Endpoint Attack Surface Reduction: Hardening with GravityZone
In short: Attack surface reduction means limiting the tools, settings and vulnerabilities an attacker could use on an endpoint to what the business actually needs. Because attackers increasingly abuse built-in tools such as PowerShell and WMI (living off the land), detection alone is not enough. In GravityZone, Risk Management, Patch Management and PHASR each cover one part.
What is attack surface reduction, and why does it matter in 2026?
Attack surface reduction is the practice of limiting the points where an attacker could enter data, extract data or take control of a system to those the business genuinely needs. On an endpoint, that means disabling unneeded services, fixing misconfigurations, applying patches and narrowing the tools each user can run.
The topic has moved up the agenda because attacker tradecraft has shifted. A joint guide published on 7 February 2024 by CISA, NSA and FBI together with the national cyber security centres of Australia, Canada, the United Kingdom and New Zealand describes state-sponsored actors using living off the land (LOTL) techniques and notes that this activity is spreading across the wider threat landscape.
In its announcement of 23 April 2025, Bitdefender stated that, according to its own investigations, legitimate tools and LOTL techniques are involved in over 70% of major security incidents; this is the vendor's own figure. For how the endpoint layer fits alongside network, telephony and email, see our SMB office IT infrastructure guide.
Why do living off the land attacks challenge traditional antivirus?
In a LOTL attack, the adversary brings no new malicious file; instead, they abuse signed, trusted tools that already ship with the operating system. The joint guide stresses that this activity leaves few conventional indicators of compromise (IOCs) and that many organizations lack a baseline of normal behavior, so malicious use blends in with legitimate administration.
The MITRE ATT&CK knowledge base describes these behaviors as separate techniques. Four that defenders meet most often:
- T1218 System Binary Proxy Execution: using Microsoft-signed binaries that ship with Windows to proxy the execution of other files or commands.
- T1059.001 PowerShell: abusing the scripting environment built into Windows for discovery and code execution.
- T1047 Windows Management Instrumentation: running commands through the Windows management infrastructure (WMI).
- T1197 BITS Jobs: using the Windows background file transfer service for downloads and persistence.
The guide's most practical warning: a legitimate admin tool is not safe to allow for everyone. CISA red teams often find LOLBins open even to standard users and overly broad exceptions granted for PsExec. Detection and hardening therefore complement rather than replace each other; we cover the detection layer in EDR vs XDR vs MDR.
Which GravityZone components shrink the attack surface?
Three GravityZone components reduce the attack surface: Risk Management finds misconfigurations and vulnerabilities, Patch Management closes known vulnerabilities, and PHASR restricts tools per user. EDR/XDR does not shrink the surface; it makes the remaining attacks visible.
| Component | What it reduces | How it works | Where it sits, per the vendor |
|---|---|---|---|
| Risk Management | OS misconfigurations, applications with known CVEs, risky user behavior | Scheduled or on-demand risk scans; automatic or manual fix per finding | Endpoint Risk Analytics is listed from the Business Security package upwards on the comparison page |
| Patch Management | Known vulnerabilities with an available patch | Automatic or manual patching for Windows, macOS, Linux and third-party applications | Add-on module for all GravityZone endpoint security solutions |
| PHASR | Risky tools and actions a user never uses | Behavioral profile per user-device pair; action-level restriction | Add-on license for Business Security Enterprise, MDR and Cloud MSP solutions; also a standalone product |
| EDR / XDR | Does not shrink the surface; exposes remaining attacks | Cross-endpoint incident correlation, threat hunting, response | Business Security Enterprise and XDR tiers |
The full feature lists and package selection by company profile are in our GravityZone package comparison; here we look only at the attack surface. Product details are on the GravityZone Business Security Enterprise, GravityZone XDR and GravityZone Patch Management pages.
How does GravityZone PHASR work?
GravityZone PHASR (Proactive Hardening and Attack Surface Reduction, Bitdefender's proactive hardening technology) builds a behavioral profile for each user-device combination and restricts risky tools or actions that profile does not use. Bitdefender announced it through an early access program on 23 September 2024 and made it available worldwide on 23 April 2025.
According to Bitdefender TechZone, PHASR monitors five activity types on Windows, macOS and Linux: LOLBins, tampering tools, piracy tools, cryptominers and remote admin tools. It ships with more than 1,100 monitored rules.
Its distinguishing feature is action-level blocking: a tool is not banned outright, only its risky use. In the documentation's example, WMIC stays available for system information but is blocked for lateral movement; for a frequent PowerShell user, only obfuscated or encrypted scripts are stopped.
The learning phase takes 30–60 days depending on the monitored rules; with GravityZone EDR, historical data can shorten it to a few minutes. Two operating modes follow, and the decision matrix below shows where each fits.
| Criterion | Direct Control | Autopilot |
|---|---|---|
| Who decides? | An administrator reviews and approves recommendations | PHASR applies changes itself based on learned behavior |
| Our suggested use | IT and admin profiles, business-critical applications, the first months | Standard users with stable behavior; categories with no business value such as cryptominers or piracy tools |
| Dashboard visibility | Recommendations listed with an impact score | No recommendations shown for activity types in Autopilot |
| Exceptions | Allow or restrict at rule level | Manual override since September 2026 (v6.77): access stays open for five days and the restriction returns if unused |
| User requests | Request Access on Windows lets users ask for access with a business reason; in both modes it goes to an administrator for approval | |
PHASR for AI Agents, introduced in the September 2026 release notes, treats AI agents on the endpoint as behavioral profiles separate from the user, so granting an agent PowerShell does not extend that right to the person. The feature is currently available on Windows endpoints.
How do you harden endpoints step by step?
An eight-step cycle that starts with inventory and ends with measurement matches both the joint LOTL guide and the "identify, prioritize, address, track" flow of GravityZone Risk Management.
- Build an inventory and a baseline. List which software and admin tools run on which device; the first two controls of CIS Controls v8.1 are built on this inventory. The joint guide also recommends a baseline of normal LOLBin use.
- Schedule risk scans. Risk Management is enabled through scheduled scans in the policy settings; you can also start a Risk Scan task on endpoints selected from the Network page.
- Fix misconfigurations. On the Findings page, each finding offers automatic mitigation, manual steps, temporary ignoring and rolling back a fix; the CIS compliant section lists findings mapped to CIS v8.
- Patch vulnerabilities. For applications with CVEs in the Vulnerabilities section, the Patch App option uses the Patch Management module to update to a fixed version.
- Start PHASR in Direct Control on a pilot group. Watch recommendations during the learning phase without enforcing them, and assess IT and admin profiles separately.
- Apply recommendations by impact. Begin with the highest-impact "Restrict access" recommendations and tell users they can ask for access through Request Access.
- Consolidate remote access tools. The joint guide advises disabling and alerting on remote access tools you do not need, keeping one primary and one backup solution.
- Measure and repeat. Track the company risk score and the PHASR attack surface exposure; move categories with stable behavior to Autopilot.
This cycle is only the endpoint part of a broader ransomware defense; for backups, MFA and incident response, see our 10-step ransomware defense plan for SMBs.
If you want to plan risk scanning, patching and PHASR configuration for your own environment, our team can help. Contact us
Which findings should you fix first?
Four criteria set the priority together: impact, evidence of exploitation, number of affected devices and the business disruption risk of the fix. GravityZone's Industry Modifier shows whether CVEs in your environment have already been exploited at other organizations in your industry.
| Priority | Criteria | Example finding | Suggested response |
|---|---|---|---|
| 1 — now | High impact, exploited in your industry, many devices | Application with a CVE exploited in your sector | Patch App or an emergency patch window |
| 2 — this week | High impact, no exploitation evidence, reversible fix | Local or group policy misconfiguration | Automatic fix on a pilot device, then roll out |
| 3 — planned | Medium impact, fix may affect workflows | LOLBins open to standard users | PHASR Direct Control, action-level restriction |
| 4 — accept and monitor | Low impact or a compensating control exists | Legacy business application that cannot be removed yet | Documented ignore with a review date |
For a simple ranking, score each criterion from 1 to 3 and use: priority score = impact × exploitation evidence × prevalence ÷ disruption risk. Set the threshold according to your own risk appetite.
What are the most common hardening mistakes?
The most common mistakes are switching a tool off entirely and breaking workflows, or leaving "temporary" exceptions in place for good. Review this checklist before each round:
- Disabling a tool outright: TechZone notes that PowerShell and Certutil are also used by many third-party applications, so disabling them can cause serious disruption; prefer action-level restrictions.
- Forgetting temporary rights: PowerShell access granted for one task widens the surface if never revoked; PHASR recommends revoking unused access.
- Keeping default logging: the joint guide recommends detailed, centralized logging of command lines, PowerShell and WMI activity.
- Forgetting ignored risks: an ignored finding drops out of the company risk score; record a reason and a review date.
- Leaving cloud identity open: the guide also points to secure configuration baselines for Microsoft 365; see our Microsoft 365 security settings checklist.
FAQ
Does attack surface reduction replace antivirus?
No, the two complement each other. Antivirus and EDR detect and stop malicious activity, while attack surface reduction removes tools, settings and vulnerabilities an attacker could use in the first place. The joint LOTL guide also treats detection and hardening as separate practice areas and stresses how hard it is to spot abuse of legitimate tools through detection alone.
Which GravityZone package includes PHASR?
According to Bitdefender's product page, PHASR is offered as an add-on license for Business Security Enterprise, MDR offerings and GravityZone Cloud MSP solutions, and as a standalone product that works alongside third-party EDR/XDR tools. To discuss adding it to your current license, use the Get a Quote form.
How long is the PHASR learning phase?
According to TechZone, the learning phase takes 30–60 days depending on the monitored rules. If you use the GravityZone EDR component, historical data can shorten it to a few minutes. The standalone PHASR agent cannot use EDR history, so its learning phase cannot be shortened this way; plan your pilot accordingly.
What happens if a restriction blocks an employee's work?
On Windows, the user can request access with a business reason through Request Access, and the request goes to an administrator. In Autopilot mode, administrators can manually override a restriction since September 2026: access stays open for five days, and the restriction returns if the tool goes unused. Starting with a pilot group surfaces such requests early.
Can living off the land attacks be prevented completely?
According to the joint guide, no foolproof solution fully prevents or detects LOTL activity. The recommended approach is layered: detailed centralized logging, behavioral baselines, application allowlisting, network segmentation and phishing-resistant multi-factor authentication. Attack surface reduction is one of these layers and works best alongside the others.
How does application allowlisting differ from PHASR?
NIST SP 800-167 describes an application allowlist as the list of applications authorized to run in an organization, deciding whether an application may execute at all. PHASR decides, based on behavior, which actions inside an allowed tool are open to which user. For Windows, the joint guide recommends AppLocker and Windows Defender Application Control; the approaches can be combined.
Conclusion
- LOTL attacks use legitimate tools, so detection alone struggles; the joint guide puts baselines and allowlisting first.
- In GravityZone, Risk Management covers misconfigurations and vulnerabilities, Patch Management covers patching and PHASR covers per-user tool restriction.
- Starting PHASR in Direct Control on a pilot group and moving stable categories to Autopilot lowers the risk of disruption.
- Rank findings by impact, exploitation evidence, prevalence and disruption risk, and document every ignored risk with a reason and a date.
Sora Yazılım Teknolojileri provides selection, procurement, deployment, support and managed services for Bitdefender GravityZone; the scope of hardening work is defined in the contract. Book a free discovery call to review your environment with us.
Free discovery call · WhatsApp: WhatsApp Support · Phone: +90 544 785 21 87 · Email: talep@sorayazilim.com
Sources
- Identifying and Mitigating Living Off the Land Techniques (joint guide) — CISA, NSA, FBI, ACSC, Canadian Centre for Cyber Security, NCSC-UK, NCSC-NZ and others, 7 February 2024. ncsc.govt.nz (accessed 19 October 2026)
- MITRE ATT&CK v20 technique pages — MITRE. T1218, T1059.001, T1047, T1197 (accessed 19 October 2026)
- CIS Critical Security Controls v8.1 — Center for Internet Security. cisecurity.org (accessed 19 October 2026)
- SP 800-167, Guide to Application Whitelisting — NIST, October 2015. csrc.nist.gov (accessed 19 October 2026)
- Bitdefender TechZone articles: PHASR, Risk Management, Endpoint Risk Management (accessed 19 October 2026)
- GravityZone PHASR product page — Bitdefender. bitdefender.com (accessed 19 October 2026)
- PHASR press releases — Bitdefender, 23 September 2024 and 23 April 2025 (accessed 19 October 2026)
- What's New in GravityZone September 2026 (v 6.77) — Bitdefender. bitdefender.com (accessed 19 October 2026)
- GravityZone Patch Management and package comparison pages — Bitdefender (accessed 19 October 2026)
How this article was prepared
Prepared by: Sora Yazılım Team. This article was prepared with AI assistance; technical details were checked against the vendor and official sources linked in the text as of 19 October 2026.
Related articles
- SMB Office IT Infrastructure Setup Guide — The pillar article covering network, phones, email and endpoint security in one plan.
- Bitdefender GravityZone Packages Compared — Choosing a package by company profile.
- Microsoft 365 Security Settings Checklist — Hardening identity, devices and email.
- Microsoft 365 Business Basic vs Standard vs Premium — Which plan fits which team.
- Exchange Server End of Support — Deciding between Exchange Online and Exchange SE.
- Ruijie Reyee or RG Enterprise Series? — Choosing network products by scale.
- Wi-Fi 7 Enterprise Migration Guide — When upgrading makes sense.
- 3CX Phone System Deployment Options — Cloud, on-premises and SIP trunk models.
- 3CX and Microsoft Teams Integration — Calling through your phone system from Teams.