Endpoint Takeover Prevention (ETP)
Built for the age of AI-accelerated cyberattacks, ETP is an industry-first security architecture that prevents threat actors from using a compromised endpoint management platform to take control of customer endpoints. Action1 is the only endpoint management vendor that offers this level of protection today.
Status: Coming soon
A new era of cyber threats demands a new
security architecture
Traditional endpoint management has relied on endpoints implicitly trusting and executing commands they receive from the management platform. This has created a long-standing, industry-wide security risk: compromising a single platform could give threat actors control over millions of endpoints across thousands of organizations.
The long-standing risk of traditional endpoint management (Now addressed by Action1 with ETP)
This risk is far from theoretical. The 2020 SolarWinds Orion supply chain breach and the 2021 Kaseya VSA ransomware attack showed how widely enterprise IT management software can expose organizations to large-scale attacks. More recently, following the March 2026 cyberattack against Stryker, CISA urged organizations to harden their endpoint management systems.
AI is making this long-standing risk even more urgent. As Anthropic demonstrated with Claude Mythos Preview, advanced AI models can autonomously discover previously unknown vulnerabilities and develop working exploits, dramatically accelerating the potential pace of cyberattacks.
While AI makes it increasingly difficult to keep attackers out, traditional security measures such as MFA, role-based access control, and zero-trust policies remain essential. But they do not address the underlying risk: endpoints continue to trust and execute commands from the management platform, even if it is compromised.
Introducing ETP: A takeover-resilient security architecture for endpoint management
ETP fundamentally changes how enterprise endpoint management platforms operate.
Instead of automatically trusting commands from the management platform, endpoints managed by Action1 execute high-risk actions only when the customer cryptographically authorizes them. Even if threat actors gain complete control of the Action1 platform, they will not be able to execute high-risk actions on customer endpoints.
Customer-controlled authorization: Customers retain cryptographic control of private keys. Action1 cannot authorize high-risk endpoint actions on their behalf.
Independent endpoint verification: Action1 agents deployed on customer endpoints verify cryptographic signatures and block unauthorized or altered commands, even when delivered through a compromised Action1 cloud.
Frictionless operation: Authorized automations and scheduled deployments continue running without requiring manual approval for every execution.
Action1 ETP: Keeping endpoints protected even if the platform is compromised
Here's how ETP works in four simple steps, from customer authorization to endpoint-side verification and execution.
Administrator signs a high-risk action
An authorized administrator cryptographically signs a protected action using a private key controlled by your organization and protected by a passphrase. The private key is controlled by your organization and cannot be used, accessed, or recovered by Action1.
Action1 Cloud delivers the signed command to the endpoint
Action1 Cloud securely delivers the signed command to the endpoint. The platform coordinates the action, but because it does not possess your private key, it cannot create a valid authorization itself.
Action1 agent verifies whether the signature matches trusted keys
Before a high-risk action can execute, the Action1 agent running on the endpoint independently verifies the signature against trusted public keys in your organization's ETP Keychain. It also verifies that the action has not been modified since it was authorized.
Action1 agent executes or blocks the action
Only a correctly signed, unaltered action from a trusted key can proceed through Action1's existing security controls. If the signature is missing or invalid, the action was altered, or the signing key is untrusted or revoked, the endpoint blocks the action.
High-risk endpoint actions protected by ETP
(protected actions)
With ETP, high-risk endpoint actions require a cryptographic signature from the customer, and the customer's private key is decrypted and used only in their browser. Even if threat actors compromise the Action1 platform, they cannot authorize high-risk actions on customer endpoints without the customer's private key.
Data Sources
Data Sources and the scripts used to collect information from endpoints.
Scripts and script execution
Scripts and the commands used to run them on endpoints.
Automations
Automations and the actions they execute.
Software Repository packages
Packages and individual package versions.
Agent control operations
Moving endpoints between organizations or uninstalling the Action1 agent.
Remote sessions
Commands that initiate a remote session.
ETP use cases
ETP gives organizations a safe, resilient way to manage endpoints by ensuring that only customer-authorized high-risk actions can run. It sets a new security standard for the industry: even if an endpoint management platform is compromised, threat actors cannot use it to take over customer endpoints.
Take zero trust all the way to the endpoint
ETP extends zero-trust principles all the way to the endpoint. High-risk endpoint actions must prove customer authorization before execution, rather than being trusted simply because they came through the management platform.
Put security first without adding friction
ETP requires cryptographic authorization where it matters most: high-risk endpoint actions. Routine endpoint management continues without an additional signing step.
Add a cryptographic security layer AI can't simply bypass
Your organization holds the private keys required to authorize protected actions. Action1 never has access to your unencrypted private keys or key passphrases and cannot use them to execute protected actions on your behalf. This puts a cryptographic barrier between platform access and endpoint control.
Break the link between platform access and endpoint control
ETP creates an independent authorization boundary between the management platform and your endpoints. Control of the platform alone is never sufficient to execute high-risk actions across your endpoint environment.