01
Canary touch
Decoys sit where ransomware looks.
SafeLayer plants Office-style decoys in Documents, Desktop, and Downloads. The names resemble temporary Office lock files, so ordinary software usually ignores them.
Ransomware Shield
See encryption behavior while there is still time to respond.
SafeLayer watches for decoy documents being touched and sudden bursts of file changes—the two signals that point to an encrypting ransomware run.
- Signals
- Two independent
- Default rate
- 40 in 5 seconds
- Cooldown
- 15 seconds
- Response
- Notify and log
A deliberate early warning
Decoys and change patterns help make a developing event visible.
Two corroborating signals
Watch the files ransomware cannot help but reveal.
A decoy at either end of an alphabetical document list makes broad file enumeration more visible. A rolling view of modifications adds context before a single signal becomes an alarm.
02
Write-rate spike
A burst of changes raises the signal.
The shield counts file modifications in a rolling window and also observes deletions and renames—the changes an encrypting run makes to original files.
Calibrated response
Escalate the signal without interrupting legitimate work.
Canary touch
Warning
Write-rate spike
Warning
Both together
Critical alert
Response that respects the machine
A filesystem signal should prompt a person, not destroy their work.
Ransomware Shield