Sophos EPP Suite Reviews

In Bangladesh, the main use cases for the Sophos EPP Suite include XDR, and several customers are moving towards MDR, which means Managed Detection and Response.

They are mainly in the banking sector, along with corporate customers, and government customers are using Sophos.

In Bangladesh's banking sector, there are numerous offerings for cloud XDR. Sophos EPP Suite has a feature called relay server cache, which means internet connection is not required for the end user. Sophos EPP Suite can download the update in servers that need internet connections, and from that server, updates can be pushed to the endpoints, even if they are in offline mode. This feature is particularly appealing to banking customers because, for compliance with the Central Bank, they don't want to connect all the PCs, laptops, and endpoints over the internet.

The feature is called relay server, and some people refer to it as a cache server.

The Sophos EPP Suite is scalable. Some customers in banks typically have 5,000 to 7,000 users. One customer started with 1,000 users and has now extended to 4,000 users. Some customers are using up to 8,000 users without any issues.

Regarding AI elements in the Sophos EPP Suite, firewalls have already introduced AI features. They have integrated AI models similar to ChatGPT in firewalls. These AI features should be introduced in endpoint XDR as well.

Key features for comprehensive detection and prevention include advanced threat prevention, ransomware protections, exploit prevention, and AI-powered detections. Extended visibility and data analysis include cross-product data correlations. They have a data lake, live discover, and threat graphs. They also offer AI case summary and AI common analysis, accessible from Sophos Central, which is the management portal for Sophos XDR. Sophos Central serves as one central management portal for managing firewalls, endpoint, Sophos encryption, and mobile device management solutions. This centralized management is particularly appealing to customers.

Originally, we started using the actual endpoints due to ransomware protection. From there, we've been using it more and more. We even use the web filtering functionality. So when people are at home and not going through the firewall, they're still being blocked from certain websites. We've also used it to manage USB ports.

The endpoint itself is nothing special, other than the way the cloud management and reseller management works. With the reseller management, I can manage multiple clients without having to log in to each client. Once I start integrating all the Sophos products, a lot of features become available that I cannot get with separate standalone products. Once it's running, it's fine.

It's similar to Sophos EDR in terms of security. The key features include malware protection, antivirus, and ransomware defense. Data Loss Prevention (DLP) is also a reason we chose it. There are many other features. 

The performance and scalability are impressive. We can install it on various computers.

We use it to protect our endpoint devices from internet threats and to block some USB devices and certain websites.

It has web protection features, allowing us to block multiple websites and applications within the network.

It has tamper protection features. We can enable and disable this as needed, and we can check the events of each system on the endpoint to find solutions.

The solution is used for endpoint protection and recovery. We have XDR.

We also use firewalls and access points. The product interacts well with other Sophos products we have.

I use Sophos EPP Suite for Sophos Connect Version 2.2.90.

The most valuable feature of the solution is that it works fine.

Earlier deployments were on-premises, but we have worked on the on-cloud and on-prem setup phases wherein the use cases were about protecting all the endpoints as there was a, you know, increase in the remote work-from-home and office happenings. There was a requirement for a customer to track the endpoints as well and not give them access to pen drives or any other things as it was an office setup or office assets. So that's the kind of policy I have created. Also, use cases included in a way, like, some URLs had to be blocked, certain URLs should not work while ensuring that applications are secure. So, whatever applications an IT administrator is providing, we have to give access to the applications. There was one of the use cases wherein some users were trying to do a POC on simulators, where the attack would be generated in certain machines, and how Sophos is trying to protect that. So, they wanted to see that. So that was also being evaluated from my end. Sophos proved around seventy percent protection score, while the other antivirus solutions were not able to do that. With the value added by Sophos, we can say that Sophos is very big in terms of endpoints.

It has web gateway protection. It can filter out at the granular level for the URL filtering and everything. So it can also give you all the detailed reporting wherein what file has been executed. Also, it has a lightweight agent wherein it has a huge database where it is constantly upgrading. Based on that, it becomes effective in catching certain threats.

The primary use case of this solution is to protect our endpoints, computers, laptops, and mobile devices.

The solution has increased user productivity by not having encountered any downtime.