VCS-aJiant EDR

Viettel Cyber Security is the cybersecurity company of Viettel Group, based in Vietnam. It develops security products and services, including endpoint detection and response, for organizations that face targeted attacks that signature-based antivirus cannot stop. Its research arm, VCSLab, regularly reports vulnerabilities to major software vendors.

VCS-aJiant is its endpoint detection and response product. A kernel-mode filter driver on each Windows, Linux or macOS endpoint monitors file, process, memory, registry and network behavior and sends suspicious events to a cluster of central servers for real-time analysis. Analysts work in a web portal that maps detections to MITRE ATT&CK, shows the kill chain, supports forensic investigation and launches response and malware removal. It integrates with threat intelligence, SIEM and SOAR and serves enterprises and public organizations.

• Filter driver monitoring: Tracks file, process, memory, registry and network behavior at kernel level.
• MITRE ATT&CK mapping: Flags abnormal behavior according to ATT&CK techniques.
• Kill chain view: Presents attack tracing as an intuitive kill chain map.
• Endpoint forensics: Provides in-depth investigation and an extensive malware removal tool.
• Policy support: Controls peripheral devices and supports a security helpdesk.
• Ecosystem integration: Connects to threat intelligence, SIEM and SOAR on Windows, Linux and macOS.

A commercial bank can deploy EDR agents on branch workstations and feed alerts to its SOC. A power or water utility can monitor servers in its IT network for lateral movement. A government department can enforce USB control and investigate phishing-related infections centrally.

Security teams detect targeted attacks that bypass traditional antivirus by watching endpoint behavior rather than signatures. Kill chain visualization and built-in forensics shorten investigation and incident response time and reduce false positives. Response actions and malware removal can be launched from the same console. Device control and helpdesk policies help enforce internal security rules across workstations and servers.

Targeted attacks and ransomware against Vietnamese banks, utilities and agencies have pushed organizations from antivirus toward EDR and SOC-based monitoring. New Vietnamese rules on information system protection and the preference for domestic security vendors in critical sectors favor locally developed EDR platforms.

Member of Viettel Group, Vietnam. The EDR datasheet lists three components: endpoint agents, a central processing and storage server cluster and a web portal. Its research lab VCSLab publishes vulnerability advisories in Microsoft products, with entries dated September and October 2026. Founding year not stated on the fetched pages.