If it's not authorized, it doesn't happen.

Known-good enforcement is a security model that establishes a verified baseline of a system's authorized state, including its approved files, processes, services, and configuration, then evaluates every attempted change against that baseline at the kernel before it executes. Changes inside the baseline proceed. Changes outside it do not run. The model does not require knowing what an attack looks like, only what the authorized state looks like.

Mimic is an enterprise security platform that enforces known-good state at the kernel level. It profiles each protected system in its approved operational state, and that profile becomes the enforcement policy. Every later change attempt, whether a new binary, a modified registry key, an altered service, or an unauthorized process action, is evaluated at the kernel before it executes. Unauthorized changes are blocked and recorded.

The most reliable ransomware defense prevents encryption from executing rather than detecting it after files change. Ransomware depends on unauthorized change: encrypting files, writing registry persistence, altering services, and moving laterally. Mimic evaluates each of those changes at the kernel against a verified baseline of authorized system state and blocks the ones that fall outside it, without needing a signature or prior knowledge of the variant.

Endpoint detection and response identifies threats by matching activity against known attack patterns such as signatures, behavioral indicators, and threat intelligence. Ransomware that executes through signed binaries or approved administrative tools can pass through clean because no known pattern matches. Known-good enforcement asks a different question. If the change is not in the authorized baseline, it does not execute, whether or not the attack has been seen before.

Detection-based security asks whether an activity matches a known threat, which requires knowing the attack in advance. Known-good enforcement asks whether the change was authorized, which does not. A novel exploit with no signature, a signed binary performing unauthorized actions, a compromised AI agent holding valid credentials, and a misconfigured administrative script all fail the same enforcement question if their changes fall outside the authorized baseline.

Kernel-level security operates at Ring 0, the layer of the operating system that every file write, registry change, driver load, and process action must pass through. Tools that run above the kernel, including endpoint agents, can be disabled or bypassed by an attacker who reaches that layer first. Enforcement at the kernel evaluates change at the point where it either happens or does not.

Mimic does not identify ransomware. It identifies unauthorized change. Because encryption, persistence, and lateral movement all require modifying a protected system, Mimic evaluates each attempted modification against the known-good baseline at the kernel and blocks the ones outside it. No signature database, threat feed, or behavioral rule is consulted in the decision, so a previously unseen variant is treated the same as a known one.

Virtual patching protects a vulnerable system from exploitation without waiting for a vendor patch. Exploiting a vulnerability still requires making an unauthorized change to a protected component. Mimic evaluates that change at the kernel against the authorized baseline and blocks it, regardless of which vulnerability the exploit targets or whether a fix has shipped. This covers the exposure window between disclosure and patch deployment.

Frontier AI models have compressed the interval between vulnerability disclosure and a working exploit from weeks to hours, faster than enterprise patch cycles run. Enforcement closes that window differently from patching. Mimic evaluates the change an exploit depends on at the kernel and blocks it when it falls outside the authorized baseline, whether or not the vulnerability has a CVE, a public proof of concept, or a vendor fix.

Identity controls verify the actor. They do not evaluate the change the actor makes. An AI agent operating with valid credentials and approved tooling can therefore make changes that look legitimate to access management and endpoint tooling. Mimic evaluates the change itself at the kernel, enforcing the scope an agent has declared, so actions outside that scope are blocked regardless of credential validity.

No. Mimic is designed to run alongside EDR, XDR, SIEM, SOAR, and backup tooling rather than replace them. It operates at the kernel, below where endpoint agents run, so enforcement continues even when those tools are the target of an attack. Attempts to disable an agent, alter its configuration, or tamper with its data are themselves unauthorized changes.

Yes. Enforcement at the kernel does not depend on vendor support or patch availability. A system that will never receive another fix carries the same protection as a maintained one, because exploiting it still requires an unauthorized change and that change is evaluated before it executes. Where patching is no longer an option, enforcement remains one.

Active Directory is a common target because compromising it gives an attacker control over identity across the estate. Attacks against it work through change: modified objects, altered group policy, new service accounts, and tampered configuration. Mimic profiles domain controllers in their authorized state and evaluates those changes at the kernel, blocking modifications that fall outside the baseline before they take effect.

The change does not execute, and the attempt is recorded with process-level attribution, timing, and sequence. That record shows what was attempted, by which process, against which system, and in what order. Because the evidence is captured as enforcement acts rather than reconstructed afterward, audit and investigation start from a retrieval rather than a forensic rebuild.

Because unauthorized change is blocked before it alters the protected system, recovery does not begin from a compromised state. Mimic can trigger a snapshot from the moment an attack is attempted rather than on a fixed schedule, so restoration draws on a verified clean state rather than a time-based backup that may already contain the attacker's changes.