System protection

The system under control. Your work, always protected.

Armor is anti-ransomware protection for Windows. It watches selected folders through decoy files and heuristic analysis of file operations; when it detects destructive behavior, it applies the configured response and records the event.

Choose your solution Learn more↓

Protected folders and decoy filesHeuristic behavior analysisIsolation, quarantine, and CDR

System protection

What Armor actually does.

Armor protects documents, images, archives, and projects inside configured folders. By default, it combines immediate decoy-file protection with heuristic evaluation of operations affecting other files. It can block suspicious activity, constrain the responsible process, and retain operational evidence. It does not replace an up-to-date backup.

Protected folders

Monitors selected paths and sensitive extensions, including configured subfolders.

Decoys and heuristics

Detects attempts against decoy files and modification sequences consistent with ransomware encryption.

Response and self-protection

Can block and terminate the process; self-protection and anti-injection defend Armor components.

Quarantine and allowlist

Keeps copies of items associated with blocks and grants exceptions only to trusted applications.

Isolation

Runs samples in a separate folder while blocking or recording file, Registry, process, and network activity.

CDR sanitization

Rebuilds documents, PDFs, images, and ZIPs while removing metadata and active content; executables and scripts are isolated.

Real interface

Visible protection, immediate actions.

The Armor console brings together protection status, monitored folders, decoy files, recent blocks, and shortcuts to primary activities.

Armor Protection dashboard showing active status, protected folders, decoy files, and recent blocks — **Protection**Anti-ransomware protection status and operational summary.

Armor Events page showing filters, search, and the recorded-events table — **Events**Search, filtering, and review of operational history.

Armor Protected folders page showing monitored paths, decoy files, and sensitive extensions — **Protected folders**Monitored paths, decoy files, and protected extensions.

Armor Quarantine page showing isolated items and restore, archive, and clear commands — **Quarantine**Management of isolated items and related actions.

Armor Allowed applications page showing exclusions and commands to add or remove applications — **Allowed applications**Controlled allowlist and exclusions from ordinary checks.

Armor Isolation console showing static and runtime analysis, severity, blocked actions, output, and operational verdict — **Isolation**Confined analysis with indicators, runtime events, and operational verdict.

Armor File sanitization page showing the CDR engine, security mode, and active-content removal options — **File sanitization**Safe document reconstruction and active-content handling.

Armor Options page showing language, process response, self-protection, network, isolation, and technical details — **Options**Protection configuration and component maintenance.

Armor Report page showing the operation timeline, expandable messages, and source details — **Report**Operational timeline with event messages and details.

System protection

From behavior to response.

Monitor decoy files and operations inside protected folders
Evaluate the process, action, and protection configuration
Block or allow, record the event, and preserve the configured evidence

Choose your solution

Buy