Fast deletion containment
Single destructive actor
Windows security research · V4
Break the attack
before it breaks you.
Shieldbreaker is an open research project exploring fast detection, attribution, and containment of destructive Windows processes—measured in milliseconds.
LIVE LAB MODELSB-V4 / WIN
Signal21.8 ms
Attribute10.7 ms
Contain34.6 ms
Measured fast-path average · 3 runs · 1,000 generated files
Measured, not imagined
The damage window is getting smaller.
V4 moves attribution into the same time scale as detection, while keeping the tested safety boundary explicit.
High-churn containment
With three benign actors
Files protected
Comparable single-deleter runs
False positives
Across current benchmark runs
These results describe the tested fast path, not a production security claim. The current prototype does not yet contain every simultaneous destructive actor.
How it works
A narrow experiment with a hard safety boundary.
The lab deliberately limits what it can destroy, measures what it can prove, and states where production telemetry is still required.
01
Detect at machine speed
Filesystem monitoring and concurrent handle attribution reduce the gap between the first destructive signal and containment.
02
Attribute the actor
The detector discovers the process. Launched PIDs are retained only to score whether attribution was correct.
03
Fail closed by design
Every destructive operation is confined to a fresh, validated lab directory. Any safety-boundary failure stops the run.
Toward production
The prototype proved speed. The next phase proves coverage.
Production containment needs trustworthy per-operation identity, broader workload coverage, and simultaneous-actor control.
- Per-operation PID telemetry through a supported kernel pipeline
- Concurrent containment of every independently attributed actor
- Signed minifilter research and production-grade telemetry
- Broader workloads, protected processes, and adversarial evaluation
Open research