Intercept X Endpoint and Server

Endpoint

Sophos has earned its place as a “Leader” in the Gartner Magic Quadrant for Endpoint Protection Platforms for the eleventh time in a row.

Forrester Research Inc also rates Sophos as a leader in the Forrester Wave for Endpoint Protection Suites after interviewing customers.

MRG Effitas compared different endpoint protection products to detect malware and potentially unwanted applications (PUAs). Sophos was ranked best for detecting both threats, and also had a low false positive rate.

MRG Effitas also compared different endpoint solutions ability to stop exploits. Sophos Intercept X lead by a landslide, blocking over two times the amount the other tools tested.

SE Labs endpoint protection test rated Intercept X as having 100% Total Accuracy Rating for both enterprise and SMB protection. It also was given a AAA rating by SE Labs in every test they conducted, beginning April 2018.

Marketing you’re getting the best protection can be done by any company, but actually proving it best by third party testers is where Sophos truly is unique. Read more by downloading the Reviewers Guide.

Intercept X can prevent attackers from gaining access and remaining undetected on a network by code cave utilization, credential theft prevention, and apc protection. Download the datasheet below.

Intercept X Endpoint Features

• EDR – Taking threat hunting and IT security operations to the next level with powerful querying and remote response capabilities.
• Anti-ransomware – File protection, automatic file recovery, and behavioral analysis to stop ransomware and boot record attacks. Intercept X utilizes many techniques, such as credential theft prevention, code cave utilization detection, and APC protection that attackers use to gain access and remain undetected on victim networks. Attacks have increasingly been using more than just malware to move around systems and networks as a legitimate user. Intercept X prevents this behavior and detects in order to stop hackers.
• Deep learning technology – AI built in to detect both known and unknown malware without using signatures. 24/7 threat hunting by an expert team as a fully-managed service. Fusing expert analysis with machine learning technology improves threat hunting and detection, allows for deeper investigation of alerts, and take targeted actions to quickly and precisely eliminate threats. Unlike other services, Sophos’s MTR team does more than just notifying you of attacks or suspicious behaviors, and takes targeted actions on your behalf to neutralized sophisticated threats.
• Exploit Prevention – Deny attackers by blocking exploits and techniques used to distribute malware, steal credentials and escape detection. There’s millions of pieces of malware in existence, thousands of software vulnerabilities to be exploited, and only a handful of exploit techniques attackers rely on as part of their attack chain. Intercept X prevents zero day attacks by taking away the key tools hackers use.
• MTR – Managed Threat Response consists of an elite team of hunters and response experts who take targeted actions on your behalf to neutralized sophisticated threats. By integrating deep learning, Intercept X is evolving from reactive to a predictive approach. Many products claim to use machine learning, but not all is created equal. Sophos’s deep learning has consistently outperformed other machine learning models for malware detection.
• Active adversary mitigation – Preventing persistent attacks on machines, credential theft, and malicious traffic. Today’s ransomware attacks combine multiple techniques with real-time hacking. Intercept X minimizes risk by monitoring and securing the whole attack chain. This advanced protection disrupts the whole attack chain by deep learning that prevents attacks, and CryptoGuard to toll back the unauthorized encryption of files in seconds.

Server

In addition to the above features, Intercept X for Server includes specific server functionality, such as:

• Application lockdown (whitelisting)
• File Integrity Monitoring (FIM)
• Cloud Security Posture Management (CSPM)
• Endpoint Detection Response (EDR)
• Mitigated Threat Response (MTR)

Server lockdown prevents unauthorized programs running on servers and sends notifications if critical files are tampered with.

Simple deployment for mixed environments allows for rapid deployment for cloud, on-prem, virtual servers, and a mixed server and multi-cloud settings.

Centralized Management allows you to see all servers from one console regardless of their location.

Secure the cloud by detecting suspicious access, insecure hosts, containers, and serverless deployments while monitoring configurations.

Download the Intercept X for Server datasheet.

Intercept X vs Competition

An Award-Winning Solution

Broadcom Symantec

Products:  Endpoint Security, SEP Cloud

Key weaknesses:

1. Disjointed management – still in the process of moving towards a fully featured cloud management console
2. Limited exploit prevention capabilities and no specific anti-ransomware technology
3. Ownership woes – Broadcom has a history of buying tech companies, drastically cutting costs, and selling to only the largest customers

Watch out for

1. Symantec has a broad feature set and is a leader in the 2019 Gartner Endpoint MQ

Find out more by clicking on the link

Crowdstrike

Products: Falcon Prevent, Falcon Insight

Key weaknesses 

1. Threat exposure – lacks tools to prevent exposure to threats (no web protection or application control)
2. Anti-exploit, anti-ransomware, and machine learning capabilities are less comprehensive than Intercept X
3. Expensive – per Gartner, CrowdStrike licenses are expensive and products are rarely sold without accompanying services

Watch out for 

1. CrowdStrike comes from a threat response background and offers granular EDR capabilities

Find out more by clicking on the link

Trend Micro

Products: Apex One, Worry-Free

Key weaknesses 

1. Multiple products are required to benefit from all features
2. Separate components, consoles – plug-in-based architecture requires additional downloads, product activations, installs and disparate management console
3.  Server protection (Deep Security) is an expensive uplift

Watch out for 

1. Endpoint license suites include multiple products and are often aggressively priced

Microsoft

Products: Defender Antivirus, Defender ATP

Key weaknesses 

1. Management and reporting split across several consoles
2. Windows 10 focused – reduced protection on other Windows platforms, Mac, and Linux machines
3. Complex configuration – Some features are centrally managed, others like Exploit Guard require manual deployment

Watch out for

1. Customers may be entitled to use endpoint protection features through their existing corporate Microsoft license

Find out more by clicking on the link

Licensing

Ask yourself:

• Does your current endpoint protection help you with IT security operations and hunt down stealthy threats?
• Can you identify devices with performance issues? What about servers that still have RDP enabled?
• Can you identify processes that are disguised as something else? What about seeing which devices clicked on a link in a phishing email?
• Is your current solution easy to use? Can you manage it from the same console as your protection?
• When an issue is detected, for example you want to remove a program, what is your process to fix it?
• What is the makeup of your team? Who is dedicated to security?
• How many end users do you oversee? What is the ratio of end users to IT staff?