Cyber SafetyPress ReleaseThreat Detection & Defense

Sophos Excels in MITRE Engenuity ATT&CK® Evaluations with 99% Detection Coverage

Sophos, a global leader in innovating and delivering cybersecurity as a service, announced its strong results in the MITRE Engenuity ATT&CK® EvaluationsSophos Intercept X with XDR detected 99% of the adversary behaviors in the evaluation, reporting 141 out of 143 adversary attack steps.

Sophos Intercept X with XDR excelled in the independent ATT&CK Evaluations with its comprehensive EDR and XDR capabilities that deliver actionable context on the “what,” “why” and “how” of attacker behaviors. In addition, Sophos Intercept X with XDR recorded rich analytic data on 98% of the substeps in the ATT&CK Evaluations.

“As active adversaries continue to prey upon the unprepared, good cybersecurity outcomes increasingly depend upon competent technologies in the hands of skilled operators. MITRE’s evaluation is a powerful objective measurement of a technology’s ability to produce the fundamental observations and classifications needed to effectively identify and defend against attackers,” said Joe Levy, president and chief technology officer at Sophos. “Sophos meticulously architects its solutions for security operators, empowering them with superior protection, detection and response capabilities for known and unknown threats before they become full-blown, destructive attacks, and we believe MITRE’s evaluation results demonstrate the robustness of Sophos’ real-world security capabilities.”

This round of independent ATT&CK Evaluations evaluated the abilities of 30 vendors in detecting and analyzing attack tactics, techniques and procedures (TTPs) of Turla, a known Russia-based threat group. Turla leverages novel TTPs and custom tooling to evade security defenses, and was chosen as the evaluation adversary based on its innovative stealthy maneuvers; targeted sectors, including government, critical infrastructure, education, and more; and breadth of open-source reporting on its tradecraft.

“Turla is one of the most sophisticated threat actors, and their tradecraft is platform diverse, dynamic in stealth, and layered in persistence,” said Amy Robertson, MITRE cyber threat intelligence lead, ATT&CK Evals. “This round provides an emulation that focused on kernel and service-level operations that often run with the same permissions as detection and protection products. Our goal is to empower end users and purchasers with unbiased insights into the product capabilities that detect these advanced adversary behaviors, while also collaborating with the participating vendors to evolve their products.”

Sophos Intercept X with XDR combines active adversary mitigations – including industry-first Adaptive Attack Protection that immediately activates heightened defenses when a hands-on-keyboard attack is detected, stopping the attack and providing defenders valuable additional time to respond; anti-ransomware technology; deep learning artificial intelligence; and exploit prevention to prevent and stop attacks. It is powered by Sophos X-Ops threat intelligence, a cross-operational task force of more than 500 security experts within SophosLabs, Sophos SecOps and SophosAI.

For more information on Sophos’ evaluation results, watch this video and visit https://attackevals.mitre-engenuity.org/enterprise/turla/.

CSA Editorial

Launched in Jan 2018, in partnership with Cyber Security Malaysia (an agency under MOSTI). CSA is a news and content platform focusing on key issues in cybersecurity in the region. CSA is targeted to serve the needs of cybersecurity professionals, IT professionals, Risk professionals and C-Levels who have an obligation to understand the impact of cyber threats.

Related Articles

Leave a Reply

Your email address will not be published. Required fields are marked *