Every package is the whole product: the detective, the Living Register, the AI Eliminator, and AI-RP™ — AI Ransomware Protection — part of the Shadow Detective line, arriving with the next build. Nothing is held back for a higher tier.
Pick the ground the detective has to cover. The price is per seat, the same card at every size — and every seat carries the full product, with AI-RP™ included and arriving with the next build.
Already a Henschel managed client? Shadow Detective is included with the Business ($165) and Premium Business ($200) managed tiers — no separate charge. MSPs: the channel price is $3 per seat, flat.
The newest ransomware carries no file for a definition to match — it asks a model for its orders, live, and runs what comes back. AI-RP™ watches the machinery instead of the file: a local AI runtime called in attack rhythm, traffic leaving through a tunnel, and files changing in bulk, converging on one machine from a process with no name and no signature. One signal alone is nothing. Together, they are a finding — raised to a human, with the evidence attached. Detection stays deterministic: definitions + rules + correlation — the same evidence produces the same finding, every time.
AI-RP™ comes with the tool — never a separate purchase. Honest status: AI-RP™ is built in the development line — correlator, console toggle, and signed definitions registry — but it is not inside the shipped 0.4.0 release, and its live collector wiring is the next build step. It arrives with the next build, off until you turn it on.
The purchase flow, exactly as designed. Checkout opens with general availability — until then, the Early List is the front of the line.
Pick the edition and the seat count on this page. The price you see is the price on the card — monthly or yearly, no tiers of features.
Secure card checkout. Your order creates your customer record and your seat count — nothing else is collected, and nothing phones home.
A license file signed for your organisation arrives by email, with your download link. The signature is ours; the license names your seats.
Your installer is built for your organisation — watermarked to your license — and the definitions stream starts the day you install.
One detective, delivered to fit the ground it covers — from a single machine to a fully self-contained enterprise install. However it is delivered, the mark is the same: the Shield Watch — the detective in the shield, border lit — carried at every size an operating system asks for, from the 16-pixel tray icon to the full-size tile. One file, resized — never redrawn, never recolored.
One agent on your machine, reporting to a hosted console. The full resident watch, nothing to run yourself.
Agents across the business, Henschel-managed, with monthly reporting — run from Station 1 or hosted.
Your own VM or hosted, with Layer 2 tool offerings, run from Station 2.
Your own VM and your own dashboard, fully self-contained, with Layer 3 tool offerings, run from Station 3. Agents cover anyone who can’t run a station or a VM.
SAME ARTWORK AT EVERY SIZE — TRAY · TASKBAR · DESKTOP · COMPANY PORTAL · BROWSER TAB (FAVICON.ICO CARRIES 16–256 PX IN ONE FILE)
Your delivery email carries your download link and your license file. The download is a single archive, built for your organisation — and it checks its own contents before anything installs. This is the shipped 0.4.0 release: what is listed below is what is in it.
EVERY INSTALLER IS WATERMARKED TO THE CUSTOMER LICENSE IT WAS BUILT FOR — A LEAKED COPY NAMES ITS SOURCE.
The installer checks its own work and shows you the checklist. No silent failures, no guessing whether it took.
Unzip the full download to a folder first — the setup program needs its payload and definitions folders beside it, and it will stop and tell you if they are missing.
Right-click ShadowDetective-Setup.exe, choose Run as administrator, and approve the prompt once. See the signing section below for the honest state of production code signing.
Payload laid down, configuration written, definitions seeded and verified, your organisation key generated, and the three services — Sensor, Update, and Console — registered and started.
The install ends with a PASS/FAIL checklist: every service running, the console answering, the installed definitions reading back as the seeded version. Any FAIL names what is wrong, and a setup log is written on every outcome.
The console lives on the machine itself at 127.0.0.1:5099 — nothing is exposed to the network. First visit: register the admin account, sign in, and the machine’s pages appear.
The tray icon appears at next sign-in: a green dot, Watching. From that moment the register is being written. AI-RP™ is not in this 0.4.0 install — it arrives with the next build, where its console switch will enable it.
NETWORK EDITION DEPLOYS THE SAME PACKAGE BY PUSH — GPO, WINRM, OR INTUNE — THE WAY YOUR OTHER BUSINESS SOFTWARE ARRIVES.
A Sectigo OV code-signing certificate for CL Henschel LLC has been purchased, and validation is still pending. Production code signing via that Sectigo OV certificate is being put in place — today’s private-testing binaries are not production-signed, and we won’t claim otherwise. When the signature is live, it is a seal: change one byte after signing and the seal breaks, loudly.
Once production signing is in place: right-click the installer → Properties → Digital Signatures. The signer will name CL Henschel LLC, and the certificate chain will run to Sectigo as the public certificate authority. Until validation completes, that production signature is not in place.
Once production signing is live, the Windows elevation prompt will show the verified publisher name — not “Unknown publisher.” That name will be there because Sectigo checked who we are before issuing the certificate.
With production signing in place, the installed services will verify their own signatures at startup. A tampered component does not quietly run — it refuses, and the refusal goes on the record.
When production signing lands, the product’s own components will be recognised by that same certificate — identity by signature, never by name.
No client software is uncrackable, and we won’t claim otherwise. The design goal is different: make a copied copy costly to build, useless without the living parts, and traceable to its source. Seven layers do that work.
Production code signing via a Sectigo OV certificate is being put in place — purchased, with validation still pending. Once live, tampering breaks the seal, and unsigned lookalikes can’t pass as ours — to Windows, or to the product itself.
The matching engine and the correlation logic — the crown jewels — are obfuscated and ahead-of-time compiled. What a copier wants most is what’s hardest to read.
The registry that does the detecting is not in the box. Definitions arrive as signed, versioned data, with rollback refused — a copied binary, cut off from the stream, goes stale on a schedule.
Each customer runs on a signed license file issued to their organisation — the private key that signs licenses never ships. Network Edition counts seats against it.
Hash-verified payloads and protected install locations today — and, once production signing is in place, a signed installer whose services verify their own signatures every time they start.
Signing keys live in a managed vault, never on a build machine and never inside the product. What isn’t in the box can’t be taken from the box.
Every customer’s installer is watermarked to their license. If a copy walks, it carries the name of where it walked from.
And behind the engineering stands the paper: Patent Pending on the product, the know-how held as trade secret, and the name carried by Henschel AI-Shield™. Copying it isn’t just hard — it’s actionable.
What comes with Shadow Detective, named plainly — what each part is, and what it is not.
The service Shadow Detective is delivered under — the managed protection around the tool, from Henschel Technologies.
The detective itself: the resident watch, the Living Register, and the AI Eliminator. Patent Pending applies to Shadow Detective only.
The Intune hardening arm: policies locking AI down on phones, laptops, tablets, kiosks, IoT, and in-house machines, applied via Intune.
A reserved future controller designation. A roadmap mention only — not a product, and not purchasable.
Shadow Detective is in private testing. Join the Early List and you’ll hear when the first cases open — packages, prices, and downloads exactly as shown here.
Join the Early ListIt’s your business. You have a right to know.
For local IT needs — Henschel Technologies·henscheltech.com·855-IT-PROBLEM