Sophos Endpoint User

Endpoint protection for everyday work

Sophos Endpoint User protects employees’ computers against malware, ransomware and attacks on applications. The solution was formerly called Central Intercept X Advanced. Protection policies, alerts and device status are managed centrally, giving IT visibility even across distributed workstations.

Several mechanisms complement each other: file checks, behavioural analysis and exploit defence look for malicious files and attack techniques. CryptoGuard detects suspicious file encryption, can stop the responsible process and restore affected files from its recovery copies. This reduces damage but does not replace an independent backup.

Available features depend on the operating system. Sophos Endpoint User is the user licence for workstations; servers require the corresponding server product. Sophos EDR or XDR offer more extensive investigations and manual response tools.

Exploit Prevention

An unpatched vulnerability can become an entry point for an attack. Exploit defence therefore targets common attack techniques and can block malicious actions even when the specific malware is not yet known.

It complements updates and other protection mechanisms. Vulnerabilities must still be patched; a protection feature does not guarantee coverage of every application or attack.

Root Cause Analysis

A blocked file often raises further questions: which process launched it and what happened next? Graphical root cause analysis displays available relationships and helps IT interpret a detection.

Sophos Endpoint therefore provides context for incidents. Sophos EDR and Sophos XDR go further with active threat hunting, additional data queries and response options. An analyst team working around the clock is included only with the MDR service.

Automatic cleanup

Detected malware should not remain on the device. Sophos Endpoint can automatically clean up malicious files and related traces, and highlights cases requiring IT intervention.

Cleanup does not guarantee that the entire computer returns to its original state after every attack. Confirmed compromises still require further investigation and, where necessary, recovery.