Independent Ransomware Impact Evaluation by Artifact Security

In January 2026, independent testing lab Artifact Security evaluated Quell against live ransomware on fully updated Windows 11 workstations. The test was run under the AMTSO Standard, the cybersecurity industry's testing standard.

Key results

• 100% detection rate across every family and scenario tested.
• 99% ransomware impact reduction. Less than 1% of files were encrypted across the whole evaluation (0.78%).
• 7 files on average were encrypted before Quell stopped the attack. In most scenarios, fewer than 10 files were affected.

What was tested

Artifact Security tested Quell against 12 ransomware families: Akira, AvosLocker, BlackBasta, ClOp, DarkAngels, Dharma, LockBit, Lynx, Medusa, Monti, NoEscape and Zeppelin. The families were chosen for diversity, from fast, encryption-focused groups like Akira to groups known for complex evasion like AvosLocker.

Scenarios also covered ransomware targeting three sectors: healthcare, manufacturing and education. Quell performed consistently across all three, and most attacks were contained before impact reached the Medium severity level.

How impact was rated

Each scenario was scored by the number of files encrypted after initial intrusion: Insignificant (1 to 4 files), Low (5 to 15), Medium (16 to 50), High (51 to 100), Very High (more than 100) and Fully Compromised. No scenario reached High or above.

Why it matters

Quell acts at the last moment, when ransomware starts encrypting files. That makes it a final fail-safe when other defenses, including EDR, are bypassed. Because it works on the endpoint and doesn't rely on cloud lookups, it remains effective in air-gapped environments.

Download the full report for results by industry and ransomware family, the test setup and the rating method.