Sophos adds endpoint detection and response to Intercept X Advanced

Sophos’ deep learning neural network is trained on hundreds of millions of samples to look for suspicious attributes of malicious code to detect never-before-seen threats. It provides broad, expert analysis of potential attacks by comparing the DNA of suspicious files against the malware samples already categorized in SophosLabs.

When It Comes To Security Size Does Matter

New research from Sophos has revealed that large enterprises currently disproportionately benefit from EDR.  Sixty three per cent of businesses with 500-750 employees have EDR tools as part of existing endpoint protection, compared to just 25 per cent of organisations with less than 250 employees.  SMEs may also be putting themselves at risk by underestimating the importance of EDR: while overall, four percent of UK businesses think EDR capabilities are unnecessary, when it comes to organisations of less than 250 employees, this figure rises to one in four companies.

Until now, effective investigation and incident response has only been achievable in organisations with a dedicated Security Operations Center (SOC) or specialised IT security team trained to hunt and analyse cyberattacks. With Sophos Intercept X Advanced with EDR, businesses of all sizes and those with limited resources can add threat tracking and SOC-like capabilities to their security defenses, reducing the time criminal hackers can hide in their network.

Vast Opportunities for Cyber Criminals

Currently, the early window of opportunity for cybercriminals is substantial and, once they have gained a foot hold, they use multiple attack methods to escalate privileges and advance step-by-step. Sophos’ research has shown that almost a third of businesses, (31 per cent) only patch monthly or even less frequently and a further 31per cent take days to months. This is despite the fact that a third of businesses receive more than one patch / upgrade a week.  The net result is that endpoints are left exposed and cybercriminals are able to move onto and across the network.

With Intercept X Advanced with EDR, IT managers can see if an attacker is moving laterally, and leverage the anti-ransomware and anti-exploit capabilities in Intercept X, the industry’s most sophisticated endpoint prevention solution. Sophos Intercept X with EDR is integrated with Sophos Central, a cloud-based unified console for managing Sophos’ portfolio of products, allowing end users and Managed Security Partners to make decisions based on EDR intelligence from a single pane of glass.

With a single click, IT managers can have on-demand access to curated intelligence from SophosLabs, guided investigations into suspicious events, and recommended next steps. To maintain full visibility into the threat landscape, SophosLabs tracks, deconstructs and analyses 400,000 unique and previously unseen malware attacks each day in a constant search for attack novelty and cybercriminal innovation. By providing access to SophosLabs data, IT managers of all skill levels can now benefit from first-responder forensics at their fingertips to best determine if and what types of attacks are happening.

Dan Schiappa, senior vice president and general manager of products at Sophos said. “The sheer volume of malware, frequency of attacks and wide availability of toolkits on the dark web have made EDR capabilities necessary to every business - especially those with limited IT security resources. Sophos is providing the equivalent of a team of global cybersecurity experts and access to the rich knowledgebase SophosLabs has about the reputation of files and other information collected through terabytes of malware analysis. IT managers can now quickly analyze and trace attack pathways without needing to reverse engineer files.”

 “We are working with thousands of IT managers and system administrators on a daily basis, many of whom are finding it harder to control the plethora of online apps that are readily available in today’s digital world. This is why we are truly excited to offer Sophos Intercept X with EDR to our customers. For many of the businesses we work with, this is a great addition to their security portfolio because many don’t have the budget, time or resources to threat hunt. We can now offer our customers the ability to see what might be hiding in the shadows of their network and address issues before potential active attackers have time to further advance and do more damage,” said Gavin Wood, group cybersecurity director of UK-based Chess Cybersecurity. “The deep learning file analysis in Sophos’ EDR eliminates a lot of the ‘noise’ that other EDR solutions might detect, due to the ability to scan suspicious files against millions of malware samples already known to SophosLabs. This detection precision gives our customers a massive head-start on investigating actual threats instead of wasting time chasing false positives.”