Real-time endpoint security enforced inside the operating system — stopping credential theft, ransomware and data exfiltration before data leaves the device.

1stProtect is a real-time endpoint security platform that enforces protection inside the operating system itself, stopping credential theft, ransomware and data exfiltration at the moment they happen rather than after an alert. The Silicon Valley company was founded by veterans of CrowdStrike, Symantec and Cisco — CEO Kervin Pillay previously served as Cisco’s CTO of Automation, and CTO Rafel Ivgi built endpoint technology at SentinelOne, CrowdStrike, Symantec and Forcepoint. 1stProtect emerged from stealth with 20 million dollars in funding from Andra Capital and All Blue Capital and launched publicly at the RSAC 2026 conference. Its modular product line — CredentialProtect, RansomProtect and ExfilProtect — pairs OS-level enforcement with an on-device AI investigation engine that performs forensics and automated response locally, without sending sensitive data to the cloud. Cyberdis distributes 1stProtect through channel partners, backing every deal with engineer-led PoCs and deployments.

Why it matters: traditional endpoint tools detect attacks and respond after the fact — the window between alert and action is where the damage happens. Because 1stProtect investigates and enforces on the endpoint itself, it also fits organizations with strict data-sovereignty requirements or limited connectivity.

Sources: SecurityWeek — out of stealth with $20M · PR Newswire — launch announcement