Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

sophos

Is "SIEM-less" really what it sounds like?

Oct 23, 2026 By Ratnesh Saxena In Sophos
SIEM-less security may sound like an escape from traditional SIEM complexity and costs, but the underlying capabilities still have to exist somewhere. A SIEM is a multipurpose tool. It brings together cyber and physical security use cases; drives threat detection, investigation, and response (TDIR); serves as a system of record for governance, regulatory, and compliance needs; and supports observability use cases tied to resilience and service degradation. The list goes on.
Read Post

Sophos Mobile Overview: Unified MDM and Mobile Threat Defense

Oct 22, 2026 By Sophos In Sophos
Mobile devices keep your business moving, but managing them's only half the battle. You've got to secure the users, apps, and business data that depend on them. Sophos Mobile brings mobile device management and mobile threat defense together in one intuitive experience, helping you simplify administration, protect corporate data, and guard users against mobile threats.
View Video
sophos

Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)

Oct 21, 2026 By Sophos Counter Threat Unit Research Team In Sophos
In response to requests, this update consolidates the Sophos countermeasures that relate the PHP2Shelll vulnerabilities. SophosLabs has developed the following countermeasures to specifically detect activity associated with this threat. The next table lists additional pre-existing Sophos countermeasures that will likely address post-exploitation activity associated with these vulnerabilities.
Read Post
sophos

Web App Owners - You're on Notice. Your Low-Hanging Fruit Just Got Lower

Oct 21, 2026 By Chris Ahearn In Sophos
Recent incident response investigations reveal how AI-assisted attackers are chaining web application vulnerabilities, credential theft, privilege escalation, and lateral movement into autonomous intrusion workflows. This article is part of an ongoing series from Sophos frontline security operations specialists, sharing the expertise they use to strengthen our industry-leading Managed Detection and Response (MDR) service and defend customers against evolving AI-era threats.
Read Post
sophos

Why Incident Response Demand Will Grow Faster than Expected

Oct 20, 2026 By Dan Levesque In Sophos
This article is part of an ongoing series from Sophos frontline security operations specialists, sharing the expertise they use to strengthen our industry-leading Managed Detection and Response (MDR) service and defend customers against evolving AI-era threats. A 20% growth forecast for cybersecurity talent sounds significant. I believe it understates what we are going to see in Incident Response. The U.S.
Read Post
sophos

BRONZE SANDCASTLE deploys modified Meterpreter shells

Oct 20, 2026 By Sophos Counter Threat Unit Research Team In Sophos
The China-based threat group uses DLL sideloading in these attacks Counter Threat Unit (CTU) and SophosLabs researchers investigated a cluster of incidents attributed to the BRONZE SANDCASTLE threat group. The most distinctive technical marker for BRONZE SANDCASTLE is its consistent use of Sandboxie DLL sideloading.
Read Post
sophos

ConnectWise Cloud Backup application abused in cross-tenant token sweep

Oct 19, 2026 By Sophos X-Ops In Sophos
Automated sign-ins used the vendor's Entra application identity to request Microsoft Graph tokens across consenting tenants On October 15, 2026, Sophos X-Ops researchers identified a series of service principal sign-ins in which a threat actor authenticated as the ConnectWise Cloud Backup application (formerly SkyKick) and requested app-only Microsoft Graph tokens from customer Microsoft 365 tenants.
Read Post
sophos

Beyond the mailbox: Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion

Oct 19, 2026 By Andrew Bonwell In Sophos
Traditional business email compromise (BEC) is often thought of as a mailbox problem: a stolen account, unauthorized access to email, forwarding rules, and (sometimes) outgoing mail impersonating the compromised user. But more recent incidents show how far beyond “email only” these intrusions can extend once an attacker gains control of a cloud identity.
Read Post

Sophos Firewall: DNS enhancements

Oct 19, 2026 By Sophos In Sophos
Sophos Firewall v23 brings new DNS enhancements including DNS-over-HTTPS (DoH) support, DNS security extension (DNSSEC) support, and one-click Secure DNS set up, made possible through native integration with Sophos Fusion. Learn about the new enhancements and the steps to set up Secure DNS Protection, third-party DNS services, and DNSSEC protection. Ask questions and get expert answers in the Sophos Community.
View Video
sophos

Sophos ITDR expands identity protection for the AI era

Oct 15, 2026 By Marlene Jones In Sophos
Sophos ITDR now delivers deeper AI identity visibility, expanded Microsoft support, faster response, and seamless deployment. Identity has become one of the most targeted attack surfaces in cybersecurity, with attackers increasingly relying on stolen credentials, compromised sessions, excessive privileges, and identity misconfigurations to gain access.
Read Post

Sophos Fusion: Securing the AI Era for MSPs

Oct 15, 2026 By Sophos In Sophos
Discover how Sophos Fusion helps Managed Service Providers (MSPs) simplify operations, improve security outcomes, and grow profitability with an AI-native cybersecurity defense system. Chapters Introduction to Sophos Fusion Unified Defense vs. Disconnected Tools Connected Protection Stack (Endpoint, Firewall, Email, MDR, Identity, Network) Shared Intelligence and Unified Response Simplified Management (Multi-tenant, Automation, RMM/PSA Integrations)
View Video
sophos

Building intent-based access control without reading minds

Oct 13, 2026 By Nash Borges In Sophos
This article was first published on LinkedIn. In Minority Report, the Department of Precrime promised certainty. Three precognitives saw the future, the system picked the consensus, and police arrested people for murders they hadn't yet committed. The whole machine depended on one buried secret: sometimes the precogs disagreed, and the dissenting vision, the minority report, was quietly deleted. The system held together as long as the precogs agreed, but broke when it removed its own doubt.
Read Post
sophos

Stopping attackers who want your endpoint protection to go dark

Oct 13, 2026 By Sophos In Sophos
EDR Killers let attackers blind endpoint protection before the real attack begins, and Sophos Endpoint stops them with several layers that are on by default. Most people picture a cyberattack as something loud: files encrypting, screens locking, a ransom note. But the attacks that do real damage usually start quietly. Before an attacker steals data or deploys ransomware, they try to make sure nobody is watching. That means dealing with the endpoint protection on the device first.
Read Post
sophos

Sophos AI Defense is now generally available

Oct 13, 2026 By Bud L. Ellis In Sophos
Bring AI out of the shadows with visibility and control that help your organization adopt AI securely. When we introduced Sophos AI Defense in July, we focused on a challenge facing organizations everywhere: AI adoption is accelerating, often faster than security and IT teams can see or control it. New AI tools, embedded capabilities, and shadow AI are creating blind spots around where AI is being used and what information it can access.
Read Post
sophos

AI governance needs more than a policy document

Oct 13, 2026 By Bud Ellis In Sophos
AI tools have made it remarkably easy for a company to expose its own data: None of these actions seem malicious, but each one moves sensitive information somewhere the security team cannot see. This new era of "move fast and break things”, a phrase famously coined by Mark Zuckerberg in the early Facebook days, benefits attackers. Company data now flows through more places, more third parties, and more delegated credentials.
Read Post

Introducing Sophos AI Defense

Oct 13, 2026 By Sophos In Sophos
Sophos AI Defense finds the AI tools employees and applications are using, including the ones security teams never approved, and enforces policy wherever they run. Every AI tool an organization can’t see is a potential gap in confidentiality, integrity, and availability. Delivered through Sophos Fusion, the AI-native cybersecurity defense system, Sophos AI Defense connects controls on the device, across the network, at sign-in, and in the browser into one line of defense, so teams can safely adopt AI faster without adding another disconnected tool to manage.
View Video
sophos

Understanding Asymmetric Routing Risks in Modern Firewall Deployments

Oct 6, 2026 By Joe DeGon In Sophos
In modern network environments, maintaining both operational efficiency and strong security controls requires careful design and planning. One of the more common challenges Sophos Professional Services encounters, especially during firewall upgrades or redesigns, is asymmetric routing.
Read Post
sophos

Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation

Oct 5, 2026 By Sophos Counter Threat Unit Research Team In Sophos
On October 4, 2026, Citrix disclosed a high-severity (CVSS score of 8.7) memory overflow vulnerability (CVE-2026-88779) affecting Citrix NetScaler ADC and Citrix NetScaler Gateway deployments that are configured as either a SAML Service Provider (SP) or SAML Identity Provider (IdP). Successful exploitation can cause a denial of service (DoS) condition, potentially disrupting authentication services and remote access functionality.
Read Post
sophos

Sophos Named a Leader in the IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises 2026

Oct 2, 2026 By Sophos In Sophos
Sophos has been named a Leader in the IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises 2026, recognizing the strength of our prevention-first approach and stopping AI-era threats as early as possible. Attackers using frontier AI models can now find vulnerabilities and generate exploits faster than organizations can patch them. And when malicious code is already running before an alert fires, detection alone is too late.
Read Post
Sophos Launches CISO Advantage, Bringing CISO-Level Security Strategy Within Reach of Every Organization

Sophos Launches CISO Advantage, Bringing CISO-Level Security Strategy Within Reach of Every Organization

Oct 1, 2026 By Sophos In Sophos
Delivered through Sophos Fusion, Sophos CISO Advantage uses agentic AI with human judgement to give every organization, with or without a CISO, a security program it can measure, fund, and prove.
Read Post
sophos

Sophos CISO Advantage is now generally available

Oct 1, 2026 By Sophos In Sophos
Take control of your security outcomes. Sophos CISO Advantage is now generally available to the market, giving CISOs and security teams without a CISO the solution they need to build, manage, and improve a compliance-driven cybersecurity program. In July, we introduced Sophos CISO Advantage, explaining how it enables organizations and Managed Service Providers (MSPs) to understand cyber risk, prioritize what matters most, and demonstrate measurable improvement over time.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.