Heavy Analysis,
Lightweight Agent
The endpoint is where users actually do their work — and where most intrusions become real. CyberFortress Threat Hunter covers corporate devices without turning them into analysis workstations.
Events collected on the device are processed centrally by MA 360°, which runs the real-time detection. The agent stays small, fast and manageable; the advanced threat analysis happens in the platform core.
Central
Detection runs in MA 360°, not on the endpoint
YARA
Custom rule sets swept across every connected device
Air-gap
Kiosk and bridge modes for isolated networks
Always on
Tamper protection keeps the agent from being switched off
What runs on the endpoint
Protection, visibility and control — without the weight of a full analysis engine on every machine.
APT control on real channels
USB devices, file shares and downloads are the routes malware actually travels. Files arriving on any of them are checked against MA 360°'s real-time analysis before they get to run.
Automatic triage
Detections are ranked by severity on the device itself, so the security team sees the critical cases first and quiet, long-running malicious activity still surfaces instead of being buried.
Screen watermark
A dynamic watermark on screen deters data exfiltration by photograph or screenshot, and makes insider activity traceable back to a user and a session.
Tamper protection
Attackers disable security software early in an intrusion. Tamper protection blocks attempts to stop or remove the agent, keeping coverage continuously active.
Outlook & browser integration
Extra inspection lands in the two applications users spend their day in, catching malicious attachments and links at the point of interaction.
YARA rule sweeps
Run your own YARA rule sets across every connected endpoint and get detailed, centrally reported findings — the fastest way to answer "are we affected?" during an active campaign.
Protection inside air-gapped networks
Isolated networks are not a solved problem — they are a harder one. Files still have to cross the boundary, and when they do there is usually nothing watching.
The endpoint agent can be deployed in kiosk or bridge mode at that boundary. Media brought into the facility is analysed for malicious content before it is allowed any further, so safe file flow and real threat analysis are possible even on systems with no route to the outside world.
Kiosk mode
A dedicated station where staff scan removable media before it enters the secure zone.
Bridge mode
A controlled transfer point that analyses files as they move between isolated and connected segments.
Removable media
USB drives are treated as untrusted by default and inspected on every insertion.
Full audit trail
Every transfer and verdict is recorded for compliance and later investigation.
Where teams put it to work
The scenarios endpoint teams reach for most often once the agent is deployed.
Phish Control
When a user reports a suspicious message, Phish Control takes it from there — the attachment is detonated, the links are resolved and a spam review is started, all without an analyst touching it. Reports that used to sit in a queue become verdicts, and the reporting user gets an answer instead of silence.
USB and removable media control
Every device plugged into a corporate machine is treated as untrusted and inspected before its contents can execute — closing the oldest gap in endpoint security.
Compromise assessment
Push a YARA rule set from a fresh threat report across the entire estate and get a centrally reported answer on which machines match, in one sweep.
Insider risk and data loss
Screen watermarking plus endpoint telemetry makes it possible to see, attribute and evidence data leaving through a user rather than through the network.
APT hunting
Suspicious artefacts collected on the endpoint are sent back to the Malware Analyzer 360, turning a quiet anomaly into a named intrusion mapped to MITRE ATT&CK.
Isolated and regulated environments
Kiosk and bridge deployments extend real malware analysis into OT, defence and other air-gapped estates that normally run blind.
Deploy the agent on one department
Roll out to a single team, run a YARA sweep across their machines and see what a central analysis engine finds that a local scanner does not.
Datasheet also available in Türkçe.