Investor overview
Investment core value proposition
Target market
Commercialization status
Why invest? Return on investment (ROI) potential
How do malware and ransomware get onto devices?

Investor overview

HEX DEREF X: Endpoint Security combines proactive Next-Generation Antivirus (NGAV) protection for Windows with traditional Endpoint Detection and Response (EDR) capabilities and application- and process-level Zero Trust enforcement. The product proactively identifies and blocks threats based on predefined security policies. It can also automatically disconnect a device from the network (Device Isolation) when specified threat criteria are met.

HEX DEREF X: Endpoint Security ( Key Features ) is positioned to compete directly with products such as CrowdStrike Falcon Pro. https://www.crowdstrike.com/en-us/pricing/falcon-pro/ -> https://assets.crowdstrike.com/is/content/crowdstrikeinc/falcon-endpoint-protection-pro-data-sheetpdf

Under application- and process-level Zero Trust enforcement, only explicitly approved and trusted applications (based on Authenticode signatures) and processes are permitted to execute. This gives organizations precise control over the software running in their environments and significantly reduces the risk of malicious software being installed or executed without the user's knowledge. The behavior of permitted processes is also monitored, allowing suspicious activity to trigger responses according to predefined security policies.

The product also brings enterprise-grade capabilities, such as Device Control, to individual consumers.

Social engineering attacks such as ClickFix and similar techniques can be stopped at an early stage when an attack requires the execution of a previously unapproved or unknown process. If a device encounters a threat that meets predefined criteria, HEX DEREF X can automatically isolate it from the network according to the configured security policies, helping contain the attack before it spreads. In simple terms, the product blocks PowerShell execution at the kernel level unless maintenance mode is enabled.

I want to emphasize that a large market share, industry awards, or perfect test scores do not automatically establish technical superiority. When a solution appears to have received every possible accolade and achieved top scores across the board, it is reasonable to ask how closely those results reflect its actual technical performance in real-world environments. My preliminary, independent, professional-level testing has shown that market position alone does not tell the whole story. I will not single out individual vendors here. I prefer to let technical performance speak for itself.

HEX DEREF X: Anti-malware is an advanced proactive endpoint protection and analytics software suite built specifically for Windows. It is designed primarily for malware analysts and threat hunters. In addition to endpoint protection and malware prevention, the product provides capabilities for analyzing malware and investigating suspicious system activity. It brings together key functionality found in ProcMon64 and System Informer, giving users extensive visibility into system activity, process behavior, and potential security threats.

These capabilities have been implemented as a lightweight, proprietary solution with seamless integration between its components. This makes HEX DEREF X technically distinctive. To my knowledge, there are currently no established solutions on the market that offer a comparable combination of capabilities in a single product.

When retention periods for critical process telemetry are limited to, for example, 14, 30, or 90 days, the practical analysis window for identifying newly emerging and previously undetected malware is effectively limited to the same timeframe.

Furthermore, none of the traditional consumer antivirus products I have tested provides users with sufficient visibility into system events. In particular, process command-line arguments and network connections — which are often among the most important indicators when investigating malicious activity — are typically inaccessible to end users.

This raises a legitimate question: what additional value do many traditional antivirus products actually provide over a solution such as Windows Defender?

If users cannot access the most relevant telemetry, the actual security benefits of a product can be difficult to assess. This is precisely where HEX DEREF X: Endpoint Security differentiates itself from competing solutions. This functionality can also be disabled through the product's settings.

The product is designed to provide as much visibility into process activity as possible, without artificial telemetry restrictions. When collected data is stored on the organization's own servers, telemetry retention periods can be determined according to the organization's operational and security requirements rather than limitations imposed by the vendor. HEX DEREF X: Endpoint Security therefore gives organizations greater visibility, stronger investigative capabilities, and more control over their own security data than many traditional endpoint security and antivirus solutions.

HEX DEREF X - Anti-cheat, which I developed as a byproduct of the Anti-Malware product, is built on core functionality originally implemented and tested in 2022. The product incorporates a simple yet highly effective detection logic for previously undetected pay-to-cheat (P2C) software, which constitutes its primary competitive advantage.

The product reaches its full technical potential when deployed as a standalone, kernel-level anti-cheat solution. A companion version designed to complement EAC and BattlEye is intended primarily for technical evaluation by AAA FPS game studios. It allows studios to test and verify HEX DEREF X's ability to detect pay-to-cheat (P2C) software against the solutions they currently use. Based on my test results, HEX DEREF X can also detect new and previously unknown external P2C cheats during the very first gaming session, regardless of HWID locking or the availability of static identifiers.

The purpose of this companion version is to give studios an opportunity to verify the technology's actual detection capabilities in practice, rather than relying solely on a proof-of-concept (PoC) video — or to supplement such a demonstration with hands-on testing.

As the lead developer of HEX DEREF X, I also spent approximately (7) seven years (2014–2021) studying how game cheats operate, from the perspectives of both internal and external cheat solutions. This hands-on experience has given me an in-depth understanding of how these systems work and how they can be detected effectively without false positives. I cannot publicly disclose the detection methods or their technical implementation. However, I can demonstrate the product's capabilities to potential partners after a non-disclosure agreement (NDA) has been signed.

https://steamdb.info/tech/AntiCheat/EasyAntiCheat/
https://steamdb.info/tech/AntiCheat/BattlEye/
https://steamdb.info/tech/AntiCheat/nProtect_GameGuard/
XIGNCODE3

nProtect GameGuard — Consider the financial implications: if an annual third-party anti-cheat license starts at $30,000 per game /year, with pricing potentially scaling according to player counts, this is a substantial recurring expense. Why continue paying for an external solution when a game studio could bring the technology and its control in-house?

HEX DEREF X: Anti-Cheat enables AAA game studios to deploy their own independent, kernel-level anti-cheat technology. Once a studio can see the practical difference in detection capabilities — particularly when identifying internal versus external P2C cheat software — it should critically evaluate whether it still needs third-party EAC or BattlEye solutions at all.

At the same time, studios can take greater responsibility for protecting their players' privacy. Under the HEX DEREF X approach, player device data does not need to be transmitted to third parties to implement anti-cheat protection.

The concept is straightforward: reach out to the head of the studio's anti-cheat team, if one exists, and obtain an HWID-locked P2C cheat targeting a still-popular game such as Rainbow Six Siege (R6S) — one that BattlEye fails to detect.

The lead developer of HEX DEREF X can then demonstrate, in a practical test, how HEX DEREF X: Anti-Cheat detects that cheat during the very first round of gameplay. HEX DEREF X: Anti-Cheat is designed to proactively identify previously undetected and entirely new P2C cheat software as it enters the market.

This illustrates an important point: an established market presence, a recognizable brand, or a large user base does not automatically translate into technical superiority. Game studios should evaluate anti-cheat solutions based on their actual, demonstrable detection capabilities in real-world conditions. Ultimately, this is also a matter of priorities: how much does a game developer value its players privacy, security, and right to control the data on their own devices?

HEX DEREF X enables studios to deploy their own independent, kernel-level anti-cheat technology without relying on third-party solutions. The goal is effective cheat prevention without unnecessary data transfers to third parties or wrongful bans.

Investment core value proposition

Combines several critical malware analysis tools into a single product
Kernel-level precision and performance, including a proprietary driver
High compatibility with the broader malware analysis tooling ecosystem
No direct competitor. The closest comparable solution is System Informer, but HEX DEREF X offers broader functionality and deeper kernel-level integration

ESET Research – RomCom Exploits Firefox and Windows Zero-Days in the Wild ESET Research regularly publishes highly technical malware and advanced persistent threat (APT) analyses. Examples include investigations into RomCom's exploitation of Firefox and Windows zero-day vulnerabilities, covering attack chains, vulnerabilities, indicators of compromise (IoCs), and attacker techniques in considerable detail.

HEX DEREF X: Endpoint Security was designed from the ground up to interrupt comparable attack chains at their earliest stages — before they can result in a data breach, ransomware execution, or other business impact. A prevention-first approach reverses this model by focusing on stopping attacks before any actual damage can occur.

The lead developer of HEX DEREF X, who also owns the usage and reproduction rights to its source code, has independently monitored and analyzed similar threats using open-source intelligence (OSINT) basis for more than (5) five years.

Following a cyberattack, compromised endpoints may not necessarily retain a malware or ransomware sample for a Cyber Incident Response Team (CIRT) or Digital Forensics and Incident Response (DFIR) team to analyze.

This depends on several factors, including the attacker's objectives, methods, and how thoroughly they attempt to cover their tracks. More sophisticated attackers may attempt to remove malware, associated files, and other traces of the attack before the security team has an opportunity to collect them. This makes digital forensics, incident reconstruction, and attacker attribution significantly more difficult. That is why comprehensive event telemetry and sufficiently early threat detection are so important.

HEX DEREF X's application- and process-level Zero Trust mode does more than prevent these types of attacks. It may also help expose previously undetected zero-day vulnerabilities affecting processes beyond web browsers.

Keuda – Final Report on the Cyberattack — In a scenario similar to the cyberattack against Keuda, HEX DEREF X's application- and process-level Zero Trust mode could have prevented the attack from spreading beyond the initial endpoint. Unknown and explicitly unapproved code — in this case, LockBit 3.x ransomware — would have been blocked from executing on that device. This could have prevented or significantly limited the damage caused by the malware and its spread to other systems.

Without application- and process-level Zero Trust enforcement, an EDR or endpoint security product cannot reliably determine which code running on a device is genuinely trusted.

If an organization uses primarily Microsoft software, which is trusted by default, alongside only a limited number of additional applications, maintaining an application allowlist is relatively straightforward. When malware and ransomware execution is blocked at the endpoint through a prevention-first approach, the organization's Security Operations Center (SOC) and malware analysts can evaluate suspicious or unknown software in a controlled analysis environment before approving it for business use.

This significantly reduces the risk of potentially vulnerable or malicious applications entering the production environment and helps minimize the attack surface — ideally bringing it close to zero.

Under traditional EDR- and/or XDR operating models, unknown code may be allowed to execute, while the system is configured to immediately alert the SOC team whenever previously unseen program code or a process starts running on an organization's endpoint. This gives the SOC team an opportunity to respond to new and unusual execution activity as early as possible.

HEX DEREF X combines both operating models in a single product. When Zero Trust mode is disabled, HEX DEREF X operates in EDR mode, allowing unknown and newly observed processes to be monitored and reported to the SOC team. When Zero Trust mode is enabled, the execution of unapproved processes is blocked at the kernel level according to predefined trust policies.

Target market

Malware Analysts
Security Researchers
Reverse Engineers
Threat Hunters
Red Team- ja Blue Team Professionals
IDA Pro Users
Security Research Laboratories and SOC Teams
Cybersecurity Companies Requiring Deep Analysis and Kernel-Level Visibility
Individual Consumers

Commercialization status

The product is largely ready for release, but a few requirements remain:

An EV Code Signing Certificate — approximately $1,272 per year
Obtaining the required certificate through a newly established company is possible, but partnering with an organization that already holds the necessary certifications would be significantly easier and more efficient
Potential funding to complete the product, marketing, and documentation

The software can begin generating revenue almost immediately once a company has been established and an EV code signing certificate has been obtained. The EV certificate is required to gain access to Microsoft's kernel-mode driver signing portal. Microsoft then signs the kernel driver, allowing the software to operate at the kernel level without requiring Windows Test Mode.

Why Invest? Return on investment (ROI) potential

F-Secure has a particularly strong position in Finland's consumer cybersecurity market. With the exception of HEX DEREF X: Endpoint Security, there are currently no other comparable domestically developed Windows products competing in this segment. This creates an interesting opportunity for HEX DEREF X in the Finnish cybersecurity market. F-Secure Total does not support Windows Server operating systems. It is designed for consumer Windows PCs, not servers. Their official list of supported platforms includes Windows 10 and Windows 11, but does not list Windows Server.

HEX DEREF X - Endpoint Security (ROI)-potential (PDF)

This is an interesting market observation for HEX DEREF X: in addition to Finland, F-Secure has secured distribution of its consumer security software through the branded offerings of four major Swedish telecommunications operators.

This distinction matters for HEX DEREF X's go-to-market strategy. If the product supports both Windows workstations and Windows Server, it can also serve customers for whom consumer-oriented security products are not suitable.

WithSecure - The European alternative for corporate cybersecurity - 5/23/2024

Investors should immediately understand that a single telecommunications operator partnership can provide access to a substantial number of potential customers without HEX DEREF X having to market and sell to each customer individually. F-Secure's business model demonstrates the effectiveness of this distribution channel: the company reports working through approximately 200 partners, most of them telecommunications operators, with partner-channel licenses typically generating recurring revenue.

In the Telia Sweden case study, F-Secure reported a 53% increase in security service revenue following the expansion of its service portfolio. These examples illustrate the potential of the distribution model and should not be interpreted as projections or forecasts of HEX DEREF X's future sales.

What about all the PDF files downloaded through your organization's web browsers? A kernel-level antivirus solution can monitor these file operations through the Windows file system filter architecture, giving it visibility into files downloaded by users across their browsers. And isn't this alone a compelling reason to acquire this production-ready source code, especially for organizations that want to keep their trade secrets and other sensitive documents on their own infrastructure rather than having them automatically submitted to third-party services? Isn't this a security concern for your organization?

A kernel-level EDR/XDR solution provides extensive visibility into activity across an organization's endpoints. This visibility can include process network connections, browser history, and files downloaded through web browsers.

Such detailed raw telemetry can be critically important when hunting for previously undetected threats (Threat Hunting). It allows security teams to investigate retrospectively whether an organization's endpoints have been targeted by, for example, an attack exploiting a zero-day vulnerability, which processes were executed on the systems, and which network connections they established.

Without sufficiently comprehensive event data, reconstructing an attack and determining its potential impact can be considerably more difficult. However, this also creates a double-edged sword: the greater the visibility a security vendor has into a customer's endpoints and user activity, the greater its responsibility for handling the collected information appropriately.

If a vendor uses collected telemetry for purposes beyond the agreed-upon security objectives, unnecessarily shares it with third parties, or handles it inadequately, technology intended to provide effective protection can itself become a significant privacy and security risk.

The following EDR/XDR products include threat hunting capabilities and are among the world's leading cybersecurity solutions:

ESET Inspect
ESET PROTECT Enterprise
CrowdStrike Falcon Insight
Microsoft Defender for Endpoint Plan 2
SentinelOne Singularity Complete

HEX DEREF X - Endpoint Security:

Unlimited access to process command-line information and network connection data, without vendor-imposed data retention limits
Active threat hunting capabilities
The ability to stop cyberattacks at their earliest stages
Prevention of ransomware attacks and data breaches before they can occur — including threats originating from within the organization itself

Ultimately, the most important factor is the ability to identify and prevent cyberattacks, particularly new and previously unknown attacks exploiting zero-day vulnerabilities, before they have an opportunity to cause damage.

Example pricing:

ESET PROTECT Core (Business): $274.50 per year for 5 devices
CrowdStrike Falcon Enterprise (Business): https://www.crowdstrike.com/en-us/products/trials/try-falcon/ — $184.99 per device per year, billed annually
ESET Business Subscription Plans — https://www.eset.com/us/business/subscription-plans/
ESET Elite Protection — https://www.eset.com/us/business/elite-protection/

The business model behind HEX DEREF X: Endpoint Security is particularly attractive due to its potential margins and scalability. A lifetime license for a single device is priced at $279.50, while a five-device package costs $1,299. Even relatively modest annual sales of 120 * $1,299 licenses (10 per month) would represent potential annual revenue of $155,880, excluding taxes.

As a software product, distribution does not require a traditional physical supply chain or significant per-unit manufacturing costs. However, expenses such as reseller commissions, marketing, and advertising must still be deducted from revenue. Despite these costs, direct sales offer considerable margin potential because the variable cost associated with delivering an individual license is relatively low.

This creates an opportunity for a business in which a significant portion of additional sales can translate directly into revenue and, subsequently, profit as sales volume increases. Naturally, expenses will still arise from software development, infrastructure, customer support, reseller commissions, marketing, and advertising. However, the marginal cost of delivering an individual software license is inherently low.

HEX DEREF X - PRO combines Endpoint Security and Anti-Malware capabilities into a single, centrally managed solution. For business customers, the product is priced at $2,999 as a one-time payment, covering 50 endpoints with lifetime licenses. Its competitive advantage lies in its extensive feature set and exceptionally competitive value proposition in the Windows security market. Consequently, acquiring just a handful of business customers could generate substantial revenue.

Hex-Rays already has an established reseller network ( https://hex-rays.com/partners ), meaning that building distribution channels from scratch may not be a major challenge. What is primarily needed now are the right people to handle sales, business development, and partnership building. Since I have not yet found a suitable partner in Finland to commercialize this source code and software, I am actively continuing my search for partners in international markets.

Investment highlights

A unique product with no direct competitor
Significant market potential as demand for cybersecurity solutions continues to grow
Deep technology suited to early-stage venture capital (VC) investors. The product is built on rare, technically demanding expertise that is difficult to replicate and creates a meaningful competitive advantage
A fully functional MVP that is already operational
An opportunity to build a company offering both endpoint protection and advanced analytics tools through a single platform

The product's value is rooted in highly specialized technical expertise that is difficult to replicate — not simply in marketing, user interface design, or the business model. This makes it challenging for competitors to develop an equivalent solution within a short timeframe.

In practice, Finland's endpoint security market remains heavily dependent on U.S.-based solutions. There are relatively few competitive alternatives developed domestically, and insufficient support has been provided for their development. Telecommunications operators worldwide represent potential source code licensing customers for HEX DEREF X.

Access to the source code provides full transparency, while SOC integration can be implemented comprehensively according to each organization's specific requirements. A telecommunications operator could use the source code as the foundation for developing its own XDR or Endpoint Security solution, in much the same way as leading enterprise security platforms in the market.

How do malware and ransomware get onto devices? Malware can enter a system through several attack vectors. For example, an attacker may gain access through a remote access connection using credentials exposed in a data breach. Malicious activity may also originate from within the organization, exploit an undisclosed zero-day vulnerability such as (CVE-2024-9680), or result from an employee accidentally executing malicious software without any malicious intent.

Regardless of how an attack originates, a successful cyberattack exploiting a zero-day vulnerability can introduce attacker-controlled or attacker-supplied code into a system that existing security solutions have never encountered before. Employee awareness training cannot necessarily prevent these attacks, because they may succeed without any employee error or intentional action.

This is precisely where HEX DEREF X: Endpoint Security's application- and process-level Zero Trust mode is designed to intervene. It monitors process execution and blocks unknown code from running at the kernel level in real time. The objective is to prevent malicious code from executing before an attack can escalate into a data breach or ransomware incident.