# Automated Moving Target Defense

_Last updated: 2026-02-11_

Automated Moving Target Defense (AMTD) is a proactive cybersecurity strategy that protects systems by making them unpredictable and difficult to attack through continuous randomization of runtime memory, stopping ransomware, zero-day, fileless, and in-memory attacks at runtime with no additional staff or performance impact.

## Definition and Core Mechanism

Automated Moving Target Defense (AMTD), also called Moving Target Defense (MTD), is a preemptive cybersecurity strategy that employs system polymorphism to make operating systems and applications unpredictable. AMTD works by changing and moving system resources—particularly runtime memory—to create a constantly shifting attack surface. By continuously altering the attack surface, AMTD complicates efforts by attackers to locate and exploit vulnerabilities.

The U.S. Department of Homeland Security defines Moving Target Defense as "controlled change across multiple network and system dimensions to increase uncertainty and complexity for attackers by reducing their window of opportunity and increasing the costs of their probing and attack efforts."

AMTD uses system polymorphism in memory to hide operating system and application targets from adversaries in an unpredictable manner, leading to a dramatically reduced attack surface and lower security operating costs.

## How AMTD Works

AMTD operates in three sequential phases: morph and conceal, protect and deceive, and prevent and expose attacks.

**Morph and Conceal:** As an application loads into memory space, AMTD morphs the process structures using keyless, one-way randomization, making the memory constantly unpredictable to attackers. The application's original memory layout is transformed into a morphed version each time the application loads.

**Protect and Deceive:** Legitimate application code memory is dynamically updated to use the morphed resources, allowing applications to load and run as usual. A skeleton of the original structure is left as a trap.

**Prevent and Expose Attacks:** Attacks target the original structure and fail because they cannot find the resources they expect and need. Attacks are immediately prevented, trapped, and logged with full forensic details.

## AMTD vs. Related Technologies

**AMTD vs. MTD:** Moving Target Defense (MTD) is a general strategy that involves changing and moving system resources to create an unpredictable attack surface. Automated Moving Target Defense (AMTD) enhances this by automating these changes, making the system continuously dynamic without manual intervention and increasing the complexity for attackers.

**AMTD vs. ASLR:** Windows Address Space Layout Randomization (ASLR) works at system boot-time, after which the system remains static. ASLR's mechanisms are known by attackers and can be bypassed using memory read iterations and other exploits. ASLR does not include traps, so while protecting memory, malicious processes continue to run with no attack visibility.

AMTD works at process load time, creating a continually changing attack surface. AMTD also creates decoy traps, which provide visibility into malicious processes and trigger their termination.

## Types of Moving Target Defense

Moving Target Defense encompasses multiple approaches:

| Type | Description |
|------|-------------|
| Environment and Artifact Deception | Uses deceptive tactics such as bait data and simulated environments to mislead and trap attackers, making cyber attacks self-defeating by exposing the attackers |
| Dynamic Network Defense | Utilizes technologies that alter network configurations and traffic routes dynamically, increasing unpredictability to prevent interception or manipulation by attackers |
| Memory Attack Prevention | Protects servers and workstations by continuously changing memory handling techniques to block exploits |
| Storage Defense | Applies changing strategies in data storage and retrieval within storage networks to thwart data corruption or unauthorized access |
| Deception Across Contexts | Deploys a variety of misleading signals and information across multiple IT layers, confusing attackers and diluting their efforts |

## Why AMTD Is Needed

Traditional cybersecurity tools—antivirus (AV), next-generation antivirus (NGAV), endpoint protection platforms (EPP), endpoint detection and response (EDR), and extended detection and response (XDR)—evolved to spot telltale signs of malware deployment, such as attack patterns and signatures, by analyzing executables on disk or the operating system.

However, sophisticated threat actors increasingly hijack legitimate system processes for malicious ends or target device memory at runtime rather than disk or OS. Hijacked legitimate system processes and in-memory threats offer little, if anything, in the way of signatures to detect or behavior patterns to analyze.

Legitimate system processes must work in memory at runtime, but this environment is mostly invisible to current cybersecurity tools. A typical application's runtime environment might contain 4GB of virtual memory. Even when configured to the most aggressive alert settings, it is impossible to scan this volume of data frequently enough without severely degrading application performance. Current threats also use polymorphism to obfuscate their presence, making detection in a small sample of device memory extremely difficult.

Aggressive alert settings also result in a vast number of false positive alerts requiring extra resources to analyze. If a high number of alerts and false positives are not an issue for an organization, their alert setting is probably too low, meaning they are almost certainly missing the most disruptive advanced attacks.

AMTD addresses these limitations by morphing the runtime memory environment to create a continually changing, unpredictable attack surface. Even if a threat actor can find their target once, they are unable to reuse that attack on another device or later on the same device. AMTD uses an ultra-lightweight agent to block unauthorized processes deterministically rather than probabilistically, generating few false positive alerts and not noticeably affecting system performance.

## Benefits of AMTD

AMTD is a proactive, prevention-first system that interrupts the progression of cyberattacks and stops threat actors' ability to gain persistence in target organizations. Key benefits include:

- **Proactive rather than reactive defense** that prevents breaches before attackers can spread and perpetrate ransomware, without waiting for attackers to breach before working
- **Virtual patching** that protects vulnerabilities until a patch is issued
- **Polymorphic defense** that hides exploits from polymorphic attacks
- **Reduced costs** by slashing false positive security alerts, IT support tickets, and analyst alert triage time
- **Stops attackers' ability to gain persistence** in target organizations
- **No additional staff needed** and no performance impact on endpoints or servers
- **Defense-in-depth integration** that seamlessly integrates into existing tech stacks to augment NGAV, EPP, EDR, and XDR with no additional staff
- **Threat prevention** that stops in-memory, fileless, zero-day, supply chain attacks, and other advanced threats

The mainstream paradigm of cybersecurity has long focused on detection and response, an inherently reactive approach that cedes the innovation advantage to threat actors. AMTD changes this calculus by providing a proactive, prevention-first system.

## Threats Prevented by AMTD

AMTD prevents the following threat categories:

- Ransomware attacks
- Supply chain attacks
- Zero-day attacks
- Fileless attacks
- In-memory attacks
- Undetectable attacks
- Malware variants

## Integration with Existing Security Solutions

AMTD is ideal for augmenting next-generation antivirus (NGAV), endpoint protection platforms (EPP), endpoint detection and response (EDR), and extended detection and response (XDR) solutions. These mainstream solutions stop known attacks with recognized signatures and behavioral patterns but often do not detect or prevent the more disruptive advanced attacks organizations experience today—undetectable attacks such as zero-days, malware variants, or supply chain attacks that lead to ransomware.