|
By Dan Levesque
This article is part of an ongoing series from Sophos frontline security operations specialists, sharing the expertise they use to strengthen our industry-leading Managed Detection and Response (MDR) service and defend customers against evolving AI-era threats. A 20% growth forecast for cybersecurity talent sounds significant. I believe it understates what we are going to see in Incident Response. The U.S.
The China-based threat group uses DLL sideloading in these attacks Counter Threat Unit (CTU) and SophosLabs researchers investigated a cluster of incidents attributed to the BRONZE SANDCASTLE threat group. The most distinctive technical marker for BRONZE SANDCASTLE is its consistent use of Sandboxie DLL sideloading.
|
By Sophos X-Ops
Automated sign-ins used the vendor's Entra application identity to request Microsoft Graph tokens across consenting tenants On October 15, 2026, Sophos X-Ops researchers identified a series of service principal sign-ins in which a threat actor authenticated as the ConnectWise Cloud Backup application (formerly SkyKick) and requested app-only Microsoft Graph tokens from customer Microsoft 365 tenants.
|
By Andrew Bonwell
Traditional business email compromise (BEC) is often thought of as a mailbox problem: a stolen account, unauthorized access to email, forwarding rules, and (sometimes) outgoing mail impersonating the compromised user. But more recent incidents show how far beyond “email only” these intrusions can extend once an attacker gains control of a cloud identity.
|
By Marlene Jones
Sophos ITDR now delivers deeper AI identity visibility, expanded Microsoft support, faster response, and seamless deployment. Identity has become one of the most targeted attack surfaces in cybersecurity, with attackers increasingly relying on stolen credentials, compromised sessions, excessive privileges, and identity misconfigurations to gain access.
|
By Sophos
EDR Killers let attackers blind endpoint protection before the real attack begins, and Sophos Endpoint stops them with several layers that are on by default. Most people picture a cyberattack as something loud: files encrypting, screens locking, a ransom note. But the attacks that do real damage usually start quietly. Before an attacker steals data or deploys ransomware, they try to make sure nobody is watching. That means dealing with the endpoint protection on the device first.
|
By Bud L. Ellis
Bring AI out of the shadows with visibility and control that help your organization adopt AI securely. When we introduced Sophos AI Defense in July, we focused on a challenge facing organizations everywhere: AI adoption is accelerating, often faster than security and IT teams can see or control it. New AI tools, embedded capabilities, and shadow AI are creating blind spots around where AI is being used and what information it can access.
|
By Bud Ellis
AI tools have made it remarkably easy for a company to expose its own data: None of these actions seem malicious, but each one moves sensitive information somewhere the security team cannot see. This new era of "move fast and break things”, a phrase famously coined by Mark Zuckerberg in the early Facebook days, benefits attackers. Company data now flows through more places, more third parties, and more delegated credentials.
|
By Nash Borges
This article was first published on LinkedIn. In Minority Report, the Department of Precrime promised certainty. Three precognitives saw the future, the system picked the consensus, and police arrested people for murders they hadn't yet committed. The whole machine depended on one buried secret: sometimes the precogs disagreed, and the dissenting vision, the minority report, was quietly deleted. The system held together as long as the precogs agreed, but broke when it removed its own doubt.
|
By Anthony Bradshaw
Active Directory defenses must combine identity fundamentals, telemetry, and rapid response as attackers reach the environment’s first breach attempt within a median of 11 hours.
|
By Sophos
Sophos Firewall v23 brings new DNS enhancements including DNS-over-HTTPS (DoH) support, DNS security extension (DNSSEC) support, and one-click Secure DNS set up, made possible through native integration with Sophos Fusion. Learn about the new enhancements and the steps to set up Secure DNS Protection, third-party DNS services, and DNSSEC protection. Ask questions and get expert answers in the Sophos Community.
|
By Sophos
Discover how Sophos Fusion helps Managed Service Providers (MSPs) simplify operations, improve security outcomes, and grow profitability with an AI-native cybersecurity defense system. Chapters Introduction to Sophos Fusion Unified Defense vs. Disconnected Tools Connected Protection Stack (Endpoint, Firewall, Email, MDR, Identity, Network) Shared Intelligence and Unified Response Simplified Management (Multi-tenant, Automation, RMM/PSA Integrations)
|
By Sophos
Discover how Sophos Endpoint’s CryptoGuard technology protects against local and remote ransomware by analyzing data files for malicious encryption and blocking activity automatically.
|
By Sophos
Sophos AI Defense finds the AI tools employees and applications are using, including the ones security teams never approved, and enforces policy wherever they run. Every AI tool an organization can’t see is a potential gap in confidentiality, integrity, and availability. Delivered through Sophos Fusion, the AI-native cybersecurity defense system, Sophos AI Defense connects controls on the device, across the network, at sign-in, and in the browser into one line of defense, so teams can safely adopt AI faster without adding another disconnected tool to manage.
|
By Sophos
Get started with the new REST APIs in Sophos Firewall v23. Learn how to enable API access, authenticate requests with API keys, import the OpenAPI specification into Postman, and use the API to create and manage firewall objects. Ask questions and get expert answers in the Sophos Community.
|
By Sophos
Every defence we rely on assumes there's time to check: verify the person on the call, vet the new hire, review the access request, patch the flaw. This video looks at how AI took that time away, in three parts. Built from the Sophos 2026 AI Security Report.
|
By Sophos
Every defence we rely on assumes there's time to check: verify the person on the call, vet the new hire, review the access request, patch the flaw. This video looks at how AI took that time away, in three parts.
|
By Sophos
You guide the strategy. You recommend the controls. You field the call when something goes wrong. You were always their CISO - now deliver it at scale with Sophos CISO Advantage.
|
By Sophos
Available as a fully integrated add-on for Sophos MDR and Sophos XDR, Sophos ITDR provides a comprehensive security solution that addresses the growing and complex challenges of identity threats and is delivered through the Sophos Fusion platform.
|
By Sophos
The Sophos Support Assistant answers your security and product questions directly within Sophos Fusion (formerly Sophos Central). It’s powered by Sophos documentation, knowledge base articles, user guides, and Community content, delivering relevant, up-to-date guidance to help you find answers and resolve issues faster. Learn how to access and use the Support Assistant. Ask questions and get expert answers in the Sophos Community.
|
By Sophos
This white paper reveals the attack techniques most likely to drive highimpact incidents - and provides practical advice on how to stop them. By learning from realworld attacks, businesses can strengthen their resilience and meaningfully reduce their cyber risk.
|
By Sophos
369 IT and cybersecurity leaders reveal the ransomware realities for financial services providers today. The report examines how the causes and consequences of ransomware attacks on financial services providers have evolved over time. This year's edition also sheds light on previously unexplored areas, including the organizational factors that left providers exposed and the human toll ransomware takes on IT and cybersecurity teams in the financial services sector.
|
By Sophos
Security Operations Centers (SOCs) are essential for detecting and responding to cyber threats, but building the right model isn't one-size-fits-all. With talent shortages and rising threat complexity, many organizations are rethinking how to scale security operations. This guide breaks down the pros, cons, and trade-offs of in-house, hybrid, and outsourced SOC models. Find the SOC strategy that fits your needs, risk profile, and available resources.
- October 2026 (19)
- September 2026 (26)
- August 2026 (8)
- July 2026 (20)
- June 2026 (6)
- May 2026 (25)
- April 2026 (17)
- March 2026 (17)
- February 2026 (6)
- January 2026 (10)
Sophos unites unmatched threat intelligence, adaptive AI, and human expertise in an open platform to stop attacks before they strike — giving you the clarity and confidence to stay ahead of every threat.
Sophos delivers adaptive, AI-powered cybersecurity — backed by real experts — so organizations can stay secure, resilient, and free to grow without compromise.
Sophos advantage in cybersecurity:
- Prevention: Sophos’ approach blocks more threats upfront to minimize risk and reduce investigation and response time.
- Trust: The only vendor named Gartner® Customers’ choice for endpoint, firewalls, mobile threats, and MDR, with 600K+ customers worldwide.
- Platform: Sophos products include 100+ integrations with other third-party solutions, plus services that are highly customizable to your needs.
Take Control of Every Threat