Bring Your Own Vulnerable Device: How EDR Killing Became an Industry
SentinelOne, Monday, October 5th, 2026
SentinelOne traces how BYOVD-based EDR killers evolved from one-off tools into a serviced capability bundled into ransomware-as-a-service.
SentinelOne examines how bring-your-own-vulnerable-driver (BYOVD) techniques for disabling endpoint security scaled into an industry.
Ransomware actors disabled security tools in about 48% of intrusions in 2024, with BYOVD described as the fastest-growing kernel-level method within that figure.
Citing its Annual Threat Report, SentinelOne says EDR killers are now built, versioned and bundled into ransomware-as-a-service for affiliates, and presents a four-year timeline arguing the shift has made a top-tier threat cheaper to use.