Web Protection

Web Protection intercepts outbound browser connections and blocks traffic destined for malicious or suspicious websites. It stops threats at the delivery stage by preventing users from being redirected to malware delivery or phishing websites.

Web Control

Web Control uses the same traffic interception technology, enabling you to block access to undesirable or inappropriate content, such as adult and gambling websites.

Application Control

Application Control enables you to block applications that may be vulnerable, unsuitable for your environment, or that could be used for nefarious purposes. Sophos provides pre-defined categories to block or monitor apps, removing the burden of blocking individual applications by hash.

Peripheral (Device) Control

Peripheral (Device) Control enables you to monitor and block access to removable media, Bluetooth, and mobile devices to prevent certain hardware from connecting to your network.

Data Loss Prevention (DLP)

Data Loss Prevention (DLP) monitors and restricts the transfer of files containing sensitive data. For example, prevent employees from sending confidential files home using web-based email.

Download Reputation

Download Reputation analyses files as they’re downloaded and uses SophosLabs global threat intelligence to provide a verdict based on prevalence, age, and source, prompting users to block files with low or unknown reputation.

Deep learning (AI-powered) malware prevention

Deep learning (AI-powered) malware prevention analyses binaries to make decisions based on file attributes and predictive reasoning. Deep learning is an advanced form of machine learning that detects and blocks malware, including new and previously unseen threats.

Anti-Exploitation

Anti-Exploitation guards process integrity by hardening application memory and applying runtime code execution guardrails. Over 60 anti-exploitation techniques in Sophos Endpoint are enabled by default, require no training nor tuning, and extend far beyond the protections provided by the native Windows OS or most other endpoint security solutions.

Some vendors including Carbon Black, SentinelOne and Microsoft lack extensive exploit mitigations or require significant manual tuning.

Behaviour Analysis

Behaviour Analysis monitors process, file, and registry events over time to detect and stop malicious behaviours and processes. It also performs memory scanning, inspects running processes to detect malicious code only revealed during process execution, and detects attackers implanting malicious code in the memory of a running process to evade detection.

Antimalware Scan Interface (AMSI)

Antimalware Scan Interface (AMSI) determines whether scripts (e.g., PowerShell or Office macros) are safe, including if they are obfuscated or generated at runtime, blocking fileless attacks where malware is loaded directly from memory. Sophos also has a proprietary mitigation against malware that attempts to evade AMSI detection.

Live Protection

Live Protection extends Sophos’ comprehensive on-device protection with real-time lookups to SophosLabs' latest global threat intelligence for additional file context, decision verification, false positive suppression, and file reputation. Our Tier 1 threat research provides additional live intelligence from Sophos’ expansive product portfolio and global customer base.

Some vendors including Carbon Black, CrowdStrike, and SentinelOne rely solely on pre-trained machine learning models.

Malicious Traffic Detection

Malicious Traffic Detection detects a device attempting to communicate with a command and control (C2) server by intercepting traffic from non-browser processes and analysing whether it is destined for a malicious address.

Application Lockdown

Application Lockdown prevents browser and application misuse by blocking actions not commonly associated with those processes. For example, a web browser or Office application attempting to launch PowerShell.