HarfangLab

Why we chose it

Some organisations cannot hand their endpoint telemetry to a non-European vendor — operators of vital importance, entities under sovereignty constraints, public bodies, defence industry. For them the question is not which EDR scores best on a test bench, but which one is admissible at all. HarfangLab meets that constraint without giving ground technically.

What it changes in practice

• ANSSI security visa

  The product has been through an evaluation by the French national agency. In a compliance file or a public tender, that point is demonstrated rather than argued.

• Deployment on your own infrastructure

  The whole stack can be installed on your premises, including on isolated networks. No telemetry leaves your perimeter unless you decide it should.

• Open detection rules

  The rules are readable and editable. For a team that wants to understand why an alert fired — and explain it to an auditor — that is a difference in kind from a black box.

• People you can reach, in France

  Support and the product team are reachable, in French, in the same time zone. That sounds anecdotal until the day of the incident.

Our assessment, without varnish

The third-party integration ecosystem is narrower than that of the American platforms, and the bundled threat intelligence does not cover the same ground. We compensate with our own sources and our orchestrator. Sovereignty has an integration cost: it is real, it is manageable, and it should be stated before the decision.