Halcyon

• Halcyon's own solutions pages sell the platform as a supplement to the buyer's existing endpoint tool. An endpoint vendor that adds ransomware-specific prevention and recovery to a product the customer already pays for removes the reason to fund a second agent.
• No third-party technical evaluation of the platform appears in the reviewed sources. A buyer who insists on independent efficacy testing before purchase has nothing in the public record to read.
• No independently verified measure of Halcyon's scale exists in the record. The 100-plus enterprise brands were the chief executive's figure in TechCrunch in 2023, and the Business Journal's triple-digit quarterly additions in 2026 carry no named source at all. If growth slows, nothing outside the company would show it.
• The ransomware warranty commits Halcyon to fund incident response and recovery when its own product fails. The reviewed sources do not state the warranty's limits or exclusions, so nothing in the public record bounds what a bad quarter would cost Halcyon under it.

Halcyon sells against one threat, and it argues that the tools already deployed cannot handle it. Its own account is that ransomware crews find ways to bypass endpoint controls, disable the products meant to stop them, and destroy backups before demanding payment, which is why the company builds a layer that assumes the rest of the stack has failed.

The pain is quantified outside the company's pages. The San Diego Business Journal opens on a figure of upwards of $32 billion lost by Americans to ransomware in 2025. TechCrunch cited the tracing firm Chainalysis for victims paying ransomware groups well over $400 million by July 2023.

The buyer Halcyon reaches is broad rather than narrow. The Business Journal reports customers across healthcare, financial services, manufacturing and legal work, and the company runs dedicated pages pitching lean small-business security teams and the managed service providers who resell the product from a multi-tenant console. Its president told the same paper that downtime of roughly 22 to 23 days is what a typical attack costs, and that small and midsize firms cannot absorb that. [s15, s8, s3, s5, s19, s20]

The Halcyon Anti-Ransomware Platform runs as one lightweight endpoint agent, as SecurityWeek describes it, acting at several points in an attack. Before execution it blocks known-bad files and hands suspicious unknowns to further layers, a design SecurityWeek also describes. During an attack, features the vendor calls EDR Last Gasp and Tamper Guard defend the customer's other security software from being switched off, and a data exfiltration component warns when an attacker starts moving data out.

The distinctive piece is recovery. Halcyon says it intercepts the encryption keys and cryptographic material an attack generates, then decrypts the affected files, which gives a customer a path back that does not depend on backups. SecurityWeek also reported that the product exploits behavior hardcoded into ransomware itself to make attacks abort or reveal themselves.

The engines behind this are trained narrowly. The vendor says its models are trained exclusively on ransomware signals drawn from attack techniques, samples, playbooks and its own incident response work, and that a behavioral engine adds threat modelling, anti-detonation and deception. In July 2026 the company added File Resilience, which the Business Journal reported intercepts encryption at the Windows kernel, and macOS support followed in August. [s2, s5, s12, s3, s15]

Halcyon positions itself beside the endpoint stack rather than in place of it. Its solutions pages offer the product as a supplement to endpoint detection and response and to backup products, and its story page says the platform works within the security ecosystem the customer already has. That is an easier sale into an installed base and a harder one against a budget that already funds an endpoint agent.

The company's argument for why the incumbents do not cover this is one of focus. Its homepage says generalist tools were not built for ransomware and that Halcyon was built for nothing else, and its chief executive told TechCrunch in 2023 that the company saw no direct competitors and wanted to improve the other security tools its customers ran. That claim is the vendor's own and the reviewed sources do not test it.

Independent coverage has settled on the company's own vocabulary. TechCrunch and SecurityWeek have both called Halcyon an anti-ransomware company since 2023 and the Business Journal called it a ransomware resilience platform in 2026, so the company's framing travels in other outlets' voices rather than only in its own. [s3, s1, s10, s8, s9, s12, s15]

Named customers exist and come from one outlet. The San Diego Business Journal reported in August 2026 that Halcyon's customer base includes Simon & Schuster, Toyota Financial Services and the Utah Jazz. The same article puts the bulk of new customers in healthcare, financial services, manufacturing and legal work.

Growth figures are relayed by reporters rather than measured by them. Halcyon's chief executive told TechCrunch in December 2023 that the company counted over 100 enterprise-level brands plus state-level school districts, and the Business Journal reported in August 2026 that new customers were arriving in the triple digits each quarter without naming a source for the count. The headcount reference point is older still, a 75-person workforce in December 2023 that the company then planned to double.

Only part of the capital is documented in a filing. SecurityWeek reported the total raised at $190 million after a $100 million Series C at a $1 billion valuation in November 2024. Separately, a Form D on file for Halcyon Tech reports $125,276,993 sold against $127,793,981 offered, with 31 October 2024 as its date of first sale. That filing names no round, so which raise it covers is not established by the reviewed record. [s15, s8, s12, s6]

The founders' backgrounds are verifiable and in the right domain. TechCrunch's December 2023 piece names Cylance and Accuvant as the firms Jon Miller and Ryan Smith came from, later acquired by Blackberry and Optiv. Its April 2023 piece adds the defense contractor Boldend and reports that the two started Halcyon after the Colonial Pipeline attack in 2021 while asking why ransomware kept growing despite widespread security spending.

Regulatory and patent records corroborate the roster rather than the résumés. A Form D for Halcyon Tech lists Jon W. Miller, Ryan Smith and Jay Leek among the company's officers and directors, and the granted US patent on key material capture names Ryan Smith and Jonathan Miller among its five inventors alongside Peter Morgan, Kristen Lamb and Clark Lindsey.

What the reviewed record does not show is a product either founder built before this one, or an exit of their own. The San Diego Business Journal names Scott Stout as president, and he is the executive who speaks for the company in its most recent independent coverage. [s8, s10, s6, s17, s15]

Halcyon runs a SafeBase-hosted trust center at trust.halcyon.ai, probed on 4 September 2026. It lists a SOC 2 Type 2 compliance record and gated documents including a penetration test report, a SOC 2 report, a data flow diagram and a CJIS statement, each behind a Get access control.

Privacy commitments extend to cross-border transfers. The trust center states that Halcyon participates in the EU-U.S. Data Privacy Framework, its UK extension and the Swiss-U.S. framework, and describes a security program covering vulnerability management, penetration testing, business continuity planning, incident response and vendor risk.

The assurance a buyer can inspect without a request is therefore the ordinary commercial set. No government authorization for the product appears in the reviewed sources, and the compliance artefacts the trust center lists are the ones any funded competitor selling into enterprises would also obtain. [s18]

Add analyzed competitors to compare them side by side with Halcyon.

Halcyon leads with the threat rather than the buyer, then pitches the same platform to each size of customer separately. A dedicated page pitches lean small-business security teams on affordable hands-free protection, another pitches managed service providers on a multi-tenant console and an add-on that slots into what they already sell, and industry pages span education, energy, federal, finance, government, healthcare, manufacturing, retail, technology, telecommunications and transportation.

The industries the outside coverage names are narrower than that list. The San Diego Business Journal reported in August 2026 that new customers arrive in the triple digits each quarter, mostly in healthcare, financial services, manufacturing and legal work, a figure the article carries without naming a source for it. Its president argued in the same piece that small and midsize firms are especially exposed, because the 22 to 23 days he gives as a typical outage is a debilitating loss for them.

Earlier coverage points the same way at the top of the range. TechCrunch reported in December 2023 that the company counted over 100 enterprise-level brands as clients along with state-level school districts, a figure that came from its chief executive rather than from the reporter.

Halcyon narrows what its models have to learn, and that narrowing is the technical claim. Halcyon says its detection models are trained exclusively on ransomware signals drawn from active attack techniques, samples, playbooks and real-world incident response engagements, and SecurityWeek's report describes the same design, a lightweight agent combining prevention engines with models trained solely on ransomware, in a piece that repeats the company's account rather than testing it.

Two mechanisms in the chain are not ordinary endpoint features. The behavioral engine uses anti-detonation and what the vendor calls deception exploitation, tricking ransomware into revealing itself by exploiting behavior hardcoded into the malware, a technique SecurityWeek also reported. Separately, features named EDR Last Gasp and Tamper Guard exist to keep the customer's other security software running while an attacker tries to switch it off.

Recovery is where the technical claim is strongest and best documented. Halcyon says it intercepts encryption keys and cryptographic material during an attack so files can be decrypted afterwards, and a granted US patent titled Signatureless key material capture, filed by Halcyon Tech in September 2025 and granted in January 2026, describes capturing key material through a telemetry component.

No self-service purchase path appears in the reviewed pages, and no trial, price list or sign-up flow appears either.

Other companies' products carry part of the pitch. The homepage advertises a Halcyon and Dell combination for ransomware-resilient PCs and a Halcyon and backup-solutions combination for keeping backups safe, without naming a backup vendor. Dell Technologies Capital took part in the Series A, which TechCrunch reported in April 2023.

Independent naming of customers is thin but real. The San Diego Business Journal listed Simon & Schuster, Toyota Financial Services and the Utah Jazz in August 2026, which is the outside account of who buys the product that the reviewed record carries.

No price appears anywhere in the reviewed sources. No rate, tier or per-endpoint figure appears in the reviewed pages.

What the company does publish is what a buyer does not pay extra for. The 24/7 Ransomware Operations Center is described as included at no additional cost, and the ransomware warranty covers expert-led incident response and recovery at no extra charge if an attack bypasses the platform. Both are stated by the vendor and neither is corroborated in the reviewed record.

Bundling the human service into the product changes what the buyer compares. Rather than weighing a tool against a tool, the buyer weighs a tool plus a staffed team against whatever ransomware coverage their existing endpoint vendor and their own analysts provide.

Delivery is one lightweight agent, as SecurityWeek describes it, plus a service the vendor staffs. Halcyon says its experts monitor the customer environment around the clock, investigate potential ransomware activity, respond when they find it, and lead the recovery including decryption from captured key material.

The operating promise is that the customer's own team does less rather than more. The vendor states that no new headcount or retraining is needed and that it contacts the customer only when it finds something suspicious, which is an explicit answer to the alert-volume objection a second endpoint agent usually raises.

Platform coverage widened during 2026. The San Diego Business Journal reported that File Resilience shipped in July, intercepting encryption at the Windows kernel, and that macOS support arrived in August, extending protection across Windows, macOS and Linux.

Halcyon runs a SafeBase-hosted trust center at trust.halcyon.ai, probed on 4 September 2026. It records a SOC 2 Type 2 compliance status and puts a SOC 2 report, a penetration test report, a data flow diagram and a CJIS statement behind a Get access control.

The published program description covers the usual ground. It names information security policies, vulnerability management, penetration testing, business continuity and disaster recovery planning, incident response procedures, employee security training, vendor risk management and ongoing monitoring, and states participation in the EU-U.S. Data Privacy Framework, its UK extension and the Swiss-U.S. framework.

The gap a buyer will notice is efficacy rather than governance. No third-party technical evaluation of the platform appears in the reviewed sources, and the figure block on the company's homepage is attributed there to a 2026 UserEvidence survey.

Halcyon designs to sit inside a stack it does not own. Its story page says the platform works within the customer's existing security ecosystem as an added detection and protection layer, and the homepage pairs Halcyon with endpoint detection and response, offering to supplement the buyer's EDR, and with backup solutions.

That posture makes several of its features defensive of other vendors' software. EDR Last Gasp and Tamper Guard exist to keep the customer's endpoint product alive under attack, which is an unusual thing for a security vendor to build, and its chief executive told TechCrunch in 2023 that the company wanted to improve the other security tools its customers ran.

Hardware and operating-system reach extend the same idea. The company markets ransomware resilient PCs with Dell, and the Business Journal reported integrations with Microsoft Defender and Microsoft Sentinel at the File Resilience launch.

The founding pair came out of the endpoint industry they now sell against. TechCrunch reported in April 2023 that Jon Miller and Ryan Smith started Halcyon after the Colonial Pipeline attack in 2021, asking why ransomware kept growing despite widespread security spending, and named the defense contractor Boldend among their prior employers. Its December 2023 piece names Cylance and Accuvant, the firms Blackberry and Optiv later acquired.

Filings and patents corroborate who runs the company. The Form D for the $127,793,981 offering names Jon W. Miller, Ryan Smith and Jay Leek among its executive officers and directors, and the granted key-capture patent lists Ryan Smith and Jonathan Miller as inventors alongside Peter Morgan, Kristen Lamb and Clark Lindsey.

Scale and leadership have both moved since. TechCrunch put the workforce at 75 people in December 2023 with a plan to double it during 2024, and the San Diego Business Journal named Scott Stout as president in August 2026, the executive who speaks for the company in its most recent independent coverage. The newest source settles the headquarters and the older ones record an earlier base. SecurityWeek called it an Austin, Texas-based company in 2023 and again in 2024, and a Form D gives 5900 Balcones Drive in Austin as the principal place of business, while the Business Journal's fact box of August 2026 gives San Diego as headquarters and reports that an Austin office opened earlier that year.