Sophos Intercept X with XDR detected 99% of the adversary behaviors in the evaluation, reporting 141 out of 143 adversary attack steps.
Sophos Intercept X with XDR excelled in the independent ATT&CK Evaluations with its comprehensive EDR and XDR capabilities that deliver actionable context on the “what,” “why” and “how” of attacker behaviors. In addition, Sophos Intercept X with XDR recorded rich analytic data on 98% of the substeps in the ATT&CK Evaluations.
“As active adversaries continue to prey upon the unprepared, good cybersecurity outcomes increasingly depend upon competent technologies in the hands of skilled operators. MITRE’s evaluation is a powerful objective measurement of a technology’s ability to produce the fundamental observations and classifications needed to effectively identify and defend against attackers,” said Joe Levy, president and chief technology officer at Sophos. “Sophos meticulously architects its solutions for security operators, empowering them with superior protection, detection and response capabilities for known and unknown threats before they become full-blown, destructive attacks, and we believe MITRE’s evaluation results demonstrate the robustness of Sophos’ real-world security capabilities.”
This round of independent ATT&CK Evaluations evaluated the abilities of 30 vendors in detecting and analyzing attack tactics, techniques and procedures (TTPs) of Turla, a known Russia-based threat group. Turla leverages novel TTPs and custom tooling to evade security defenses, and was chosen as the evaluation adversary based on its innovative stealthy maneuvers; targeted sectors, including government, critical infrastructure, education, and more; and breadth of open-source reporting on its tradecraft.
“Turla is one of the most sophisticated threat actors, and their tradecraft is platform diverse, dynamic in stealth, and layered in persistence,” said Amy Robertson, MITRE cyber threat intelligence lead, ATT&CK Evals. “This round provides an emulation that focused on kernel and service-level operations that often run with the same permissions as detection and protection products. Our goal is to empower end users and purchasers with unbiased insights into the product capabilities that detect these advanced adversary behaviors, while also collaborating with the participating vendors to evolve their products.”
