EDR killers -- the key to ransomware operations

ESET research finds EDR killers are now among the most commonly used tools in ransomware intrusions, with attackers deploying legitimate but vulnerable drivers (BYOVD) or abusing built-in admin tools to disable endpoint detection before launching encryptors. The study warns of growing complexity—AI-assisted code traits, diversified RaaS affiliate tooling, and kernel-impact techniques—so enterprises should not rely solely on blocking drivers and must prioritize disrupting EDR killers before drivers load to reduce ransomware risk and operational impact.

Analysis

Attackers gaining outsized leverage from a small toolkit means defenders will pay premiums for controls that are not single-point failures. Expect accelerated budget reallocation away from standalone kernel-focused EDR to layered controls (network-level enforcement, identity hardening, immutable backups) — a shift that will concentrate spend towards larger platform players that can bundle those capabilities and smooth deployment across heterogeneous estates.

The vulnerable-driver problem creates a near-term legal and procurement externality: enterprises will demand supplier guarantees and indemnities from OEMs and driver vendors, and procurement teams will prioritize vendors offering rapid patch SLAs and signed, verifiable components. That dynamic favors large cloud/OS vendors and enterprise software vendors with deep support contracts and onshore engineering footprints, while fragmentary point-solution vendors without service leverage face margin compression or become M&A targets.

Catalysts unfold on multiple horizons. In weeks-to-months, expect elevated procurement activity and more conservative change-control in large enterprises (slower rollouts, more isolation of legacy endpoints). Over 6–24 months, regulatory pressure and insurer underwriting will force standardized mitigations (driver attestations, mandatory telemetry retention), producing non-linear revenue growth for vendors that already offer compliance and attestation features. A reversal would come from an attacker operational failure or a widely adopted cheap mitigation that neutralizes the asymmetric advantage — both low-probability but high-impact events.

For portfolio construction, the rational play is to long diversified platform/security providers and cloud-native network controls while using hedges to protect against headline-driven reratings. Size allocations should be tactical (3–6% of cyber sleeve) with option protection; avoid one-way exposure to single-feature EDR vendors without broader product suites.

Key Decisions for Investors

• Long Zscaler (ZS) — 6–12 month horizon: buy a calendar or 9–12 month call spread to express acceleration into network/cloud-centric controls. Target upside 20–35% if adoption accelerates; max loss is the premium paid (aim for ~3:1 reward:risk vs premium).
• Overweight Palo Alto Networks (PANW) — 12 month horizon: add on weakness as a platform play (network + cloud + Cortex). Size 2–4% portfolio; expected upside 15–25 if enterprise consolidation occurs, hedge with a 6–9 month out-of-the-money put for tail protection.
• Relative pair: long MSFT Defender/security suite (MSFT) / short pure-play EDR specialist (SentinelOne S or CrowdStrike CRWD) — 6–12 month horizon: go 1:1 dollar exposure. Rationale: shift to OS/cloud-integrated controls; target capture of 10–20% dispersion; hedge execution risk by limiting notional to 2% of portfolio.
• Buy catastrophe hedge via cyber-insurance re-pricing trade: long select reinsurers with diversified books (e.g., BRK.B sized allocation via index exposure) only if mandated reporting/regulatory moves materialize — trade horizon 12–24 months, asymmetric payoff if regulatory tightening forces premium expansion and capital raising.