Sophos Firewall Zero-Day Protection

Cyberthreats continue to evolve. Signature-based malware detection benefits from additional analysis of unknown files. Zero-Day Protection adds protection against advanced and changing threats. It combines behavioural analysis and emulation to investigate potentially malicious files. Together with the appropriate Web Protection licence, it adds defence against advanced persistent threats (APTs) and unknown malware in web traffic.

Behavioural analysis and emulation examine suspicious activity rather than relying solely on known signatures. Conventional malware protection remains an important first layer, complemented by tools that investigate unknown threats. Zero-Day Protection supplies this additional layer.

It complements existing Sophos security products against advanced persistent threats and zero-day malware. It helps detect and block evasive threats designed to bypass existing controls. Cloud-based sandboxing analyses suspicious files to strengthen protection against advanced malware.

Additional defence against targeted attacks

Help keep unknown, data-stealing malware out of your network. Cloud sandboxing helps analyse and respond to APTs and zero-day threats.

Zero-Day Protection adds file-analysis methods beyond conventional scanning. It supports proactive defence by detecting malicious behaviour before a file is released, according to policy. AI and machine learning help assess unknown and evolving threats.

Activate within your existing firewall

Zero-Day Protection is configured within Sophos Firewall. After licensing, enable analysis in the appropriate web or email rules and check the supported traffic paths. Sophos documentation and covered support services help with configuration questions.

Zero-Day Protection integrates with your Sophos security solution. Activate the licence and configure the appropriate inspection rules. Protection applies to eligible files in the configured inspection paths.

Detect evasive threats

Zero-Day Protection adds analysis beyond signatures and heuristics. Behavioural analysis and machine learning help identify threats designed to evade conventional controls. These methods can reveal attacks that simpler checks miss, without guaranteeing detection of every threat.

Investigate threats designed to evade sandbox analysis. Full-system emulation examines unknown files’ behaviour and helps identify sandbox-evasion techniques.

Detailed analysis

Analysis reports show what suspicious files do in the isolated sandbox environment. They can include file, process, memory, registry and network activity; this is file analysis, not continuous monitoring of every endpoint or operating system. Let suspicious files run in the isolated cloud sandbox before releasing them to your network, according to the configured policy.

Cloud-based processing

Zero-Day Protection analyses files in a Sophos cloud datacentre; select the available processing location to meet your organisation’s requirements. The actual analysis time depends on the file and the processing required. Analysis can take several minutes; pending files remain subject to the configured release policy.

The firewall checks traffic first and sends eligible suspicious files for additional analysis. Cached verdicts reduce repeated analysis, but new-file analysis can delay a download or attachment delivery.