Until now, effective incident investigation and response were only achievable in companies with a dedicated Security Operations Center (SOC) or a specialized IT security team trained to detect and analyze cyberattacks. With Sophos Intercept X Advanced with EDR, businesses of all sizes, including those with limited resources, can incorporate threat monitoring and SOC-like capabilities into their security strategy, reducing the time cybercriminals can remain hidden within the corporate network.
With a single click, IT administrators have on-demand access to up-to-date information from SophosLabs, guiding them in investigations during suspicious events and recommending next steps. To maintain complete visibility of the threat landscape, SophosLabs tracks, deconstructs, and analyzes 400,000 unique and previously unknown malware attacks every day in a constant search for novel attacks and cybercriminal innovations. By providing access to SophosLabs data, IT administrators everywhere have all the tools they need to more accurately determine what types of attacks are occurring.
“Am I experiencing a cyberattack? Where is this attack taking place? How should I act?” IT administrators regularly face all these questions, which require a quick answer. But without a SOC or trained security experts who know how to analyze potential threats, it’s very difficult to disrupt a cyberattack in real time,” explains Ricardo Maté, General Manager of Sophos Iberia.
“The sheer volume of malware, the frequency of attacks, and the widespread availability of attack kits on the dark web have made EDR solutions essential for all companies, especially those with limited cybersecurity resources. Sophos provides the equivalent of a global cybersecurity expert team and access to up-to-date information from Sophos Labs on file reputation and other data gathered through terabytes of malware analysis. IT administrators can now quickly analyze and trace attack paths without having to perform reverse engineering.”
Once cybercriminals gain a position of control, they use multiple attack methods to escalate privileges and advance in stages. With Intercept X Advanced with EDR, IT administrators can see if a cyberattacker is moving laterally and leverage the anti-ransomware and anti-exploit capabilities of Intercept X, the industry's most sophisticated endpoint protection solution. Sophos Intercept X with EDR integrates with Sophos Central, a unified cloud-based console for managing the Sophos product portfolio, enabling end users and Managed Services Partners to make EDR-informed decisions from a single pane of glass.
“EDR initially evolved as a business discipline, typically requiring a team of skilled security analysts to leverage it effectively. Companies looking to add EDR should consider how they will integrate the technology into their overall security strategy, making the classification and resolution of potential incidents easier and more effective,” says Scott Crawford, information security research director at 451 Research. “Sophos has focused on creating EDR tools that are easy to use, affordable, and integrated as part of its Intercept X endpoint product. This should give companies additional visibility into threat response. Together, these security components can provide companies with greater control over their networks and help improve defenses against today’s cyberattacks.”.
“In addition to technology, it’s equally important that customers receive training as part of their overall security strategy. Our small and medium-sized customers need tools that provide valuable information about the threats that have occurred, where and how they gained access, and how to fix the problem so that attacks don’t happen again and again,” says Nick Beardsley, chief solutions architect at TeamLogic IT, a Sophos partner and managed security provider based in Woburn, Massachusetts. "There's always a lot of preliminary work involved in determining the cause of an attack. Our customers don't have the time, budget, or expertise to detect threats, and they don't always understand why they need to. Even if they see the value, their budgets don't allow them to have an in-house threat intelligence team like Sophos Labs or a dedicated SOC. The ability to access Sophos Labs research through Intercept X Advanced with EDR allows us to show our customers why antivirus or a single security product alone isn't enough, and to explain much better how attacks happen, so they don't make the same mistakes. We're thrilled that our customers are joining the early access program and using Sophos EDR.".
“We work daily with thousands of IT and systems administrators, many of whom are finding it increasingly difficult to manage the vast number of online applications available in today’s digital world. That’s why we’re really excited to offer Sophos Intercept X with EDR to our customers. For many of the companies we work with, this is a significant addition to their security portfolio, as many lack the budget, time, or resources to detect threats. “Now we can offer our customers the ability to see what might be lurking in the shadows of their enterprise network and address issues before potential attackers have time to advance and cause further damage,” says Gavin Wood, group cybersecurity director at UK-based Chess Cybersecurity. “Sophos’s Deep Learning file analysis in EDR eliminates much of the ‘noise’ that other EDR solutions can detect, thanks to its ability to scan suspicious files and compare them against millions of known malware samples controlled by Sophos Labs.” This detection accuracy gives our clients a huge advantage in investigating real threats instead of wasting time looking for false positives.".
