Sophos Endpoint Protection
Stop ransomware and breaches before they happen

Stop Ransomware Instantly

CryptoGuard detects and blocks unauthorised file encryption in real time whether the ransomware is running locally on the protected device or remotely from a compromised machine elsewhere on the network. Encrypted files are automatically rolled back to their pre-attack state, minimising damage and recovery time.

• Blocks local and remote encryption attacks.
• Automated file rollback to pre-attack state.
• Remote ransomware protection across your network.
• No manual intervention required for containment.

AI-Based Prevention

Sophos uses a deep learning neural network trained on hundreds of millions of samples to detect malware and potentially unwanted applications before they execute including entirely new, never-before-seen threats that evade signature-based detection.

• Deep learning AI detects threats pre-execution.
• Identifies never-before-seen malware without signatures.
• AI-powered malware prevention across all file types.
• Continuously updated threat intelligence from SophosLabs.

Adaptive Attack Protection

When an active, hands-on-keyboard attack is detected, Sophos Endpoint automatically elevates its defences blocking actions commonly used by attackers such as disabling security tools, running scripts, and lateral movement without requiring manual input from an administrator.

• Automatically escalates defences during active attacks.
• Blocks attacker tools and techniques in real time.
• Prevents lateral movement and privilege escalation.
• Reverts to standard mode automatically once the threat is resolved.

Anti-Exploit Protection

More than 60 exploit mitigations protect commonly targeted applications browsers, Office applications, PDF readers, and media players from techniques used to gain initial access and escalate privileges.

• 60+ exploit mitigations for high-value targets.
• Protection against memory injection, heap spray, and ROP attacks.
• Credential theft protection including Mimikatz prevention.
• Code cave and hollow process detection.

Unified Management via Sophos Central

Deploy, configure, monitor, and respond across all endpoints from a single cloud-based console. Sophos Central provides full visibility across your estate, automated health checks, and one-click remediation for detected misconfigurations.

• Single cloud console for all endpoints and servers.
• Account Health Check with one-click remediation.
• Automated policy deployment and enforcement.
• Real-time threat dashboard and incident reporting.

Proactive Attack Response

Sophos Endpoint provides a comprehensive set of proactive controls that operate before, during, and after an attack reducing dwell time and limiting the impact of any breach.

Critical Attack Warning

When Sophos detects indicators of a sophisticated, active attack across multiple endpoints in your organisation, it sends an immediate Critical Attack Warning notification prompting rapid investigation and response before the attack progresses.

Web Protection and Control

Block access to malicious websites, enforce web usage policies, and protect users from drive-by downloads and phishing pages. Download reputation filtering evaluates files before they are opened. All web controls are enforced on and off the corporate network.

Application Control and Lockdown

Define which applications are permitted to run in your environment. Application Control blocks unwanted or unapproved software from executing. Application Lockdown restricts execution to an approved allowlist, preventing any unauthorised binary from running effective against living-off-the-land and supply chain attacks.

AMSI and Behavioural Detection

Sophos integrates with the Windows Antimalware Scan Interface (AMSI) to scan scripts and macros before execution. Behavioural detection monitors running processes and memory for suspicious activity patterns catching fileless attacks, script-based attacks, and in-memory exploits that bypass traditional file scanning.

Live Protection

Real-time lookups against the SophosLabs cloud threat intelligence database supplement on-device detection, providing up-to-the-minute protection against the latest malware as it is discovered without waiting for a signature update cycle.

Sophos Endpoint Protection Specifications:

Legend: Fully supported   Partial / add-on required   Not available

Documentation:

Download the Sophos Endpoint Protection Solution Brief (PDF).