Endpoint defense you can actually audit
A Windows EDR/XDR console that collects endpoint telemetry in user mode, keeps it on the machine, and asks for your consent before every privileged response.
User-mode visibility, operator-controlled response
No driver, no service
Sensors run in user mode through documented Win32, ETW, firewall and service APIs. Nothing is loaded into the kernel and nothing is installed as a Windows service.
Continuous local telemetry
Processes, network, persistence and host resources are scanned every few seconds and stored in SQLite on the PC. Nothing is uploaded unless you configure a destination.
One console for detection, response & XDR
Containment that asks first
Terminate a process tree
Stop a process or its whole tree through the one-shot elevated helper, after the termination grant and a Windows UAC prompt.
Block an IP or isolate the host
Named Windows Firewall rules you can see in wf.msc. Host isolation is one outbound block rule that is just as easy to release.
Quarantine a suspicious file
Move a selected file into the RECONIFIED quarantine folder with its original name kept, gated by the quarantine grant.
Allowlisted live response
Built-in checks only: ps, netstat, filehash, reg query, ls, whoami and env. Any other command text is refused.
From sign-in to response
RECONIFIED runs as a single-host Windows console. Setup takes four steps, and nothing privileged happens until you say so.
See what your endpoints are really doing
Verify it without the vendor
RECONIFIED is built to be checked. Here are two of the nine things an auditor can confirm on a running host.
No kernel driver. No service. Every privileged action asks Windows first.
Nothing leaves the PC unless you configure a destination.
Every grant, containment and quarantine lands in a SHA-256 linked audit chain.
No kernel driver. No service. Every privileged action asks Windows first.
Nothing leaves the PC unless you configure a destination.
Every grant, containment and quarantine lands in a SHA-256 linked audit chain.
No kernel driver. No service. Every privileged action asks Windows first.
Nothing leaves the PC unless you configure a destination.
Every grant, containment and quarantine lands in a SHA-256 linked audit chain.
No kernel driver. No service. Every privileged action asks Windows first.
Nothing leaves the PC unless you configure a destination.
Every grant, containment and quarantine lands in a SHA-256 linked audit chain.
No kernel driver. No service. Every privileged action asks Windows first.
Nothing leaves the PC unless you configure a destination.
Every grant, containment and quarantine lands in a SHA-256 linked audit chain.
Know exactly what runs on your PC
The architecture notes describe the software as it is: every process, file, port and Windows API it touches.
