世界一流技术与实战专业知识，无间协同，始终为您护航。这就是双赢。
强韧防护与自适应 AI 原生平台，阻止攻击于未然
精锐 MDR 威胁猎手快速精准揪出并打击威胁
无以伦比的防御守护整个攻击面，覆盖端点、防火墙、电子邮件和云端
.png?width=640&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Company - Banner with Background Media - BG Image")
Sophos defeats cyberattacks with an adaptive
AI-native open platform and unmatched security expertise.
Sophos Central 为客户提供卓越的安全防护，并为防御团队加强防御力量。动态防御、实战验证的 AI，以及开放式并备有丰富集成的生态系统融合在业内领先的 AI 原生平台。
.webp?width=490&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Sophos X-Ops")
汇聚跨攻击环境的深度专业知识，以抵御甚至最先进的攻击敌手。
我们与Sophos的合作之所以如此强大，是因为他们确实有团队全天候监控。没有那种速度，攻击就会成功，造成的损失可能以数十万计，甚至数百万美元。”
Already a customer?
Find additional information to inspire, grow your knowledge, troubleshoot, and get help.
The benefits of GenAI for cybersecurity are matched by their potential danger. Sophos deploys rigorous processes for all GenAI tools, from concept to full deployment. Detailed performance analysis and user feedback at each stage informs the next step in the development process.
* Transceivers sold separately
** 5G module (Gen.2) not sold in Japan
Sophos Central offers centralized security management, real-time threat protection, automated responses, multi-factor authentication, secure data encryption, and custom dashboards. It integrates seamlessly with all Sophos products, providing a comprehensive and scalable solution for managing your cybersecurity needs.
Sophos Central offers centralized security management, real-time threat protection, automated responses, multi-factor authentication, secure data encryption, and custom dashboards. It integrates seamlessly with all Sophos products, providing a comprehensive and scalable solution for managing your cybersecurity needs.
Sophos Central offers centralized security management, real-time threat protection, automated responses, multi-factor authentication, secure data encryption, and custom dashboards. It integrates seamlessly with all Sophos products, providing a comprehensive and scalable solution for managing your cybersecurity needs.
Sophos Central offers centralized security management, real-time threat protection, automated responses, multi-factor authentication, secure data encryption, and custom dashboards. It integrates seamlessly with all Sophos products, providing a comprehensive and scalable solution for managing your cybersecurity needs.
centralized security
management, real-time threat protection
automated responses, multi-factor aut
comprehensive and scalable solution for man
Sophos Central offers centralized security management, real-time threat protection, automated responses, multi-factor authentication, secure data encryption, and custom dashboards. It integrates seamlessly with all Sophos products, providing a comprehensive and scalable solution for managing your cybersecurity needs. Sophos Central offers centralized security section, automated responses, multi-factor authentication, secure data encryption, and custom dashboards. It integrates seamlessly with all Sophos products, providing a comprehensive and scalable solution for managing your cybersecurity needs.
Sophos Central offers centralized security management, real-time threat protection, automated responses, multi-factor authentication, secure data encryption, and custom dashboards. It integrates seamlessly with all Sophos products, providing a comprehensive and scalable solution for managing your cybersecurity needs.
Sophos Central offers centralized security management, real-time threat protection, automated responses, multi-factor authentication, secure data encryption, and custom dashboards. It integrates seamlessly with all Sophos products, providing a comprehensive and scalable solution for managing your cybersecurity needs.
Sophos and Tech Research Asia (TRA) present the latest Cybersecurity Playbook for Partners in Asia Pacific and Japan.
Based on research with 900 companies, the playbook explores trends in cybersecurity investment, challenges, and areas of growth for MSPs, building on insights from our previous report.
With 83% of companies increasing cybersecurity budgets and more than 50% expanding MSP use, the opportunity for growth is immense. Use this playbook to enhance client engagement, offer strategic support, and strengthen their cybersecurity resilience.
Download the full report to discover how you can drive growth in the APJ region.
EYEBROW
Sophos and Tech Research Asia (TRA) present the latest Cybersecurity Playbook for Partners in Asia Pacific and Japan.
Based on research with 900 companies, the playbook explores trends in cybersecurity investment, challenges, and areas of growth for MSPs, building on insights from our previous report.
Based on research with 900 companies, the playbook explores trends in cybersecurity investment, challenges, and areas of growth for MSPs, building on insights from our previous report.
Reduce reliance on expensive MPLS links by switching to SD-WAN. Maintain or increase application performance and availability.
The results provided by this tool are an estimate based on the information you provide. Your actual savings may vary.
See Your Savings
Current Monthly Cost
Projected Monthly Costs
Monthly Cost Reduction
Three-year Savings
Sophos can help you decrease costs by offloading some or all of your MPLS connections to less expensive local internet services like 3G/4G, DSL, and cable. We'll work with you to build a secure, highly available, and higher performance WAN at a significant savings.
Join our team today. Check out our current openings.
Aliqua. ipsum et incididunt consectetur . amet Lorem aliqua. Lorem dolore incididunt adipiscing amet . tempor dolore tempor adipiscing tempor amet ut . amet consectetur magna elit amet do tempor consectetur . elit consectetur labore elit ut .
Online criminal forums, both on the public internet and on the “dark web” of Tor .onion sites, are a rich resource for threat intelligence researchers. The Sophos Counter Threat Unit (CTU) have a team of darkweb researchers collecting intelligence and interacting with darkweb forums, but combing through these posts is a time-consuming and resource-intensive task, and it’s always possible that things are missed.
As we strive to make better use of AI and data analysis, Sophos AI researcher Francois Labreche, working with Estelle Ruellan of Flare and the Université de Montréal and Masarah Paquet-Clouston of the Université de Montréal, set out to see if they could approach the problem of identifying key actors on the dark web in a more automated way. Their work, originally presented at the 2024 APWG Symposium on Electronic Crime Research, has recently been published as a paper.
The research team combined a modification of a framework developed by criminologists Martin Bouchard and Holly Nguyen to separate professional criminals from amateurs in an analysis of the criminal cannabis industry with social-network analysis. With this, they were able to connect accounts posting in forums to exploits of recent Common Vulnerabilities and Exposures (CVEs), either based upon the naming of the CVE or by matching the post to the CVEs’ corresponding Common Attack Pattern Enumerations and Classifications (CAPECs) defined by MITRE.
Using the Flare threat research search engine, they gathered 11,558 posts by 4,441 individuals from between January 2015 and July 2023 on 124 different e-crime forums. The posts mentioned 6,232 different CVEs. The researchers used the data to create a bimodal social network that connected CAPECs to individual actors based on the contents of the actors’ posts. In this initial stage, they focused the dataset down to eliminate, for instance, CVEs that have no assigned CAPECs, and overly general attack methods that many threat actors use (and the posters who only discussed those general-purpose CVEs). Filtering such as this ultimately whittled the dataset down to 2,321 actors and 263 CAPECs.
The research team then used the Leiden community detection algorithm to cluster the actors into communities (“Communities of Interest”) with a shared interest in particular attack patterns. At this stage, eight communities stood out as relatively distinct. On average, individual actors were connected to 13 different CAPECs, while CAPECs were linked with 118 actors.
Next, key actors were identified based on the expertise they exhibited in each community. Three factors were used to measure level of expertise:
As shown above, the sample for the identification of key actors consisted of 359 actors. The average actor had 36.68% of posts committed to their Community of Interest and had a skill level of 2.19 (‘Medium’). The average activity rate was 0.72.
Finally, to identify the truly key actors — those with high enough skill level and commitment and activity rate to identify them as experts in their domains — the researchers used the K-means clustering algorithm. Using the three measurements created for each actor’s relationship with CAPECs, the 359 actors were clustered into eight clusters with similar levels of all three measurements.
| Skill Level Value | CAPECs | % of Skill Level Values among all values in actors’ list |
|---|---|---|
| Low | 118 (44.87%) | 57.71% |
| Medium | 66 (25.09%) | 24.14% |
| High | 79 (30.04%) | 18.14% |
One cluster of 14 actors was graded as “Professionals” — key individuals; the best in their field; with high skill and commitment and low activity rate, again because of the length of their involvement with the forums (an average of 159 days) and a post rate that averaged about one post every 3-4 days. They focused on very specific communities of interest and did not post much beyond them, with a commitment level of 90.37%. There are inherent limitations to the analysis approach in this research— primarily because of the reliance on MITRE’s CAPEC and CVE mapping and the skill levels assigned by MITRE.
The research process includes defining problems and seeing how various structured approaches might lead to greater insight. Derivatives of the approach described in this research could be used by threat intelligence teams to develop a less biased approach to identifying e-crime masterminds, and Sophos CTU will now start looking at the outputs of this data to see if it can shape or improve our existing human-led research in this area.
.svg?width=93&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Home"){kind=logo}
.svg?width=7&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Top Navigation - Sign in - Icon")
.png?width=550&quality=80&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Home - Slider with Logo Tabs - Media 2")
.png?width=550&quality=80&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Home Page - Slider with Logo Tabs Slide Video")
.png?width=550&quality=80&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Home - Slider with Logo Tabs - Media 4")
