Sophos Ltd. has introduced a new email security solution equipped with real-time threat protection capabilities based on deep learning technology.
Named Sophos Email Advanced and available immediately, the new system adds a cloud-based option to an email security portfolio that had previously relied exclusively on locally-deployed firewalls and appliances.
Next-generation “predictive security” functionality in Email Advanced inspects incoming messages and block malicious payloads, including never-before-seen attacks, before they reach an end user’s network. That feature draws on Sophos Sandstorm, the U.K.-based vendor’s cloud sandbox technology, as well as artificial intelligence technology borrowed from Intercept X, Sophos’s next-generation endpoint security solution.
“We’ve pulled the backend guts out of Intercept X and put it in the cloud to scan stuff as it comes through our gateway,” says Bill Lucchini, senior vice president and general manager of the Messaging Security Group at Sophos.
Sophos introduced Intercept X in September 2016 and updated it most recently in January, adding a deep learning engine armed with neural networking technology. While machine learning systems can study tens of millions of virus samples, according to Sophos, Intercept X’s deep learning component can process hundreds of millions.
Other active threat protection capabilities in Email Advanced include “time-of-click” technology that rechecks embedded URLs the system previously cleared for use. The new feature is designed to defeat a sophisticated technique hackers have lately begun employing to hide dangerous links.
“They’ll send emails with links that go to benign locations and then a couple of hours after they send those emails they’ll go ahead and change the destination content so that it becomes malicious,” Lucchini says. Confirming that previously safe addresses are still safe every time a user clicks a URL protects organizations from such tactics.
Email Advanced also comes with anti-phishing technology that uses three industry standard safeguards—sender policy framework, domain keys identified mail, and domain message authentication reporting & conformance (DMARC)—in combination to help verify that incoming messages are really from who they claim to be from.
Lucchini points to DMARC in particular as a highly-effective anti-“spoofing” tool that has yet to be broadly adopted due to the difficulty organizations without specialized skills can have deploying it.
“We set it up so it’s super easy for our partners to configure and get their customers protected,” he says, noting that both the U.S. and U.K. governments have begun mandating use of DMARC.
“We expect that we’re going to see, finally, some serious adoption of DMARC,” Lucchini states.
Barracuda Networks Inc. introduced a DMARC-equipped anti-phishing solution of its own named Sentinel a year ago.
In addition to its various inbound defenses, Email Advanced scans outbound messages as well to prevent unintended distribution of spam and viruses. It also allows users to customize security policies by user, group, or domain and integrates with the vendor’s cloud-based Sophos Central management solution.
Licenses for Email Advanced run from $25 to $44 per user for a one-year subscription, with discounts available for larger orders and longer terms.
According to Lucchini, Email Advanced is the latest addition to Sophos’s Synchronized Security technology, which allows solutions in multiple categories to share information and collaborate against threats. Though not presently equipped to coordinate defensive measures with other Sophos products, the system will gain that capability in future editions.
“We have a feature coming up where when we detect outbound spam, we will pass that information on to our other products,” Lucchini says. “That then enables us to do things like trigger an endpoint scan of the user’s laptop.”
Synchronized Security is a core element in Sophos’s strategy for differentiating itself from competitors and driving revenue for itself and its partners. Cross-selling synchronized products is one of the top VAR revenue opportunities highlighted by Sophos executives at the company’s North American partner conference in Las Vegas last month.
Prior to today’s launch, Sophos provided email security via its on-premises firewall systems, which are popular especially among small businesses looking for a simple, all in one solution, and the more robust but also on-premises Sophos Email Appliance. Though both products remain part of the Sophos catalog, the company views Email Advanced as its primary option for email security going forward.
“We think most people are going to a cloud-based email security solution, which is what this is,” Lucchini says.
Email remains a primary point of entry for security threats. According to Sophos researchers, drawing on information collected from the more than 10 million inboxes the company currently protects daily, roughly 80 percent of spam messages contain a malicious payload.
Further data drawn from Sophos’s Phish Threat security awareness training platform suggests that some 30 percent of security “neophytes” and seven percent of experienced users fall for phishing attacks on average, suggesting that companies are highly vulnerable to infected messages.
