Published on July 6, 2026 · 5 min read
A while back, a friend of mine was running IT for a small company. One morning, half the office couldn't open anything on the shared drive. Files had new extensions. There was a readme.txt on the desktop.
The EDR tool they were paying for hadn't flagged anything. That's when I started looking into how these attacks actually work.
The first thing that surprised me: encryption is usually the last step, not the first. Before any file gets touched, the attackers spend time on reconnaissance. They look at what's on the network, which machines are worth hitting, where the backups live.
Then they go after the network itself. I've seen this done a few ways — DNS poisoning, route manipulation, just pushing a bad firewall rule. The method changes, the goal doesn't. Get the endpoint isolated before the payload runs.
If you've followed any of the big ransomware incidents — NotPetya, Ryuk, Conti — this pattern shows up again and again. The encryption is what you read about in the news. The network takedown is what makes it work.
Here's why that matters for antivirus. The way most AV products work today, when they see a file they don't recognize, they send a hash to a server and wait for a verdict. Cloud lookup. Signature update check. Threat intel feed. It's all remote.
That's fine when the network is up. But if the endpoint can't reach the server — because the connection is down, or blocked, or the attacker deliberately cut it — the file just sits there. Waiting for a verdict that never comes.
I'm not saying cloud AV is useless. It works for a lot of threats. But it has a dependency, and that dependency is exactly what a sophisticated attacker targets first.
This is the part that pushed me toward building something offline. If the detection engine runs on the endpoint itself — no cloud lookup, no signature server — then taking down the network doesn't help the attacker. The defense keeps working.
People hear "offline" and assume it means outdated. Like you're giving up on modern detection. That's not quite right. A local engine can still do behavior analysis, entropy checks, file monitoring — the same techniques cloud products use. It just runs on the machine instead of a server farm.
How does offline detection catch 0-day threats?
It doesn't rely on signatures. It watches behavior. If a process starts encrypting files at high speed, or tries to delete shadow copies (vssadmin delete shadows), or disables the recovery environment (bcdedit /set recoveryenabled no) — that pattern is suspicious regardless of what the file is called.
How do offline tools get updates?
A local engine needs new rules eventually, especially if a new attack technique shows up. That's still doable — the tool can pull updates when the network is available, just not depend on it for every detection.
For air-gapped systems or critical infrastructure, this isn't really a preference. It's a requirement. You can't depend on a cloud service if the whole point of the environment is that it doesn't talk to the internet.
If you want to see how this works in practice, there's a free 14-day trial below.
Try WinRansomProtect free for 14 days.
⬇️ Download Free Trial