Bring Your Own Vulnerable Device: The EDR Killer Economy
SentinelOne, Monday, September 28th, 2026
SentinelOne finds ransomware crews now sell versioned, supported 'EDR killer' tools to affiliates as a BYOVD service economy.
Part of a series on bring-your-own-vulnerable-driver (BYOVD) attacks, this post examines the market around EDR-killing tools.
SentinelOne describes ransomware groups maintaining in-house EDR killers as products, with versioned variants, pricing and support for paying affiliates, shifting the threat from lone operators to a service economy with operator-led R&D.
The post covers the supply chain behind these tools and how defenders can respond.