Catch adversaries the moment they compromise an endpoint
Now available in research preview, Prelude's Runtime Memory Protection (RMP) comprehensively detects the execution of any malicious code on your endpoints. Because the only code that should run on your systems is your own.


Introducing runtime memory protection
.png)
Read our whitepaper on detecting out-of-context code execution in order to catch in-memory threats
Why focus on memory?
Your current endpoint security isn’t built to handle in-memory attacks
Attackers operate nearly exclusively in-memory—never dropping a file to disk, and use AI to obfuscate themselves with near-infinite creativity.
~75%
(and rising) of current cyberattacks are exclusively in-memory
50%
of zero-day vulnerabilities result in malware being run in-memory
90%
of attacks require code execution to occur at some point
Don’t believe us? Ask your red team.
Catch adversaries the moment that they compromise an endpoint by detecting malicious code execution
Rather than endlessly attempting to predict what an adversary might do, trapping adversaries at code execution allows us to focus all of our efforts on what they must do, regardless of their sophistication or how much creativity (or AI) they apply to their tactics.
Hardware-focused telemetry
Our user mode agent collects ground truth data from the CPU, watching every branch created, context switch generated and memory allocation.
Asynchronous processing at the edge
Hundreds of millions of events are processed, leveraging the compute available on modern endpoints. Rather than period memory scans with known signatures, we look for everything related to memory, performantly.
Queryless search
Snapshots of in-memory attacks are automatically created upon a violation. These snapshots are graphs, based on our ontology of the operating system.

Why memory?
Is RMP complementary to my existing endpoint defenses?
Completely complementary. In fact, our product Monitor is designed to ensure your AV and EDR agents (and other controls) are deployed and configured correctly to defend against attacks.
Why can’t my existing defenses catch these attacks?
The world has changed a lot since the last generation of endpoint defenses were architected. Existing endpoint security relies on infrequent memory scanning based on known signatures. Adversaries know this, and evade these techniques through creating novel permutations and flushing their work in memory.
How is this possible from user mode?
We gain comprehensive visibility into extremely granular OS operations through providers like Event Tracing for Windows (ETW), providing insight into the necessary activities to detect malicious code execution more comprehensively. We chose to trade the rarely-used capability of inline blocking (which historically has only existed in kernel mode) for the essential promise of comprehensive detection.
Why now?
For the first time—endpoints are powerful enough, hardware telemetry is available, and user mode is appropriate to process the magnitude of data needed to detect all memory events at runtime.
Ready to build the next generation of endpoint security?
Whether you're ready to learn or ready to build, find out more about how we're reimagining endpoint security.

