In short: Check Point anti-ransomware is a behavioural engine in Harmony Endpoint (now Check Point Endpoint Security). It detects illegitimate encryption without relying on signatures, quarantines every element of the attack, restores affected files from a protected local backup and produces a forensics report. It is included in the Advanced, Complete and Elite editions.
How Check Point anti-ransomware works
Most ransomware is new or repackaged by the time it reaches you, so a signature match alone is not enough. The anti-ransomware component in Harmony Endpoint works on behaviour instead. It runs inside the same agent as the rest of the product and does four things.
- Watches for ransomware behaviour. The agent monitors files and processes for the early signs that encryption attacks share, such as rapid file enumeration, deletion of shadow copies and illegitimate encryption of user data. Check Point's admin guide also describes decoy (honeypot) files that the agent places in common folders such as Documents, Pictures and the drive root: if a process starts modifying them, the attack is stopped straight away.
- Keeps a protected copy of files. Before ransomware can encrypt a file, the agent backs it up to a safe location on the device. Administrators can change which file types are covered, the largest file that is copied, how much disk space the backup may use and how often a changed file is copied again.
- Stops and cleans up. When an attack is confirmed, the malicious process is terminated, the files involved in the attack are deleted and the elements of the attack are quarantined.
- Restores and reports. Encrypted files are restored automatically from the backup, either to their original location or to a folder you choose, and a forensics report is created so you can see the full chain of events.
Each policy can run the component in Prevent (the attack is remediated, with logs, alerts and a forensics report), Detect (logs, alerts and a forensics report only) or Off. We usually pilot in Detect and move to Prevent once we are happy there are no conflicts with your applications.
The layers around it
Anti-ransomware is strongest as one layer among several. In the same agent, and in every current edition, you also get:
| Layer | What it stops |
|---|---|
| Behavioural Guard | Malware variants classified and blocked by how they behave, not by a file hash |
| Anti-exploit | Attacks that abuse a flaw in a legitimate application; the exploited process is shut down |
| Anti-malware and anti-bot | Known malware, and infected devices trying to reach attacker command-and-control servers |
| Threat Emulation and Threat Extraction | Weaponised downloads and attachments, detonated in a sandbox or delivered as sanitised copies |
| Zero-phishing and password reuse protection | Credential theft that often comes before a ransomware attack (see Harmony Browse) |
| Network share protection | Encryption of shared folders on the network, whatever the file-sharing protocol (an advanced setting) |
| Volume encryption tool blocking | Attackers using built-in tools such as BitLocker to encrypt drives or change the encryption on them (an advanced setting) |
Check Point's solution brief also lists Intel TDT (Intel Threat Detection Technology), which adds processor-level protection on supported Intel hardware, as part of anti-ransomware. Detection draws on ThreatCloud AI, Check Point's shared threat intelligence, so new indicators reach your devices without waiting for you to update anything.
One practical point: if you use the volume encryption block and also plan to encrypt drives with BitLocker, encrypt the drives first or pause that protection while you do it. We plan this with you during deployment.
Forensics: how did the attack start?
Restoring files is only half the job. You also need to know how the attacker got in, so it does not happen again. When the anti-ransomware component fires, Harmony Endpoint starts forensic analysis automatically and presents the whole attack sequence as a forensics report. Check Point's admin guide lists what the report covers:
- Entry point: how the malicious file got onto the device
- Business impact: which files were affected and what was done to them
- Remediation: which files were treated and their current status
- Suspicious activity: the unusual behaviour the attack caused
- Incident details: a visual map of the attack's path through the system
Events are also mapped to MITRE ATT&CK tactics and techniques on a dashboard, and the report can be downloaded in JSON for your own tools. If the ransomware arrived by email, Behavioural Guard can add details of the message to the report through an add-in for Microsoft Outlook. From the console you can then isolate the device, remediate files and hunt for the same indicators on other machines. Our Harmony Endpoint EDR and XDR page covers those tools in more depth.
Which editions include anti-ransomware?
All three current packages include it, so you do not need to buy anti-ransomware separately.
| Edition | Anti-ransomware with file restoration | Also adds |
|---|---|---|
| Harmony Endpoint Advanced | Included | Prevention, browser security, EDR, sandboxing and CDR |
| Harmony Endpoint Complete | Included | Full disk and removable media encryption |
| Harmony Endpoint Elite | Included | Infinity XDR for Endpoint, posture management and DLP |
The editions comparison has the full feature table, and the pricing and licensing guide explains how subscriptions work.
Anti-ransomware is not a backup
The automatic restore covers files on a protected device during an attack it detects. It does not replace proper backups of servers, cloud data and line-of-business systems, and it cannot help with data that was stolen before encryption.
The NCSC's guidance, *Mitigating malware and ransomware attacks*, is a good checklist for the wider picture. It recommends regular, tested backups with copies held offline or separately from your network, filtering of email and web traffic, multi-factor authentication on every remote access point, prompt patching (especially of remote access and internet-facing devices), limits on which applications, scripts and macros can run, and an incident response plan that you exercise regularly. Harmony Endpoint helps with several of these: posture management handles patching, browser security filters the web, and Check Point MDR can provide the round-the-clock response team that many smaller organisations lack.
How we help
Forever Systems scopes, deploys and supports Harmony Endpoint for UK organisations. For ransomware readiness we typically:
- review where your current antivirus leaves gaps, and pilot Harmony Endpoint in Detect mode on a sample of devices
- tune the backup settings, file types and exclusions so protection does not get in the way of everyday applications
- move policies to Prevent, set alerting and agree who acts on a forensics report
- check your backups, patching and remote access against the NCSC guidance and the Cyber Essentials requirements
Contact us for a proof of value or a quote.
How Forever Systems supplies and supports Check Point Harmony
We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.
- Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
- Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
- Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
- Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
- Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.
Want a Check Point Harmony quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Can Check Point anti-ransomware restore encrypted files?
Yes. Before ransomware can encrypt a file, the agent backs it up to a protected location on the device. When the attack is stopped, the files involved in the attack are removed and the originals are restored automatically, to their original location or to a folder you choose.
Does Harmony Endpoint stop ransomware it has never seen before?
It is designed to. Anti-ransomware works on behaviour, such as illegitimate encryption, shadow copy deletion and changes to decoy files, rather than relying on a signature for each strain. Behavioural Guard, anti-exploit and sandboxing add further layers.
Is anti-ransomware included in Harmony Endpoint Advanced?
Yes. Anti-ransomware with automatic file restoration is part of every current package: Advanced, Complete and Elite.
Do I still need backups if I have Harmony Endpoint?
Yes. The restore protects files on endpoints during a detected attack. You still need tested, separate backups of servers, cloud services and business data, as the NCSC's ransomware guidance recommends.
Does Check Point anti-ransomware protect network shares?
Yes, as an advanced setting. Network share protection covers shared folders on the network whatever the protocol, but Check Point notes that remote devices are not protected, so an unprotected machine could still reach a share. We look at server protection and backups as well.
Does Check Point anti-ransomware work on Macs and Windows Server?
Check Point's client requirements list the Anti-Ransomware and Forensics capabilities for macOS and for supported Windows Server versions, as well as Windows workstations. Support varies by platform and client version, so we confirm coverage for your estate before you buy.