Sophos Excels in MITRE Engenuity ATT&CK® Evaluations with 99% Detection Coverage

Sophos, a global leader in innovating and delivering cybersecurity as a service, today announced its strong results in the MITRE Engenuity ATT&CK® Evaluations. Sophos Intercept X with XDR detected 99% of the adversary behaviors in the evaluation, reporting 141 out of 143 adversary attack steps.

Sophos Intercept X with XDR excelled in the independent ATT&CK Evaluations with its comprehensive EDR and XDR capabilities that deliver actionable context on the “what,” “why” and “how” of attacker behaviors. In addition, Sophos Intercept X with XDR recorded rich analytic data on 98% of the substeps in the ATT&CK Evaluations.

“As active adversaries continue to prey upon the unprepared, good cybersecurity outcomes increasingly depend upon competent technologies in the hands of skilled operators. MITRE’s evaluation is a powerful objective measurement of a technology’s ability to produce the fundamental observations and classifications needed to effectively identify and defend against attackers,” said Joe Levy, president and chief technology officer at Sophos. “Sophos meticulously architects its solutions for security operators, empowering them with superior protection, detection and response capabilities for known and unknown threats before they become full-blown, destructive attacks, and we believe MITRE’s evaluation results demonstrate the robustness of Sophos’ real-world security capabilities.”

This round of independent ATT&CK Evaluations evaluated the abilities of 30 vendors in detecting and analyzing attack tactics, techniques and procedures (TTPs) of Turla, a known Russia-based threat group. Turla leverages novel TTPs and custom tooling to evade security defenses, and was chosen as the evaluation adversary based on its innovative stealthy maneuvers; targeted sectors, including government, critical infrastructure, education, and more; and breadth of open-source reporting on its tradecraft.

“Turla is one of the most sophisticated threat actors, and their tradecraft is platform diverse, dynamic in stealth, and layered in persistence,” said Amy Robertson, MITRE cyber threat intelligence lead, ATT&CK Evals. “This round provides an emulation that focused on kernel and service-level operations that often run with the same permissions as detection and protection products. Our goal is to empower end users and purchasers with unbiased insights into the product capabilities that detect these advanced adversary behaviors, while also collaborating with the participating vendors to evolve their products.”

Sophos Intercept X with XDR combines active adversary mitigations – including industry-first Adaptive Attack Protection that immediately activates heightened defenses when a hands-on-keyboard attack is detected, stopping the attack and providing defenders valuable additional time to respond; anti-ransomware technology; deep learning artificial intelligence; and exploit prevention to prevent and stop attacks. It is powered by Sophos X-Ops threat intelligence, a cross-operational task force of more than 500 security experts within SophosLabs, Sophos SecOps and SophosAI.

For more information on Sophos’ evaluation results, watch this video and visit https://attackevals.mitre-engenuity.org/enterprise/turla/.

###

About MITRE Engenuity

MITRE Engenuity, a subsidiary of MITRE, is a tech foundation for the public good. MITRE’s mission-driven teams are dedicated to solving problems for a safer world. Through our public-private partnerships and federally funded R&D centers, we work across government and in partnership with industry to tackle challenges to the safety, stability, and well-being of our nation.

MITRE Engenuity brings MITRE’s deep technical know-how and systems thinking to the private sector to solve complex challenges that government alone cannot solve. MITRE Engenuity catalyzes the collective R&D strength of the broader U.S. federal government, academia, and private sector to tackle national and global challenges, such as protecting critical infrastructure, creating a resilient semiconductor ecosystem, building a genomics center for public good, accelerating use case innovation in 5G, and democratizing threat-informed cyber defense. www.mitre-engenuity.org

About Sophos

Sophos is a worldwide leader and innovator of advanced cybersecurity solutions, including Managed Detection and Response (MDR) and incident response services and a broad portfolio of endpoint, network, email, and cloud security technologies that help organizations defeat cyberattacks. As one of the largest pure-play cybersecurity providers, Sophos defends more than 500,000 organizations and more than 100 million users globally from active adversaries, ransomware, phishing, malware, and more. Sophos’ services and products connect through its cloud-based Sophos Central management console and are powered by Sophos X-Ops, the company’s cross-domain threat intelligence unit. Sophos X-Ops intelligence optimizes the entire Sophos Adaptive Cybersecurity Ecosystem, which includes a centralized data lake that leverages a rich set of open APIs available to customers, partners, developers, and other cybersecurity and information technology vendors. Sophos provides cybersecurity-as-a-service to organizations needing fully-managed, turnkey security solutions. Customers can also manage their cybersecurity directly with Sophos’ security operations platform or use a hybrid approach by supplementing their in-house teams with Sophos’ services, including threat hunting and remediation. Sophos sells through reseller partners and managed service providers (MSPs) worldwide. Sophos is headquartered in Oxford, U.K. More information is available at www.sophos.com.