
Mark Loman
Mark Loman, vice-president of software development and threat research at Sophos, is a ransomware expert and a good-guy hacker who really cares about keeping information safe. He leads a team of experienced developers whose main job is to create practical defenses that can spot and stop threats without needing to know about past attacks or specific signatures. With over 15 years of experience, Loman and his team really understand modern computer systems and applications. Their goal is simple: To make it difficult for the bad guys who want to sneak into computers, mess with how apps work, or lock up your files. They achieve this with security measures that safeguard documents and secrets, and by making swift adjustments to the computer's inner workings, which significantly increases the difficulty for anyone trying to cause trouble. Among his many other Sophos projects, he is the co-creator of CryptoGuard.
Content by Mark Loman

Products & Services
Endpoint
Sophos Endpoint
Exploits
Sophos Endpoint in action: Blocking a novel supply chain attack
May 12, 2026

Products & Services
Ransomware
Endpoint
Sophos Endpoint
EDR
AI
artificial intelligence
Ransomware: AI changes the writer. It doesn't change the math.
May 11, 2026

Products & Services
Mythos
Sophos Endpoint
Endpoint
Exploits
Zero Days
AI
AI finds the vulnerabilities, but exploiting them is a different problem.
May 1, 2026

Products & Services
Secure by Design
tamper protection
Putting the dampener on tamperers
May 8, 2025

Threat Research
Akira
anti-ransomware
CryptoGuard
Featured
Intercept X
Lockbit
Ransomware
Remote Ransomware
Sophos X-Ops
CryptoGuard: An asymmetric approach to the ransomware battle
December 20, 2023

Products & Services
AMTD
Endpoint
Gartner
Sophos Intercept X
Pioneering Automated Moving Target Defense (AMTD)
October 19, 2023

Security Operations
Threat Research
3cx
CVE-2023-29059
d3dcompiler_47.dll
DLL sideloading
Featured
ffmpeg.dll
IOC Hunting
Update 2: 3CX users under DLL-sideloading attack: What you need to know
March 29, 2023

SophosLabs Uncut
Threat Research
Featured
LockFile
ProxyShell
Ransomware
LockFile ransomware’s box of tricks: intermittent encryption and evasion
August 27, 2021

Threat Research
BlackMatter
DarkSide
Encryption
Featured
LockBit Ransomware
Ransomware
REvil
BlackMatter ransomware emerges from the shadow of DarkSide
August 9, 2021