CyberIndexBeta

Product

CylancePROTECT is now sold by Arctic Wolf as part of Aurora Endpoint Security (Aurora Protect / Aurora Endpoint Defense), which provides AI-driven prevention, detection and response for endpoints. AI-driven prevention, detection, and response to stop endpoint threats before they disrupt your business. Recover quickly from cyber attacks and breaches, from threat containment to business restoration. Helping Solution Providers scale their business with a comprehensive portfolio of products and services. It runs on Linux, macOS and Windows.

Current Version
3.1.1000.537
Market
EnterpriseSMB
Licence
Paid
Price
Quote
Record Created
2026-08-20
Last Updated
2026-10-12

Vendor

Cylance made a claim in 2012 that sounded implausible and turned out to be influential: that a machine learning model, trained once and shipped to the endpoint, could block malware it had never seen without signatures and without needing to phone home. CylancePROTECT was the product, and the argument it started — about how much a static model can do on its own — shaped a decade of endpoint marketing. It has changed hands twice. BlackBerry bought Cylance in 2019 for 1.4 billion dollars, and in 2025 sold the Cylance endpoint business to Arctic Wolf, whose site the company's web address now leads to. Arctic Wolf sells the technology as Aurora Endpoint Defense, folded into its managed detection and response service. Products listed here under the Cylance name should be read with that in mind: the detection technology continues, the brand is being retired into Arctic Wolf's, and the company that sells and supports it today is a different one. Vendor page →

Country
United States
Headquarters
Irvine, United States
Year Established
2012
Customers
3,800 organisations
Users
14.5M devices protected
Revenue
$189.0M (2021)

Platforms

Linuxnative
macOSnative
Windowsnative

Target Market

Enterprise primarySMB secondary

Capabilities

Malware Detectionkeynative
Ransomware ProtectionkeyNot known
Behavioral DetectionkeyNot known
Web ProtectionkeyNot known
Email ProtectionNot known
Host FirewallNot known
Sandbox AnalysisNot known
Cloud-Assisted ScanningNot known
Heuristic Detectionnative
Device Controlnative
Vulnerability Shieldingnative
Central Management Consolenative

7 of 12 not yet known — not recorded, which is not the same as not supported.

Pricing

PlanLicencePriced perBilledPrice
SummaryPrice on requestnot statedno recurring chargeQuote

Versions

  • 3.1.1000.537macOS
  • 3.0.1005.38Windows
  • 2.0.1534Linux

The newest release each source names per platform, not every release the vendor has shipped. A release date is shown only where one is recorded.

Independent Tests

At a glance — latest result per lab test

MITRE ATT&CK Evaluations (Enterprise)

2023-09-20lab report ↗

Each bar is one lab’s own figure on that lab’s own scale. Labs test different models at different times, so the figures are not combined into one score.

MITRE ATT&CK Evaluations (Enterprise)MITRE ATT&CK Evaluations — Enterprise 2023 (Turla)2023-09-20
Technique-level detection: 33.6%Any detection: 78.3%Attack sub-steps evaluated: 143

Certifications

OESIS Framework SupportSupported1 activeSupported
OPSWAT Certified Security ApplicationGold1 activeGold

Change History

This record was created 2026-08-20. Everything below is what has changed since.

  • 2026-10-12Test result addedNew MITRE ATT&CK Evaluations (Enterprise) resultevidence
  • 2026-09-23Capability addedCentral Management Console: built inevidence
  • 2026-09-23Capability addedDevice Control: built inevidence
  • 2026-09-23Capability addedVulnerability Shielding: built inevidence
  • 2026-09-23Capability addedHeuristic Detection: built inevidence
  • 2026-09-22Product updatedListed in Enterprise Antimalwareevidence
  • 2026-09-22Product updatedListed in Small Business Antimalwareevidence
  • 2026-09-19Product updatedAlso sold to: SMBevidence
  • 2026-09-19Pricing plan addedPrice: price on requestevidence
  • 2026-09-09New versionNew version: 3.0.1005.38 (Windows)evidence
  • 2026-09-09New versionNew version: 3.1.1000.537 (macOS)evidence
  • 2026-09-09New versionNew version: 2.0.1534 (Linux)evidence
  • 2026-08-20Certification addedCertified: OESIS Framework Support (Supported)evidence
  • 2026-08-20Capability addedMalware Detection: built inevidence
  • 2026-08-20Pricing plan addedPrice: paidevidence
  • 2026-08-20Product updatedSold to: Enterpriseevidence
  • 2026-08-20New versionNew version: 3.1.1000.537evidence
  • 2026-08-20Platform addedRuns on macOSevidence
  • 2026-08-20Platform addedRuns on Linuxevidence
  • 2026-08-20Platform addedRuns on Windowsevidence
  • 2026-08-20Certification addedCertified: OPSWAT Certified Security Application (Gold)evidence
  • 2026-08-20Product createdNew product listedevidence

May we count your visit? CyberIndex would like to use Google Analytics to see which pages are read. It sets cookies and sends your visit to Google. Decline and nothing is loaded — the site works the same either way. Privacy.