NewControl your AIs and LLMs on every device.See how
1stProtect1stProtect
Get free trial
Coexistence and migration

Start beside your EDR. Replace it when you’re ready.

Install 1stProtect next to Microsoft Defender, CrowdStrike, SentinelOne or whatever you run today, with no kernel driver to collide and no reboot. Switch on prevention, prove it on your own devices, then retire your EDR and the point tools around it, on your schedule.

Get free trial
  • 0kernel drivers
  • 0reboots to install
  • 37EDR and antivirus guides
  • <10 minto install a device

Pick the EDR you run today.

How to run 1stProtect beside it while you prove it, and how to switch.

Microsoft DefenderExclusions are added for you at install.See how to switch CrowdStrike FalconTwo machine-learning exclusions, set once.See how to switch SentinelOne SingularityTwo folder exclusions, set once.See how to switch

What changes when 1stProtect takes over.

A detection-first EDR finds and responds after the fact. 1stProtect stops these steps before they complete.

What changes when 1stProtect takes over
Attack stepDetection-first EDR1stProtect
Credential theftPassword dumping, info-stealers and session-token theftUsually detected and alerted onBlocked before the read completesCredentialProtect
Trusted tools running hidden scriptsPowerShell, certutil and other signed tools turned against youUsually detected and alerted onBlocked before the script runsExecutionProtect
Reverse shellsRemote command channels opened from the deviceUsually detected and alerted onBlocked before the channel opensShellProtect
EDR killersSigned but vulnerable drivers loaded to switch security offCan be switched off by themThe driver is stopped from loadingDriverProtect
Unhooking and blindingRemoving the hooks security tools rely onCan lose visibilityStopped before the hooks are removedPayloadProtect
AI agents acting as youAgents running with the signed-in user’s rightsAgents often discovered or allowed as a wholeEach action judged by policyAIControl
Sensitive files moving outFiles copied into apps they shouldn’t reachUsually loggedControlled by policyDataProtect

Every engine listed is available now. Typical EDR behaviour varies by product and configuration.

Why you can run both while you switch.

No second kernel driver

1stProtect runs in user mode. There’s no driver competing with your EDR’s, and nothing that can crash the machine.

Not a second telemetry stream

It isn’t a telemetry collector. It reports only the events and incidents that matter, so your SOC doesn’t get a duplicate feed.

Exclusions on both sides

The agent excludes the most widely used security agents on its side. You add 1stProtect to your EDR’s exclusions, once, for every version.

Microsoft Defender is handled for you.

The installer adds these Defender exclusions at install time.

  • Folder C:\Program Files\1stProtect
  • Folder C:\ProgramData\1stProtect
  • Processes C:\Program Files\1stProtect\*\*.exe

For every other product

Exclude the same two folders and the agent’s processes in your EDR or antivirus. The wildcard covers every agent version, so you set it once.

The agent also excludes the most widely used security agents on its side.

Hard to switch off, before and after the switch.

Before ransomware runs, attackers often try to blind or kill the security tools on the device. 1stProtect stops the main techniques they use, which protects the device while you migrate, and after.

Vulnerable-driver attacks

“EDR killer” tools load a signed but vulnerable driver to switch security software off. DriverProtect stops those drivers from loading.

Available now

Unhooking and blinding

Attackers remove the hooks security tools rely on, or call the system directly to avoid them. PayloadProtect stops EDR unhooking and direct system calls.

Available now

Cross-process tampering

Stopping one process from terminating or writing into another, such as a security agent. IntegrityProtect

Roadmap

Start beside it. Prove it. Replace it.

Nothing changes in your stack until you choose. Most teams time the switch to their EDR renewal.

  1. Land beside your EDRInstall on up to 10 devices for the free 30-day trial, in audit mode. Nothing is blocked; you get a report of everything 1stProtect would have stopped.
  2. Enforce, engine by engineSwitch on prevention where it matters most first, such as credential theft and EDR killers.
  3. Replace your EDR and point toolsRetire the EDR and the tools 1stProtect covers, one at a time. Time it to your renewal, and map what you’ll retire with your partner.

Before you retire your EDR.

Replacing an EDR is a process, not a switch. Check these with us first.

  • Prevention is in enforce mode across a pilot group, and the audit report matches what you expect.
  • Your team investigates from the 1stProtect console, with AIProtect explaining each case.
  • Events reach your SIEM, if you use one.
  • The response actions you rely on today are covered. We map them with you.
  • Your cyber-insurance and compliance questionnaires describe your endpoint controls correctly.
  • Every platform you protect is supported. Windows today; macOS and Linux are on the roadmap.

Questions teams ask about switching.

Can’t find yours? Book a demo.

Can 1stProtect replace our EDR?

Yes, in stages. Start beside it, switch on prevention, and retire your EDR and the overlapping point tools once 1stProtect covers what you rely on. We help you check each item first.

Will we get double alerts?

Rarely. 1stProtect blocks first, so your EDR usually has nothing left to alert on. 1stProtect’s own events go to its console and can be streamed to your SIEM.

Do we need to change our EDR’s settings?

Only its exclusions. Add 1stProtect’s two folders and its executables, as you would for any security tool. For Microsoft Defender, our installer adds them for you.

What if Defender is managed centrally?

If Intune or Group Policy turns off local exclusion merging, add the same three entries there. Everything else stays as it is.

Will it slow devices down?

It runs in user mode and isn’t a telemetry collector, so it only reports events that matter. You see its footprint on your own devices during the trial, before you decide.

Does it need a connection?

No. Protection works offline from first boot. A connection adds visibility and policy changes, not protection.

Which systems are supported?

Windows 10 and 11, and Windows Server 2016 or later, 64-bit. macOS and Linux are on the roadmap.

Coexistence guides

Exact entries for 37 products, from guide version 2.3 (October 2026).

37 products

Acronis Cyber Protect
  • Trusted item, Add as file/folder: C:\Program Files\1stProtect\*
  • Trusted item, Add as file/folder: C:\ProgramData\1stProtect\*
  • Trusted item, Add as process: C:\Program Files\1stProtect\*\*.exe
Arctic Wolf Agent
  • Request Subject: Approved endpoint agent 1stProtect, please tune detections
  • Processes: C:\Program Files\1stProtect\*\*.exe, 1stprotect-agent.exe, 1stprotect-health.exe, 1stprotect-tray.exe,, installer-assistant.exe, CPWraperInstaller.exe
  • Paths: C:\Program Files\1stProtect\, C:\ProgramData\1stProtect\
  • Hosts and start date: <group or host list> Start date: <date>
Aurora Protect Desktop
  • Exclude folders, Allow execution on: C:\Program Files\1stProtect
  • Exclude folders, Allow execution on: C:\ProgramData\1stProtect
  • Memory Protection (Aurora agent 3.0+): C:\Program Files\1stProtect\**\*.exe
  • Script Control, only if scripts are blocked: /Program Files/1stProtect/*
Avast / AVG Business Antivirus
  • File paths (both folders): C:\Program Files\1stProtect\*, C:\ProgramData\1stProtect\*
  • Hardened mode, CyberCapture, Programs: C:\Program Files\1stProtect\*
  • Behavior Shield (workstations): C:\Program Files\1stProtect\*
  • On-Premise only: DeepScreen: C:\Program Files\1stProtect\*
  • If a list rejects it: the five full paths, for example, C:\Program Files\1stProtect\2.3.1.25\1stprotect-agent.exe
Bitdefender GravityZone
  • Folder, Modules: all: C:\Program Files\1stProtect\
  • Folder, Modules: all: C:\ProgramData\1stProtect\
  • Process, every module offered: C:\Program Files\1stProtect\*\*.exe, On-Access, ATC/IDS, Ransomware Mitigation
Carbon Black Cloud
  • Permission, Bypass: C:\Program Files\1stProtect\**
  • Permission, Bypass: C:\ProgramData\1stProtect\**
  • Sensor tab exclusion, Process > Path: C:\Program Files\1stProtect\*\1stprotect-agent.exe, C:\Program Files\1stProtect\*\1stprotect-health.exe, C:\Program Files\1stProtect\*\1stprotect-tray.exe, C:\Program Files\1stProtect\*\installer-assistant.exe, C:\Program Files\1stProtect\*\CPWraperInstaller.exe
Check Point Harmony Endpoint
  • File path: C:\Program Files\1stProtect\**
  • File path: C:\ProgramData\1stProtect\**
  • Process path: C:\Program Files\1stProtect\*\*.exe
  • Optional: Process signer: the 1stProtect code-signing certificate
  • Legacy lists, older clients (+ five processes, page 4): C:\Program Files\1stProtect\, C:\ProgramData\1stProtect\
Cisco Secure Endpoint
  • Path: C:\Program Files\1stProtect\
  • Path: C:\ProgramData\1stProtect\
  • Process, four entries (one per engine): C:\Program Files\1stProtect\*\*.exe, with Apply to Child Processes ticked
  • Executable, Exploit Prevention only: each of the five .exe names above, one entry each, no path
Cortex XDR
  • Folder, in 3 modules: C:\Program Files\1stProtect\*
  • Folder, in 3 modules: C:\ProgramData\1stProtect\*
  • Operational Agent Exceptions (full paths only): C:\Program Files\1stProtect\2.3.1.25\1stprotect-agent.exe, C:\Program Files\1stProtect\2.3.1.25\1stprotect-health.exe, C:\Program Files\1stProtect\2.3.1.25\1stprotect-tray.exe, C:\Program Files\1stProtect\2.3.1.25\installer-assistant.exe, C:\Program Files\1stProtect\2.3.1.25\CPWraperInstaller.exe
  • Optional: signer: the 1stProtect signer (two modules accept it)
CrowdStrike Falcon
  • ML (file path) exclusion: Program Files\1stProtect\**
  • ML (file path) exclusion: ProgramData\1stProtect\**
  • Optional: ML (certificate): the 1stProtect code-signing certificate
  • IOA, only after a detection: image file name regex:, .*\\Program Files\\1stProtect\\[^\\]+\\[^\\]+\.exe
Cybereason Defense Platform
  • File (Anti-Malware): C:\Program Files\1stProtect\, C:\ProgramData\1stProtect\
  • Process: BEP and Exploit Protection: C:\Program Files\1stProtect\*\*.exe
  • Process: Fileless Protection (names only): 1stprotect-agent.exe, 1stprotect-health.exe, 1stprotect-tray.exe, installer-assistant.exe, CPWraperInstaller.exe
Datto EDR and Datto AV
  • Datto AV Folder, or Defender File / folder: C:\Program Files\1stProtect\, C:\ProgramData\1stProtect\
  • Datto AV: Process, five entries: C:\Program Files\1stProtect\*\1stprotect-agent.exe, C:\Program Files\1stProtect\*\1stprotect-health.exe, C:\Program Files\1stProtect\*\1stprotect-tray.exe, C:\Program Files\1stProtect\*\installer-assistant.exe, C:\Program Files\1stProtect\*\CPWraperInstaller.exe
  • Defender policy: Process: C:\Program Files\1stProtect\*\*.exe
Deep Instinct DSX for Endpoints
  • Allow List: Path: C:\Program Files\1stProtect\*
  • Allow List: Path: C:\ProgramData\1stProtect\*
  • Allow List: Process: C:\Program Files\1stProtect\*\*.exe
  • Optional: Certificate: the 1stProtect code-signing certificate
Elastic Defend
  • Trusted app: Path matches: C:\Program Files\1stProtect\*\*.exe
  • Trusted app: Path matches: C:\Program Files\1stProtect\*
  • Trusted app: Path matches: C:\ProgramData\1stProtect\*
  • Optional: trusted app, Signature: the 1stProtect signer name
  • Endpoint exception: process.executable matches C:\Program Files\1stProtect\*
ESET Endpoint Security
  • Performance exclusion: C:\Program Files\1stProtect\*
  • Performance exclusion: C:\ProgramData\1stProtect\*
  • Processes exclusions (five, full path): C:\Program Files\1stProtect\2.3.1.25\1stprotect-agent.exe, C:\Program Files\1stProtect\2.3.1.25\1stprotect-health.exe, C:\Program Files\1stProtect\2.3.1.25\1stprotect-tray.exe, C:\Program Files\1stProtect\2.3.1.25\installer-assistant.exe, C:\Program Files\1stProtect\2.3.1.25\CPWraperInstaller.exe
  • Rule for both lists: Append (if more than one policy reaches the endpoints)
FortiClient (EMS-managed)
  • Paths to Excluded Folders: C:\Program Files\1stProtect\
  • Paths to Excluded Folders: C:\ProgramData\1stProtect\
  • Paths to Excluded Files (five, full path): C:\Program Files\1stProtect\2.3.1.25\1stprotect-agent.exe, C:\Program Files\1stProtect\2.3.1.25\1stprotect-health.exe, C:\Program Files\1stProtect\2.3.1.25\1stprotect-tray.exe, C:\Program Files\1stProtect\2.3.1.25\installer-assistant.exe, C:\Program Files\1stProtect\2.3.1.25\CPWraperInstaller.exe
FortiEDR
  • Execution Prevention: \Program Files\1stProtect\, \Program Files\1stProtect\*
  • Execution Prevention: \ProgramData\1stProtect\, \ProgramData\1stProtect\*
  • Process, five entries: File Name: each of the five <name>.exe, Path: \Program Files\1stProtect\*
  • Optional: Signer attribute: the 1stProtect certificate name (confirm with 1stProtect)
G DATA Endpoint Protection
  • Monitor exception: Directory: C:\Program Files\1stProtect\, C:\ProgramData\1stProtect\
  • Monitor exception: Process (five, full path): the five full paths on page 4, for example, C:\Program Files\1stProtect\2.3.1.25\1stprotect-agent.exe
  • Each scan job's exceptions: the same two directories
Huntress Managed EDR
  • Path: C:\Program Files\1stProtect\
  • Path: C:\ProgramData\1stProtect\
  • Process: C:\Program Files\1stProtect\*\*.exe
Kaspersky Endpoint Security
  • Scan exclusion, File or folder: C:\Program Files\1stProtect\
  • Scan exclusion, File or folder: C:\ProgramData\1stProtect\
  • Trusted application: C:\Program Files\1stProtect\*\*.exe
OpenText Core Endpoint Protection
  • Folder / File override: Path / Folder Mask: C:\Program Files\1stProtect\, File Mask: (blank)
  • Folder / File override: Path / Folder Mask: C:\ProgramData\1stProtect\, File Mask: (blank)
  • Both overrides: Include Sub-folders: on Detect if Malicious: off
  • Stopgap only: MD5 override of a caught file (stops matching at the next 1stProtect update)
Qualys Cloud Agent and EDR
  • FOLDER: C:\Program Files\1stProtect\
  • FOLDER: C:\ProgramData\1stProtect\
  • PROCESS: C:\Program Files\1stProtect\*\*.exe
  • Removal tool, Add Exclusions: 1stProtect (or confirm the tool is off)
Rapid7 Insight Agent
  • Path (Windows): C:\Program Files\1stProtect\*
  • Path (Windows): C:\ProgramData\1stProtect\*
  • Purpose, if On-Access Scanning: Scanning files and monitoring processes
  • Only from a pilot alert: Certificate, Publisher level (if offered)
Sangfor Athena EPP
  • Excluded Paths (folders): C:\Program Files\1stProtect\, C:\ProgramData\1stProtect\
  • Excluded Paths (executables): C:\Program Files\1stProtect\*\*.exe
  • Trusted Processes, if Scenario 1 Protect OS is on: C:\Program Files\1stProtect\*\*.exe
SentinelOne Singularity
  • Path exclusion, As Folder: \Device\HarddiskVolume*\Program Files\1stProtect\
  • Path exclusion, As Folder: \Device\HarddiskVolume*\ProgramData\1stProtect\
  • Or the drive-letter form: C:\Program Files\1stProtect\, C:\ProgramData\1stProtect\
  • Optional: certificate: the 1stProtect Signer Identity (suppresses alerts only)
Sophos Intercept X
  • File or folder (Windows): C:\Program Files\1stProtect\
  • File or folder (Windows): C:\ProgramData\1stProtect\
  • Process (Windows): C:\Program Files\1stProtect\*\*.exe
  • Exploit Mitigation and Activity Monitoring (Windows): C:\Program Files\1stProtect\*\*.exe, Protect Application: off
Symantec Endpoint Protection
  • Folder exception: [PROGRAM_FILES] 1stProtect (Also exclude subfolders)
  • Folder exception: [COMMON_APPDATA] 1stProtect (Also exclude subfolders)
  • File exception, 14.3 RU5 and later: [NONE] C:\Program Files\1stProtect\*\*.exe
  • File exceptions, older clients: [NONE] the five full paths, version folder included (page 4)
  • Scan types, on every entry: Security Risk (all scans) + SONAR + Application Control
  • SES cloud Allow List policy: the same folders and file, all four technologies on (page 4)
Tanium Threat Response
  • System filter, and optional Recorder filter (process path): C:\Program Files\1stProtect\*\*.exe
  • Fallback: five full paths, updated after every upgrade: C:\Program Files\1stProtect\2.3.1.25\1stprotect-agent.exe, C:\Program Files\1stProtect\2.3.1.25\1stprotect-health.exe, C:\Program Files\1stProtect\2.3.1.25\1stprotect-tray.exe, C:\Program Files\1stProtect\2.3.1.25\installer-assistant.exe, C:\Program Files\1stProtect\2.3.1.25\CPWraperInstaller.exe
  • Real AV, in its own syntax: C:\Program Files\1stProtect\, C:\ProgramData\1stProtect\
ThreatDown Endpoint Protection
  • Folder by Path: C:\Program Files\1stProtect
  • Folder by Path: C:\ProgramData\1stProtect
  • File by Path: C:\Program Files\1stProtect\*\*.exe
  • Exploit Protection, only after a detection: MD5 Hash, taken from that detection
ThreatLocker
  • Rule 1: Full Path AND Certificate: c:\program files\1stprotect\*, + Certificate: the 1stProtect signer
  • Rule 2: only if code runs there: c:\programdata\1stprotect\*, + Certificate: the 1stProtect signer
  • Policy action: Permit (not Permit with Ringfence)
  • Last resort: Excluded Processes: the five executable names, each with, File Path c:\program files\1stprotect\*
Trellix Endpoint Security (ENS)
  • On-Access Scan, Standard tab: C:\Program Files\1stProtect\**, C:\ProgramData\1stProtect\**
  • On-Demand Scan: the same two patterns
  • When to exclude: When writing to or reading from disk
  • Exploit Prevention / Access Protection, only after an event: 1stprotect-agent.exe 1stprotect-health.exe, 1stprotect-tray.exe installer-assistant.exe, CPWraperInstaller.exe
Trend Micro Apex One
  • Scan Exclusion List (Directories): C:\Program Files\1stProtect\
  • Scan Exclusion List (Directories): C:\ProgramData\1stProtect\
  • Trusted Program List (five, full path): C:\Program Files\1stProtect\2.3.1.25\1stprotect-agent.exe, C:\Program Files\1stProtect\2.3.1.25\1stprotect-health.exe, C:\Program Files\1stProtect\2.3.1.25\1stprotect-tray.exe, C:\Program Files\1stProtect\2.3.1.25\installer-assistant.exe, C:\Program Files\1stProtect\2.3.1.25\CPWraperInstaller.exe
  • Behavior Monitoring Approved List: C:\Program Files\1stProtect\*\*.exe
Trend Micro Deep Security
  • Directory List "1stProtect": C:\Program Files\1stProtect\, C:\ProgramData\1stProtect\
  • Process Image File List: C:\Program Files\1stProtect\*\*.exe
  • Trusted certificate exemption: 1stProtect signing certificate, trusted for Scan Exclusions
  • Attach the lists to: real-time: both lists manual and scheduled: Directory List
WatchGuard Endpoint Security 360
  • Folders: C:\Program Files\1stProtect
  • Folders: C:\ProgramData\1stProtect
  • Authorized Software, Program Properties: File Path: C:\Program Files\1stProtect\2.3.1.25, File Name: each of the five executables
  • Or: Authorized Software: Signature: the 1stProtect code-signing signature
  • Anti-Exploit Excluded Processes, only if flagged: 1stprotect-agent.exe 1stprotect-health.exe 1stprotect-tray.exe, installer-assistant.exe CPWraperInstaller.exe
Wazuh Agent
  • syscheck <ignore>: C:\Program Files\1stProtect
  • syscheck <ignore>: C:\ProgramData\1stProtect
  • Executables: no entry: Wazuh has no process exclusion list
  • Only if a rule acts on the agent: narrow that rule, or add a level="0" child rule in local_rules.xml
WithSecure Elements
  • Path (folder): C:\Program Files\1stProtect\
  • Path (folder): C:\ProgramData\1stProtect\
  • Path (executables): C:\Program Files\1stProtect\*\*.exe
  • DeepGuard, only if still blocked: Exclude file by SHA1, from the security event
Xcitium Client Security
  • Containment rule, Ignore (Folder): C:\Program Files\1stProtect
  • Antivirus: Excluded Paths: C:\Program Files\1stProtect, C:\ProgramData\1stProtect
  • Optional: Excluded Groups: a File Group containing, C:\Program Files\1stProtect\*

Start beside your EDR. Prove it. Replace it.

Run 1stProtect free for 30 days on up to 10 of your own devices, next to the tools you have today.

Get free trialBook a demo
Get free trial