Deckhand Endpoint and server malware protection

The gateway protects the boundary. Deckhand protects what is behind it, because laptops leave the building, USB sticks arrive in pockets, and a threat that starts inside never crosses the boundary at all.

It is deliberately small. It installs in minutes, uses very little of the machine it runs on, and does not interrupt the person using it. From the inside it keeps a running inventory of the software installed, watches for files and behaviour that match known malware, controls which removable devices are allowed to be used, and can restrict which programs are permitted to reach the internet at all.

Everything it learns goes back to one place, so you can answer the questions that are otherwise a week of work: which machines are missing this update, which machine had that file, which laptop has not checked in since last month.

When something needs doing, it can be done from the console rather than by walking to the desk: quarantine a malicious file, block an address, stop a service, collect what an investigation needs, push an update. On machines old enough that most vendors have given up, there is a build that still works.