Cybersecurity vendor Sophos has introduced a managed detection and response (MDR) service for organizations running Microsoft Defender, adding a human layer of protection against cyberthreats such as ransomware.
The solution, Sophos MDR for Microsoft Defender, provides “a critical layer of 24/7 protection” across the Microsoft Security suite of endpoint, SIEM, identity, and cloud solutions, the vendor says. It adds to Microsoft’s security baseline with human-led threat intelligence, incident response, and other critical tasks.
“Sophos MDR delivers additional threat context, proprietary Sophos detections that go above and beyond what Microsoft tools can generate, and threat intelligence from the Sophos X-Ops task force,” says Sophos’ Eric Kokonas (pictured), senior director, market intelligence. “Additionally, human-led threat hunts identify and stop more threats than Microsoft Security tools can on their own.”
The service is customizable and available through Sophos’ global channel of resellers and MSPs.
“For channel partners delivering Microsoft Security offerings, there’s tremendous opportunity to ensure customers are fully protected and maximizing value from their existing deployments,” said Raja Patel, Sophos senior vice president of products and managed services, in a prepared statement.
Sophos MDR leverages the vendor’s six global security operations centers (SOCs) and more than 500 experts. Analysts work around the clock to monitor, investigate, and respond to Microsoft Security alerts, says Kokonas.
Whenever a threat is confirmed, the service triggers an immediate response, Kokonas explains. The average threat response time is 38 minutes, which he says is 96% faster than the industry benchmark.
Cloud Risks
The service covers both on-premise and cloud environments. Each environment faces different risks, with cloud risks typically revolving around identities and environment misconfiguration, Kokonas says.
So far, threats to on-premise networks outnumber those affecting cloud-based environments. However, threat actors never relent from their efforts to find vulnerabilities wherever they can, so risks to cloud environments may increase in the future.
“While ransomware isn’t as common of a threat in the cloud, data is still at risk of being misused and stolen. As every company makes some sort of shift into cloud-based environments, we will see the actors change course to begin further targeting these environments,” Kokonas says.
Integration with Other Vendors
Sophos MDR integrates telemetry from various Microsoft Security tools, including Microsoft Defender for Endpoint, Microsoft Defender for Cloud, Microsoft Sentinel, and Office 365 Management Activity. It also works with security tools and telemetry sources from dozens of other vendors, including Palo Alto Networks, Fortinet, Check Point, AWS, Google, and Darktrace.
“Sophos MDR for Microsoft Defender is a continuation of our strategy to meet partners and customers where they are and help them get the best defense possible from the security technology investments that they’ve already made, while providing pathways to advancing their cybersecurity and business objectives through top-performing products and world-class services,” Kokonas says.
The service, he notes, reduces risk and costs associated with incidents and breaches, and frees up IT and security staff to focus on business enablement. Sophos provides the people, process, and technology to handle threats so internal teams can focus on driving business growth, he says.
PEDRO PEREIRA is a New Hampshire-based freelance writer who has covered the IT channel for two decades.
