ABOUT
Detection after execution is the wrong shape.
Every antivirus shares one structural flaw: it acts after code is already running. ZeroWrite exists because that ordering is backwards, and fixing it is an engineering problem rather than a detection-rate problem.
Conventional endpoint protection watches what happens on a machine and reacts. By the time a verdict is reached, the code has already touched memory, and the argument becomes how quickly the damage can be contained rather than whether it happened.
ZeroWrite intercepts arriving code at the platform level and suspends it. The engine simulates execution pathways and scores what the code intends to do, backed by YARA rules and hash reputation, and produces a verdict in under three seconds. Only then does Windows get to run it.
That ordering has a cost: the analysis budget is measured in seconds, and it has to run locally on a normal desktop within a couple of percent of CPU. Most of the engineering effort goes into making a genuinely useful decision inside that budget.
What we hold ourselves to
Pre-execution or it doesn't count
Analysis must finish and produce a decision before code runs. We never let something execute and inspect it afterwards. This constraint shapes every part of the architecture, and we would rather cut a feature than break it.
No dependency on signatures
Behavioural and AI analysis must work with no threat-intel response at all. Reputation lookups are enrichment. A product that goes blind when a third-party API is down is not a security product.
Your files stay yours
File contents never leave your machine. Not for analysis, not for research, not for improving our models. The only things that can be transmitted are hashes and URLs, and only with your consent.
Honest about limits
No product stops everything. We publish a threat model that says what we do not defend against. Overstating coverage is how security vendors teach users to ignore warnings.
Where we are
ZeroWrite 1.0 is in early access on Windows 10 and 11. macOS and Linux are not on the roadmap for v1 — the interception approach is deeply platform-specific and doing it badly on a second platform would help nobody.