General Information

Plurilock DEFEND is a continuous authentication platform that offers identity assurance with behavioral biometrics. It uses micro-patterns in a person's keystroke and pointer behavior to identify users, using this data to continually check for unauthorized use of the endpoint.

DEFEND is based on a client/server architecture:

• The DEFEND agent (client) runs in the background collecting mouse and keyboard timing data

• This data is delivered to the DEFEND server for analysis and learning

• The DEFEND server continuously informs the agent that the most recent biometric data was either good (a “match” for the user) or bad (not a “match” for the user)

• You can configure DEFEND to take action (by having the agent lock workstations when identity risk is high) or you can take action yourself (by ingesting decisions from the DEFEND server with your SIEM)

In short, the DEFEND server receives data samples from connected agents and uses them to build and maintain profiles (biometric keyboard and mouse movement signatures) of end-users.

Once the profile of the user has matured, the protection and detection capabilities of DEFEND are automatically enabled and the DEFEND server then continuously compares a user’s current activity against their biometric signatures to detect suspicious behavior.

The Endpoint Agent

Plurilock agent is a lightweight agent that can be installed on Windows or Mac OS machines. The agent begins working automatically when a user logs into the system and stops running when a user logs out of the system.

Plurilock Agent Requirements

DEFEND endpoint requirements are as follows:

• Windows: Windows 8 or higher (Home, Pro, Workstation or Enterprise editions)

• Mac OS: Mac OS Mojave (10.14) or higher