Ransomware is the scare story that still happens on real home computers. Someone clicks a bad link, opens a fake invoice, or runs an installer that looked legitimate for ten seconds. Files get encrypted. The screen fills with a demand. Work documents, tax PDFs, kids’ photos—suddenly hostage.

A lot of home antivirus is built to block known bad files. That helps. It is not the whole problem. Modern ransomware often runs in memory, blends into normal software behavior, and starts encrypting before a simple signature match catches up. By the time a traditional scanner lights up, the damage may already be written to disk.

That is where endpoint detection and response (EDR) is different from “scan and hope.” EDR watches how programs behave on the device—unexpected encryption sweeps, mass file changes, suspicious process chains—and can stop the attack, quarantine what it can, and (on Windows) offer a path back through Volume Shadow Copy rollback when that recovery point exists.

What rollback means in plain English

On Windows, SentinelOne Control (the plan many EDR For Home customers start with) includes one-click rollback that uses Windows Volume Shadow Copy Service (VSS). In the right conditions, that can restore files to a recent clean shadow-copy state after ransomware encryption—without paying an attacker and without wiping the whole machine as your only option.

Important limits, said clearly:

• Rollback is a Windows capability in this stack. Mac and Linux protection still matter; the one-click VSS rollback story is Windows-specific.
• Rollback depends on usable shadow copies. If VSS was disabled, full, or never created for those volumes, there may be nothing to roll back to.
• Rollback is recovery after containment—not a promise that every file, every time, comes back perfect. Good backups (cloud or external) still belong in a home plan.

What EDR For Home is—and is not

EDR For Home offers SentinelOne Singularity Control and Complete for homeowners and home offices. Control covers core protect-and-remediate features: kill/quarantine, remediation, USB/Bluetooth device control, host firewall, and that Windows VSS rollback path.

Complete adds deeper tools in the customer console when console access is provisioned for your site—things like longer EDR retention, Storyline investigation, ActiveEDR hunting helpers, STAR rules, remote shell, and Purple AI. Those are tools you (or someone you authorize) use in the console. EDR For Home is not a managed SOC. We do not sit and hunt your threats 24/7, and we do not replace a corporate security operations center.

Support stays practical: scheduled help with install and uninstall, and clear documentation in our Help Center—not an always-on analyst desk.

A simple home checklist that still works

1. Put real EDR on every Windows PC that holds work or family files—not only the laptop you travel with.
2. Keep Windows Update current so shadow copies and system recovery features stay healthy.
3. Turn on (or keep) a separate backup you control: OneDrive/Google Drive versioning, Time Machine-style backups, or an external drive you disconnect when you are done.
4. Be suspicious of unexpected invoices, “shipping” PDFs, and installer pop-ups—even if the logo looks familiar.
5. If something already feels wrong—ransom note, mass file renames, sudden disk thrashing—disconnect from the network if you can and use the recovery path your agent provides; do not start paying from panic.

If you want the longer walkthrough of install, uninstall, or what console access includes, start at https://edrforhome.com/help/. Plans and device counts live on https://edrforhome.com/membership/.

Ransomware is scary because it hits the files you care about. Rollback will not erase every bad day—but on a protected Windows PC, it is one of the clearest reasons home EDR is more than yesterday’s antivirus.