The Paranoid BPM holds a set of pre defined behavior patterns and common denominators of large scale of attacks, developed by Nyotron's research department, which disassemble any malicious activity into a set of common strict procedures and operations.

These patterns map can then identify and mark the hooked operation, from non-effecting (lowest priority) to potentially hazardous (highest priority), respectively. The Paranoid XP Agent uses the BPM to successfully detect and report any un-authorized or potentially hazardous activity, process, etc. located in the end point, protected, computer.

The Paranoid BPM is created using a proprietary language architecture, crafted by Nyotron R&D team, and enables the Paranoid XP Agent to perform the analyze in an accurate and fast manner, without effecting the end point workstation's performance or user experience in the protected work station.