Web Protection intercepts outbound browser connections and blocks traffic destined for malicious or suspicious websites. It stops threats at the delivery stage by preventing users from being diverted to malware delivery or phishing websites.

Enforces acceptable-use policies on user web activity, including Generative AI usage. Restricts access to inappropriate content or unsanctioned AI tools, with allow, warn, or block actions per website category.

Blocks vulnerable, unauthorized, or risky applications by category. Pre-defined categories, including Generative-AI tools, remove the burden of managing individual applications by hash. Restrict AI tool usage to reduce shadow AI risks.

Peripheral (Device) Control enables you to monitor and block access to removable media, Bluetooth, and mobile devices to prevent certain hardware from connecting to your network.

Data Loss Prevention (DLP) monitors and restricts the transfer of files containing sensitive data. For example, prevent employees from sending confidential files home using web-based email.

Download Reputation analyzes files as they’re downloaded and uses SophosLabs global threat intelligence to provide a verdict based on prevalence, age, and source, prompting users to block files with low or unknown reputation.

Sophos has a rich heritage in leveraging AI for protection. Multiple AI models identify known and never-seen malware before execution, including AI-generated and AI-mutated variants. Pre-execution scanning blocks payloads at the point of execution.

Over 60 Sophos proprietary exploit mitigations are enabled by default and applied to every running process. They block the techniques attackers must use to turn a vulnerability into a compromise, including AI-generated zero-days, with no per-application configuration.

Some vendors, including Carbon Black, SentinelOne, and Microsoft, lack extensive exploit mitigations or require significant manual tuning.

Behavior Analysis monitors process, file, and registry events over time to detect and stop malicious behaviors and processes. It also performs memory scanning, inspects running processes to detect malicious code only revealed during process execution, and detects attackers implanting malicious code in the memory of a running process to evade detection.

Antimalware Scan Interface (AMSI) determines whether scripts (e.g., PowerShell or Office macros) are safe, including if they are obfuscated or generated at runtime, blocking fileless attacks where malware is loaded directly from memory. Sophos also has a proprietary mitigation against malware that attempts to evade AMSI detection.

Live Protection extends Sophos’ comprehensive on-device protection with real-time lookups to SophosLabs' latest global threat intelligence for additional file context, decision verification, false positive suppression, and file reputation. Our Tier 1 threat research provides additional live intelligence from Sophos’ expansive product portfolio and global customer base.

Some vendors including Carbon Black, CrowdStrike, and SentinelOne rely solely on pre-trained machine learning models.

Malicious Traffic Detection detects a device attempting to communicate with a command and control (C2) server by intercepting traffic from non-browser processes and analyzing whether it is destined for a malicious address.

Application Lockdown prevents browser and application misuse by blocking actions not commonly associated with those processes. For example, a web browser or Office application attempting to launch PowerShell.

EDR killers using bring-your-own-vulnerable-driver techniques are a common pre-ransomware step. Tamper Protection provides kernel-level self-defense that blocks interference with the Sophos agent. Defense evasions are caught before a malicious driver can act.