PHASR
The Proactive Hardening and Attack Surface Reduction (PHASR) solution provides organizations with a detailed view of their internal attack surface, identifying areas where attack vectors could potentially be exploited.
PHASR first goes into a learning phase, continuously monitoring user behaviors, learning typical behaviors and system interactions and analyzing them. This phase can last up to 30 days. If EDR is enabled for the company, and enough historical data is available, this period may shorten.
Once this learning phase completes, PHASR uses the observed behavior to determine the appropriate access to tools from one of the following categories: Living off the land binaries, Crypto miners, Piracy tools, Tampering tools, and Remote admin tools. Depending on the configured operating mode, PHASR can automatically apply access decisions or generate recommendations for you to review. Each PHASR recommendation contains behavioral profiles for which the learning phase is completed. Behavioral profiles are pairs of users and their devices. A single user may have multiple devices. As a result, different recommendations may contain the same user but different devices. When PHASR for AI Agents is enabled, a behavioral profile can also associate a user and device with an AI agent. A user may have multiple behavioral profiles across devices and AI agents.
PHASR operating modes
You can configure PHASR to operate in Autopilot or Direct control mode, depending on how much control you want over access decisions.
In Autopilot mode, PHASR automatically applies restriction decisions based on the behavior it observes. You do not need to review and manually apply each restriction. You can also override the Autopilot decision if you choose to do so.
In Direct control mode, PHASR generates recommendations based on observed behavior. You can review each recommendation and decide whether to apply the proposed access decision and which behavioral profiles it should affect.
Note
You do not need to wait for the PHASR learning phase to complete before restricting access to an attack vector. To proactively reduce your attack surface, you can manually restrict individual attack vectors from PHASR attack vectors or manage multiple attack vectors from PHASR MITRE Grouping.
The attack surface encompasses all potential entry points through which a malicious actor might exploit a system's vulnerabilities. This includes the misuse of legitimate operating system applications and tools, such as Living off the land binaries and Tampering tools, to evade detection and carry out attacks. It represents the totality of methods an attacker can use to gain unauthorized access to a system or its data.