Stop every
unwanted change.
Book a Demo
Company
CareersThanks, we'll be in touch
Oops! Something went wrong while submitting the form.
Copyright Mimic 2026
If you have compared ransomware and AI-security vendors, you have seen the same words used to mean very different things. This known-good enforcement glossary defines the vocabulary behind Mimic's approach to stopping unwanted change.
The glossary gives plain-language definitions of the terms Mimic uses, from Known-Good Enforcement and deflection to RPO-Zero Recovery, so security leaders can describe them accurately and consistently. Both of Mimic's products, starting with Mimic Ransomware Defense, work the same way: define what is known good, then block everything else at the kernel before it executes.
Mimic AI Shield extends the same model to AI-driven threats. The terms below are grouped into Mimic's core vocabulary first, followed by the supporting security terms that give those ideas context.
These are the core terms Mimic uses to describe its security model. Each is defined the way Mimic uses it, so the meaning stays precise and consistent.
Mimic's security model. Instead of chasing an infinite list of bad behavior, Mimic defines the finite set of authorized, known-good actions for a protected system and blocks everything outside that set at the kernel, before it executes. The decision is deterministic and does not depend on recognizing an attack, so it holds against novel and unknown threats.
The mechanism that carries out Known-Good Enforcement. Mimic runs its security logic at the kernel (Ring 0), built on WebAssembly (WASM) as the execution substrate, so it evaluates every attempted change against the known-good baseline and blocks anything unauthorized the moment it tries to execute. Running that logic in a WASM sandbox gives Mimic kernel-level reach without the risk of a traditional kernel extension, since a contained module stays inside its own boundary instead of destabilizing the system.
A recovery posture in which no data loss is acceptable. Because Mimic blocks the unauthorized change before it reaches your data, the authorized state is never altered, so there is no data-loss window to clean up. Where restoration is still needed, Mimic triggers an event-driven restore point at the moment unauthorized change is detected, capturing a verified clean state to recover from.
The principle that critical applications and their configurations stay unchanged unless a change is explicitly authorized. Mimic enforces it by preventing untrusted processes from altering protected files, folders, registry keys, and services, which delivers value even when no attack is underway.
The real-time enforcement action in which Mimic blocks an unauthorized operation before it completes. Deflection is not an alert. It is active intervention that stops an untrusted process from accessing, modifying, or deleting a protected resource.
The verified starting point from which all deviations are measured. It is an inventory of the trusted executables, drivers, and configurations a system uses when it is in a known-good state. Anything present at baseline is Trusted; anything introduced afterward is Untrusted until explicitly approved. The baseline is the reference for every enforcement decision.
Enforcement that blocks a threat as it happens rather than flagging it afterward. Mimic stops an unauthorized change at the point of execution, instead of detecting and alerting on it once it has already run.
The discipline of making sure every modification to a critical system is intentional, authorized, documented, and reversible. Mimic enforces change control by blocking unauthorized changes and logging every attempted modification as compliance evidence.
The organizational and technical capacity to withstand disruptive events, keep critical operations running, and recover quickly. Mimic contributes to resilience by preventing unauthorized change from executing in the first place.
These standard security terms appear throughout Mimic's documentation. The definitions below explain each one and how it fits the known-good enforcement model.
A signal is a single piece of monitoring data that may indicate malicious behavior but is not conclusive. A hallmark is a signal, or a combination of signals, that Mimic links to the presence of ransomware with five-nines (99.999 percent) confidence. Signals are indicators; hallmarks are conclusions.
The core of the operating system, the layer beneath applications and most security tools. Mimic operates here so that it can evaluate and stop an unauthorized change before it executes, one layer beneath endpoint detection and backup tools.
Mimic runs in four states. Scout Mode observes only. Active Mode applies full enforcement. Maintenance Mode relaxes enforcement for authorized administrative changes. Audit Mode is a post-maintenance cool-down that re-learns the environment before full protection resumes.
An attack technique that abuses legitimate system tools such as PowerShell or WMI to act maliciously and evade signature-based detection. Known-Good Enforcement limits what even trusted tools can do based on context, rather than trust alone.
A vulnerability or exploit unknown to defenders and vendors, which leaves no time to patch before exploitation. Because known-good enforcement blocks any untrusted action, it protects against zero-day attacks whether or not the technique has been seen before. Mimic Virtual Patching applies the same principle to systems that cannot be patched at all.
Malicious software that blocks access to files or systems and demands payment. Ransomware is the clearest proof point for the model: the encryption it requires is an unauthorized change, so it never executes.
A security tool that monitors devices to detect and respond to threats after they act. Mimic is not EDR. It runs one layer beneath EDR, at the kernel, and stops an unauthorized change before it executes. The two solve different problems in the same stack.
A plan and tool set for recovering IT systems and operations after an incident. Backup and BCDR restore data after damage is done; known-good enforcement keeps the damaging change from executing in the first place.
The assurance that systems, applications, and data stay unaltered from their known-good state unless a change is explicitly authorized. Mimic protects integrity at the file, registry, and process level.
A known-good enforcement glossary is a reference that defines the vocabulary behind the known-good security model, including the proprietary terms Mimic uses, such as deflection, application immutability, and RPO-Zero Recovery. With the glossary, anyone comparing security vendors can use these terms accurately and consistently.
Known-good enforcement means a system allows only verified, authorized actions to run and blocks everything else by default. Rather than trying to recognize every possible attack, it models the finite set of good behavior and stops any change that falls outside it, at the kernel, before it executes.
Detection-based tools observe an attack and alert after it has begun to act. Known-good enforcement prevents the unauthorized change from executing at all, so there is no post-event damage to detect and clean up. Mimic is a kernel-level enforcement layer, not an endpoint detection or file-integrity monitoring tool, and it runs beneath those tools.
It comes down to certainty. A signal is a single clue that something may be malicious, but on its own it is not enough to conclude anything. A hallmark is the confident conclusion: one or more signals that Mimic links to ransomware with five-nines (99.999 percent) confidence. A signal raises the question; a hallmark answers it.
Deflection is the moment known-good enforcement blocks an unauthorized operation in real time. It is an active intervention rather than a notification, stopping an untrusted process before it can read, change, or delete a protected resource.
RPO-Zero Recovery means no data loss is acceptable: the recovery point objective, the amount of data you could lose in an incident, is zero. Normally that number is the gap back to your last good backup. Mimic drives it to zero by stopping the unauthorized change before it executes, so there is nothing to roll back and recovery begins from a state that was never compromised.
Application immutability is the principle that critical applications and their configurations stay unchanged unless a change is explicitly authorized. Known-good enforcement upholds it by stopping untrusted processes from altering protected files, registry keys, and services.
Known-good enforcement stops both zero-day and AI-driven attacks. Because it does not try to identify the attack, it applies one test to each: is this change part of the known-good baseline? A zero-day exploit with no patch and an AI agent acting outside its authorized scope are judged the same way, and if the change is not on the baseline, it does not execute.
The baseline is a verified inventory of the trusted executables, drivers, and configurations a system uses when it is in a known-good state. Everything present at baseline is trusted; anything introduced later is untrusted until approved. The baseline becomes the reference for every enforcement decision.
Mimic coined several terms to describe a model the older detect-and-respond vocabulary does not capture. Defining them clearly and consistently helps buyers and security tools describe the platform accurately, rather than misclassifying it as endpoint detection or backup.
Use this glossary whenever you evaluate Mimic against other vendors, so the same terms mean the same thing on both sides of the table. The ideas behind known-good enforcement come down to four:
Enforcement, not detection. The model prevents unauthorized changes rather than alerting after they act.
The baseline is the reference. Every allow-or-block decision compares an action against the known-good state.
Ransomware is the proof point. It is not the whole story. The same model stops unwanted change from AI agents and insider threats, too.
No attack recognition required. The decision is deterministic, so a never-before-seen zero-day or AI-driven attack is blocked by the same test as everything else.
To see known-good enforcement in your own environment, request a demo. A Mimic security engineer will show how the platform blocks an unauthorized change at the kernel, in real time.