CylancePROTECT

CylancePROTECT is an enterprise endpoint protection product originally developed by Cylance and later sold by BlackBerry to Arctic Wolf on February 3, 2025. Arctic Wolf now presents the technology through Aurora Endpoint Security, formerly CylancePROTECT.

The product uses machine-learning-based analysis and policy controls to prevent malware and suspicious activity before execution. Its controls include threat prevention, memory protection, script control, application control, device control, and configurable exclusions.

Organizations can manage supported Windows, macOS, and Linux endpoints through a web console. Related mobile protection capabilities support Android and iOS through the CylancePROTECT Mobile product family.

AI-based malware prevention: The endpoint agent analyzes files and applications to identify malicious or suspicious content without relying solely on traditional signature updates.

Memory protection: Policies can detect process injections, malicious payloads, stack protection violations, and other memory-based exploit behaviors. Administrators can configure alert, block, terminate, or ignore responses.

Script and application controls: Administrators can control script execution, application behavior, device access, and policy exceptions. Windows 3.x agents use a consolidated memory protection configuration for several script and macro controls.

Cross-platform endpoint agents: Documentation lists supported agents for Windows, macOS, and Linux. Compatibility depends on the operating system release and agent version.

Centralized administration: The management console provides device policies, zones, event data, deployments, integrations, and administrative controls through a browser interface.

SIEM and syslog forwarding: Endpoint events can be forwarded to one SIEM solution or syslog server. Documentation warns that delivery may not be suitable for real-time monitoring.

API access: The current Aurora Endpoint Security API provides authenticated REST resources for registered organizations. Administrators can create applications, assign access privileges, and use application credentials.

Restricted-network deployment: CylanceHYBRID and CylanceON-PREM support environments with limited or prohibited internet connectivity. These options add infrastructure requirements and operational complexity.

Arctic Wolf does not publish a standard CylancePROTECT or Aurora Endpoint Security price on its official product page. Enterprise pricing is provided through a sales consultation and normally depends on endpoint count, product scope, deployment model, and service requirements.

Independent software directories display historical or indicative pricing, but those figures are not current official list prices. A free trial was not verified on the current official product or documentation pages.

Pros:

• Supports Windows, macOS, and Linux desktop environments.
• Combines malware prevention with memory, script, application, and device controls.
• Offers REST API access and SIEM or syslog event forwarding.
• Provides hybrid and on-premises deployment options for restricted networks.
• Independent review platforms report a 4.6 out of 5 overall rating.

Cons:

• Public pricing is unavailable, which complicates initial budget comparisons.
• Policy tuning can require security administration expertise.
• Independent reviews mention occasional false positives and configuration challenges.
• Product naming and ownership changed after the 2025 sale from BlackBerry to Arctic Wolf.
• SIEM forwarding documentation notes that event delivery should not be treated as real-time monitoring.

CrowdStrike Falcon is a cloud-native endpoint security platform with prevention, detection, response, and managed security options.

SentinelOne Singularity provides autonomous endpoint prevention, detection, response, and rollback capabilities.

Microsoft Defender for Endpoint suits organizations already invested in Microsoft 365, Entra ID, and Microsoft security services.

Sophos Intercept X combines endpoint prevention, exploit protection, ransomware controls, and managed detection options.

Trellix Endpoint Security provides enterprise endpoint protection, threat prevention, and centralized policy management.

Is CylancePROTECT still available?
Its technology remains available through Arctic Wolf’s Aurora Endpoint Security portfolio. Arctic Wolf identifies Aurora Endpoint Security as formerly CylancePROTECT.

Who owns CylancePROTECT?
Arctic Wolf acquired BlackBerry’s Cylance endpoint security assets on February 3, 2025. BlackBerry retained reseller rights for certain government customers.

Does CylancePROTECT have a free trial?
No current official free-trial offer was verified in the reviewed product and documentation pages.

What operating systems does it support?
Desktop documentation covers Windows, macOS, and Linux. Mobile protection documentation covers Android and iOS through CylancePROTECT Mobile.

Does it provide an API?
Yes. The current Aurora Endpoint Security documentation describes authenticated REST APIs and application credentials with configurable privileges.

Can it integrate with SIEM tools?
Yes. Administrators can forward endpoint events to a SIEM solution or syslog server. The documented integration supports one destination directly.

Is CylancePROTECT an EDR product?
CylancePROTECT primarily provides endpoint prevention and control. Detection and response capabilities are associated with related products such as CylanceOPTICS and the broader Aurora Endpoint Security platform.