) or decisive containment controls (containment-first), with TTL-based safety rails to avoid permanent disruption.
Per-process throttlingKill process treeHost isolationFile quarantine / CFA
How it works
Step 1: Assess & fix the basics
Get a ransomware posture score aligned to real attack paths (hardening, identity protections, remote exposure, recovery readiness). Apply Quick Fix actions for supported controls to close gaps quickly.
Step 2: Watch for ransomware-style activity
Detect encryption-in-progress with integrity burst patterns and entropy-based content signals. Escalate confidence as signals correlate.
Step 3: Take action with guided response
Apply availability-first controls to slow damage while keeping users productive, or switch to containment-first actions to stop spread when confidence is high.
Step 4: Protect recovery points
Validate local restore readiness (System Restore/VSS presence) and apply protective measures to backup directories (where supported) during suspected ransomware activity.
Resonance vs Traditional EDR
EDR provides broad endpoint detection and response. Resonance is the ransomware-focused layer that helps SMEs operationalize the loop, especially around readiness, encryption behaviour, and “what to do now” response modes.
| Capability area | Typical EDR | Resonance |
|---|---|---|
| Ransomware readinessHardening, exposure, recovery readiness | VariesOften available, but requires configuration discipline and ongoing checks. | Built for SMEsPosture score + Quick Fix actions for supported controls (e.g., Defender baseline, CFA, firewall, SMBv1, RDP NLA, restore readiness). |
| Detect encryption-in-progressDamage signals vs malware names | VariesBehavioural engines exist, but coverage and operationalization vary by vendor/tier. | Dedicated signalsIntegrity burst detection + entropy-driven likelihood to spot ransomware-style encryption early. |
| Business continuity controlsBuy time without pulling the plug | Limited / add-onSome tools jump straight to isolation; others require playbooks or MDR. | Availability-first modePer-process throttling, encryption dampening, folder protections, designed to reduce damage while staying operational. |
| Containment controlsStop spread when confirmed | CommonIsolation and quarantine are common EDR actions. | Guided containment-first modeKill process tree, host isolation (policy-controlled), quarantine files + controlled folder access, TTL-based guardrails. |
| Recovery-path protectionPreserve what you’ll need to restore | VariesRollback/restore mechanisms differ; windows and scope depend on the underlying approach. | Reduce surprisesRestore readiness signals + protective measures for local backup directories (where supported) during ransomware suspicion. |
| Operational burdenSmall team reality | Often heavyAlert triage and tuning can be hard without dedicated security staff. | Designed for small teamsOpinionated readiness checks, guided modes, and safe defaults to make response easier to run day-to-day. |
Note: Specific EDR feature depth varies by vendor, tier, and MDR/XDR add-ons. Resonance is designed to complement, not replace, your endpoint stack.
Common use cases
Microsoft-first SMEs
Add continuous ransomware readiness validation and encryption-in-progress detection on top of a Defender-based estate, then respond with clear availability-first or containment-first modes.
MSP-led security bundles
Standardize ransomware posture and response across clients with a consistent score, remediation options, and guided response controls that reduce on-call burden.
Best-of-breed EDR buyers
Keep your primary EDR, and use Resonance for ransomware-specific readiness, early encryption detection, and practical response controls that match business continuity constraints.
FAQ
Do we have to replace our EDR?
No. Resonance is designed to complement existing endpoint security and make ransomware readiness and response easier to operationalize for SMEs.
What does “availability-first” mean?
It means using lower-disruption controls (like throttling and protective folder controls) to slow or suppress encryption and preserve recovery while keeping endpoints usable, before escalating to full isolation.
What does “containment-first” mean?
It means applying decisive actions when confidence is high: terminating encryption activity, isolating the host, and quarantining suspect files. Many controls include TTL-based guardrails to reduce the chance of accidental long-lived disruption.
Does Resonance provide full rollback like some EDR vendors?
Resonance focuses on earlier detection and rapid response to reduce the amount you need to roll back, plus readiness signals and protective measures around restore points and local backup directories (where supported). Your rollback/restore approach still depends on your broader backup strategy and platform.
Which platforms are supported?
Deployment and hardening capabilities are OS-dependent. Many readiness and response controls are Windows-focused. Contact us for an up-to-date support matrix.
Platform overview
Ransomware defence by Design
A practical, layered defence model that helps teams contain threats quickly, protect endpoint integrity, and minimise operational disruption.
Legacy system support
Protects Windows 7 and above today, supports macOS on Apple silicon across generations, with Linux support on the roadmap. Ideal for mixed estates where older endpoints still matter.
Supports and complements your XDR
Designed to run alongside your existing EDR/XDR rather than replace it. Adds an independent integrity and containment layer that fits neatly into existing SOC workflows.
Built for peace of mind
Install, activate, and you are protected with sensible defaults. The MVP reduces decision fatigue with clear outcomes and minimal tuning.
Fast, quick deployment
Roll out in minutes with minimal onboarding friction. Keep endpoints protected quickly, with a straightforward path for managed updates.
On-device protection, privacy-first
Threat decisions are made on the endpoint, avoiding telemetry-heavy cloud processing. The service stays focused on essentials such as licensing, updates, and optional health or posture reporting.