Highlights:

  • Halcyon offers a platform that detects ransomware using artificial intelligence models built on the CapsNet (capsule neural network) architecture.
  • Halcyon plans to allocate the proceeds from its latest funding round to improve its technology and expand its customer base.

Recently, a startup leveraging capsule neural networks to combat ransomware attacks, Halcyon Tech Inc., secured USD 100 million in its Series C funding round.

The investment was led by Evolution Equity Partners, with participation from Bain Capital Ventures, Dropbox Ventures, and other institutional investors, including several of Halcyon’s existing supporters. The Austin-based software company now has a valuation of USD one billion.

Halcyon offers a platform that uses artificial intelligence powered by the CapsNet (capsule neural network) architecture to detect ransomware. This innovative AI modeling approach, introduced in 2017 by a team that included Geoffrey Hinton, employs unique mathematical operations distinct from those used in traditional AI models. These differences enhance its ability to identify specific patterns in data.

The company reports that its AI models have been trained on millions of ransomware-related data points, including details on breach tactics used in ransomware campaigns. Additionally, Halcyon provides its AI models with access to malicious files detected by its customers.

Many ransomware variants not only encrypt a victim’s files but also transfer copies to servers controlled by hackers, who then threaten to expose the data unless a ransom is paid. Halcyon claims its platform can identify ransomware by detecting attempts to exfiltrate files from an organization’s network.

Halcyon employs additional techniques to detect malicious activity, such as monitoring common breach indicators like file deletions and renaming on employee devices. To gather this data, the platform uses an agent—a lightweight program installed on each endpoint the company wants to secure.

Some ransomware variants try to evade detection by disabling the targeted system’s cybersecurity software. To counter this, Halcyon has developed an “endpoint armoring” feature designed to protect breach prevention applications from being compromised. Additionally, the platform can integrate with a company’s other threat detection tools by sharing the data it gathers on ransomware campaigns.

Detecting ransomware before it encrypts an organization’s files isn’t always feasible. To minimize data loss, Halcyon offers a feature capable of extracting the cryptographic key used by ransomware for encryption. With this key, decrypting compromised files becomes significantly faster, reducing recovery times from days or months to just a few hours.

“Ransomware victims paid over $1 billion in 2023 just to regain access to their own data and assets. One in every 10 organizations worldwide have been affected by ransomware and Halcyon’s unique technology is proven to prevent ransom payments and data loss to criminals,” said Bain Capital Ventures partner Enrique Salem.

Halcyon plans to use the funds from its recent financing round to further develop its technology and expand its customer base.