Endpoint Takeover Prevention
Built for the age of AI-accelerated cyberattacks, ETP makes Action1 takeover-resilient by design. It helps ensure a compromised platform alone can't take control of your endpoints or trigger widespread disruption. Protected actions run only with your authorization, verified by each endpoint before execution. No other endpoint management vendor offers this level of protection.
Status: Coming soon
New to Action1? See this capability in action!
A new era of cyber threats demands a new
security architecture
Endpoint management platforms are powerful by design. They need trusted access to patch systems, deploy software, run scripts, and control devices across an organization. But that same power makes them a high-value target for attackers: compromise the platform, and an attacker could gain a path to the entire endpoint environment.
How ETP's agent-side verification allows or blocks commands
AI is making this threat more urgent. Anthropic's Claude Mythos Preview demonstrated that frontier AI can autonomously discover previously unknown vulnerabilities and develop working exploits. At the same time, CISA is urging organizations to harden endpoint management systems, while OpenAI is calling for collective action on cyber defense as AI-enabled attacks become increasingly widespread and sophisticated.
ETP is Action1's architectural answer to this new threat model. It puts organizations in cryptographic control of protected actions affecting their endpoints. Even if the Action1 platform is compromised, attackers cannot use it alone to take over customer endpoints, making Action1 takeover-resilient by design.
How ETP reinvents endpoint security
ETP changes the traditional trust model in endpoint management: an endpoint does not execute a protected action simply because the management platform tells it to.
Instead, the action requires customer authorization. Action1 Cloud delivers it, and the Action1 agent independently verifies the authorization on the endpoint before the action can run. Action1 can deliver protected actions, but it cannot authorize them on your behalf.
Sign
An authorized administrator cryptographically signs a protected action using a private key controlled by your organization and protected by a passphrase. The private key is controlled by your organization and cannot be used, accessed, or recovered by Action1.
Deliver
Action1 Cloud securely delivers the signed action to the endpoint. The platform coordinates the action, but because it does not possess your private key, it cannot create a valid authorization itself.
Verify
Before a protected action can execute, the Action1 agent independently verifies the signature against trusted public keys in your organization's ETP Keychain. It also verifies that the action has not been modified since it was authorized.
Execute or block
Only a correctly signed, unaltered action from a trusted key can proceed through Action1's existing security controls. If the signature is missing or invalid, the action was altered, or the signing key is untrusted or revoked, the endpoint blocks the action.
How ETP verifies every protected action
Protected actions that require authorization
Data Sources
Data Sources and the scripts used to collect information from endpoints.
Scripts and script execution
Scripts and the commands used to run them on endpoints.
Automations
Automations and the actions they execute.
Software Repository packages
Packages and individual package versions.
Agent control operations
Moving endpoints between organizations or uninstalling the Action1 agent.
Remote sessions
Commands that initiate a remote session.
ETP highlights
Take zero trust all the way to the endpoint
ETP extends zero-trust principles all the way to the endpoint. Protected actions must prove customer authorization before execution, rather than being trusted simply because they came through the management platform.
Put security first without adding friction
ETP requires cryptographic authorization where it matters most: protected actions. Routine endpoint management continues without an additional signing step.
Add a cryptographic security layer AI can't simply bypass
Your organization holds the private keys required to authorize protected actions. Action1 never possesses them and cannot authorize these actions on your behalf, putting a cryptographic barrier between platform access and endpoint control.
Break the link between platform access and endpoint control
ETP creates an independent authorization boundary between the management platform and your endpoints. Control of the platform alone is never sufficient to execute protected actions across your endpoint environment.