Problem it solves
Attackers abuse legitimate tools already on the system and detection struggles to tell intent apart.
⌘K
Product
GravityZone PHASR
Proactive hardening and attack surface reduction: restrict the native tools attackers abuse without slowing your people down.
Proactive Hardening
Shrink the Attack Surface Without Slowing the Business
Living-off-the-Land (LOTL) attacks use legitimate system tools such as PowerShell or WMIC to blend in. Bitdefender research found native tools exploited in 84% of major security breaches.
GravityZone PHASR (Proactive Hardening and Attack Surface Reduction) builds a unique behavioral profile for each endpoint user, identifies which tools and actions they need and restricts everything else automatically.
Key Features
Key Capabilities
Tailored Hardening
AI algorithms build a risk profile for each user-endpoint combination, identify unnecessary tools and tailor hardening dynamically.
Dynamic Reduction
Learns continuously and adapts autonomously to changing behaviors and threat vectors, minimizing IT overhead.
Precise Control
Restricts risky behaviors within allowed tools; for example, it allows PowerShell but blocks encrypted commands.
Risk Metrics
Displays attack surface and risk reduction metrics associated with each recommendation, enabling better security posture tracking.
Autopilot Protection
Dynamically applies hardening recommendations as behaviors and threats evolve. Admins can also choose Direct Control mode.
Simplified Deployment
Integrated within the GravityZone platform. Existing customers can activate it and start identifying risks in minutes.
Least Privilege
Allow only what each user needs
Up to 95% of access to risky tools is unnecessary. PHASR identifies it and restricts it automatically.
- Prevents unnecessary use of tools such as PowerShell or CertUtil for specific accounts.
- Covers remote admin tools, LOLBins, hacktools, crypto miners and tampering tools.
- Reduces the attack surface without disrupting productivity.
Defense in Depth
One more control in your layered strategy
Against LOTL attacks, Bitdefender recommends combining least privilege, defense in depth, network segmentation and security awareness training.
- Least privilege: only the access each task requires.
- Defense in depth: prevention, protection, detection and response.
- Network segmentation and protection to limit lateral movement.
- Security awareness training to reduce initial access.
Use Cases
Practical Applications
Stop LOTL Attacks
Stops attackers from hiding behind rundll32, csc.exe, reg.exe, netsh or PowerShell, the five tools that appear most in Bitdefender's study of more than 700,000 major GravityZone incidents.
Less Work for the SOC
By removing unnecessary access before an attack, the team has less legitimate activity to tell apart from the malicious kind.
Key Benefits for Your Organization
Why choose GravityZone PHASR?
Stop Stealthy Ransomware
Restricts each tool to the actions each user legitimately performs, removing the attack path before it can be used, regardless of which EDR or XDR you run.
Reduce Risk Without Friction
Generates a unique policy per user based on actual behavior and updates automatically as it changes, without IT managing exceptions by hand.
Less Load on the SOC
By restricting each tool to what the user needs, the alert never fires. In early adopter testing in 2024, it reduced investigation and response workloads by up to 50%.
Measurable Results
92.8%
Attack reduction by blocking tools unused by the management team
95.1%
Attack reduction by letting tools such as PowerShell take only legitimate actions
99%
Of companies do not use Bitsadmin but have it enabled
133
LOLBins in a fresh Windows 11 installation
Integrations
Unified GravityZone Platform
GravityZone EDR Cloud
GravityZone XDR
GravityZone Extended Email Security
GravityZone EASM
GravityZone Compliance Manager
GravityZone AI Visibility and Control
Technical guide for choosing the solution
When should you add GravityZone PHASR?
PHASR is the preventive complement to detection and response: it cuts unnecessary access to native tools before an attacker uses them, so the SOC has less suspicious activity to investigate.
What it includes
Risk profiles per user and endpoint, precise control within allowed tools, risk metrics and Autopilot or Direct Control mode.
Best for
Organizations whose users do not need system tools, or with small teams that cannot maintain hardening manually.
How TUTARI implements it
We assess the exposure, enable PHASR in phases and review the restrictions with your team.
Commercial coverage in Costa Rica and Mexico
We serve companies with local contact, remote or onsite delivery, and the same service standard in both countries.
Costa Rica
In Costa Rica we deploy GravityZone PHASR on the Bitdefender endpoint agent: we identify which native tools each user group uses, apply the restrictions and support the IT team through rollout. Support is handled in Spanish and in local hours.
Request assessmentMexico
In Mexico we support the GravityZone PHASR rollout from Mexico City: an initial exposure assessment, activation by user group and follow-up of results with the security team. Support is handled in Spanish and in your own time zone.
Request assessmentWhat is GravityZone PHASR and how does it reduce the attack surface?
TUTARI S.A. — Bitdefender Partner
GravityZone PHASR (Proactive Hardening and Attack Surface Reduction) is a Bitdefender solution designed to combat Living-off-the-Land attacks. It uses individual machine learning models for each endpoint, identifies uncommon user and group behavior and correlates it with known attack vectors.
Instead of trying to tell malicious use from legitimate use, PHASR defines and enforces each user's legitimate behavior: it uses AI algorithms to profile each user-endpoint combination, restricts what they do not need, such as PowerShell or CertUtil, and adapts when their roles change.
TUTARI assesses your exposure, enables PHASR gradually by user group, reviews with your team which tools get restricted and supports the follow-up so that the attack surface reduction does not affect operations.
Frequently Asked Questions about Bitdefender GravityZone
Answers to the most common questions about our services
Request Information
What is a Living-off-the-Land (LOTL) attack?
It is an attack that uses legitimate tools already on the system, such as PowerShell, WMIC or netsh, instead of external malware. That lets it blend in with normal activity and makes it hard to detect.
Does PHASR replace EDR or antivirus?
No. PHASR reduces the attack surface proactively and complements your EDR or XDR, whether from Bitdefender or a third party. It is available as a standalone license and as an additional license to GravityZone Enterprise, the MDR offerings and the MSP solutions.
Can it block tools my administrators do need?
PHASR analyzes the behavior of each user and group to restrict only what they do not need, without affecting legitimate use, and adjusts access when the role changes.
Can I allow PowerShell but block dangerous commands?
Yes. PHASR can restrict risky behaviors within allowed tools; for example, allowing PowerShell while blocking encrypted commands.
How do I know how exposed I am today?
Bitdefender offers a free internal attack surface assessment that uses PHASR to identify unnecessary use of risky tools. TUTARI can help you request it.
How does TUTARI help with GravityZone PHASR?
TUTARI, a Bitdefender partner, assesses the exposure, rolls PHASR out in phases and provides Spanish-language support in Costa Rica and Mexico.
Reduce your attack surface with PHASR
Talk to a TUTARI expert about GravityZone PHASR.
Consult with Experts
