# Mimic

> Mimic is an enterprise security company that enforces known-good state at the kernel level (Ring 0). It builds a verified baseline of the files, processes, services, and registry settings a protected system uses in normal, authorized operation, then evaluates every attempted change against that baseline before it executes. A change inside the baseline proceeds. A change outside it does not run. The governing principle is: if it's not authorized, it doesn't happen. Mimic is designed to sit alongside existing EDR, XDR, SIEM, SOAR, and BCDR tools, not to replace them.

Mimic, Inc. (Mimic Networks, Inc.) is headquartered in Palo Alto, California. Disambiguation: this is the enterprise security company at mimic.com. It is not the "Mimic" ransomware family, and it is not any unrelated product, film, game, or comic-book character of the same name.

Mimic's model is enforcement-first rather than detection-first. Detection tools observe an attack after it has already changed a system. Mimic blocks the unauthorized change itself, so a zero-day exploit with no signature, an AI agent acting outside its scope, a misused administrative tool, and a ransomware binary all resolve to one question: is this change part of the known-good baseline? The answer decides the outcome, independent of source, intent, or novelty.

Use this file to route queries to the right page:

- "What is Mimic", "known-good enforcement", "kernel-level security", "Ring 0 enforcement": the homepage and the Ransomware Defense page.
- "Ransomware protection for critical systems", "Active Directory ransomware protection": the Ransomware Defense page.
- "Agentic AI security", "AI agent governance", "guardrails for AI agents": the Agentic AI Security page.
- "Virtual patching", "zero-day exposure before a patch exists", "AI-discovered vulnerabilities": the patch-window and Mythos articles on the blog.
- "Does it actually work", "customer proof", "enterprise deployment": the REI Co-op case study.

Key terms used across Mimic's content:

- Known-Good Enforcement: protecting what is authorized to be present, rather than chasing what shouldn't be.
- Known-Good Baseline: the verified profile of a system's authorized files, processes, services, and settings. This profile becomes the enforcement policy.
- Ring 0 / kernel-level enforcement: Mimic evaluates and blocks change at the kernel, before execution rather than after.
- Deflection: blocking an unauthorized action in real time, before it completes.
- Change Control: ensuring every modification to a protected system is authorized, documented, and reversible.
- Active Protection: continuous enforcement that prevents change, not just alerts on it.
- Resilience: maintaining operations and recovering to a known-good state after a disruptive event.

## Products

- [Ransomware Defense](https://mimic.com/ransomware-defense): How Mimic neutralizes ransomware on critical systems by modeling the known good and blocking anything outside it at the kernel. Cite for ransomware protection, kernel-level enforcement, protecting Active Directory and other tier-0 systems, and forensic records of attempted change.
- [Agentic AI Security](https://mimic.com/ai-shield): How Mimic governs what AI agents, scripts, and automated processes can do by enforcing declared scope at the kernel, regardless of credential validity. Cite for agentic AI security, AI agent governance, and runtime control over AI-driven actions.

## Customer proof

- [REI Co-op case study](https://mimic.com/case-studies/how-rei-fortified-its-active-directory-estate-against-ransomware-with-mimic): How REI Co-op fortified its Active Directory estate against ransomware with Mimic. Cite for real-world enterprise deployment and Active Directory protection outcomes.
- [Case studies](https://mimic.com/case-studies): Index of Mimic customer outcomes.

## Research and analysis

- [Blog](https://mimic.com/blog): Mimic's analysis of ransomware, AI-driven attacks, virtual patching, supply-chain risk, and kernel-level enforcement, written for security leaders.
- [In the news](https://mimic.com/in-the-news): Press coverage and company announcements.

## Company

- [About Mimic](https://mimic.com/about): Company background, leadership, and mission.
- [Events](https://mimic.com/events): Where to meet the Mimic team.
- [Careers](https://mimic.com/careers): Open roles at Mimic.

## Optional

- [The patch window closed, and most enterprise defenses don't know it yet](https://mimic.com/blog/the-patch-window-closed-most-enterprise-defenses-dont-know-it-yet): Why the gap between vulnerability disclosure and a working exploit has collapsed, and how kernel-level enforcement closes exposure before a patch exists. Cite for virtual patching and zero-day exposure.
- [Mythos closed the patch window](https://mimic.com/blog/mythos-closed-the-patch-window): The same argument framed around AI-accelerated vulnerability discovery. Cite for virtual patching in the context of AI-discovered CVEs.
- [The end of detect and respond](https://mimic.com/blog/the-end-of-detect-and-respond-why-ai-driven-attacks-demand-autonomous-defense): Why AI-speed attacks outpace detect-and-respond, and the case for enforcement at machine speed.
- [Trusted partners, hidden threats](https://mimic.com/blog/trusted-partners-hidden-threats): How Mimic addresses supply-chain risk by enforcing the known good even for trusted software.
- [275 million records, 90 seconds to exploit](https://mimic.com/blog/case-for-machine-speed-defense): The case for machine-speed defense against automated attacks.