Introducing Sophos MDR for Microsoft Defender

Skilled adversaries don’t break in. They log in.

Organizations that have invested in the Microsoft Security suite still need to protect against these advanced, human-led attacks that technology alone cannot prevent. However, the sheer volume of alerts generated by Microsoft security technologies, together with the complexity of the threat landscape and widespread shortage of in-house expertise and capacity, means that delivering effective security operations is an uphill task for most organizations:

• 71% of security teams struggle to determine which security alerts to investigate among the noise generated by their tools
• 52% of leaders say cyberthreats are now too advanced for their organization to deal with on their own, rising to 64% in small businesses
• The median threat response time is 16 hours, leaving attackers significant time to operate within the network

Introducing Sophos MDR for Microsoft Defender

Increasingly, organizations running Microsoft Defender are turning to specialist MDR providers such as Sophos to extend their cyber defenses. Given this pressing need, I am excited to announce the availability of Sophos MDR for Microsoft Defender. With this service, over 500 Sophos analysts monitor, investigate, and respond to Microsoft security alerts 24/7, taking immediate action to stop confirmed threats.

• Detect advanced threats using a wide range of Microsoft Security event sources together with proprietary Sophos detections and human-led threat hunts
• 24/7 expert-led threat response quickly stops attacks and terminates threats
• Integration with non-Microsoft security tools (Sophos or other providers) expands visibility and accelerates investigation response across the entire environment

With our experts taking care of security operations, organizations running Microsoft Defender can reduce cyber risk, increase the impact and efficiency of their existing security investments, and improve insurability.

Unparalleled visibility that delivers accelerated detection and response

The more we see, the faster we act. Unlike other MDR offerings that limit support to Microsoft Defender for Endpoint or Microsoft Sentinel, Sophos MDR leverages signals from the full Microsoft Security suite, including:

• Microsoft Defender for Endpoint
• Microsoft Defender for Identity
• Microsoft Defender for Cloud
• Microsoft Defender for Cloud Apps
• Identity Protection (Azure Active Directory)
• MS O365 Security and Compliance Center
• Microsoft Azure Sentinel
• Office 365 Management Activity

Microsoft security solutions are only one part of a threat detection stack that typically includes firewalls, identity solutions, email security tools, NDR platforms, and public cloud security tools. Sophos MDR for Microsoft Defender provides a holistic approach to cybersecurity operations, integrating with almost any technology investment that generates security alerts – including tools from Microsoft, Sophos, and dozens of other providers.

By consolidating and correlating cross-product and cross-vendor telemetry in the Sophos XDR Data Lake, Sophos MDR increases the detection capability of our customers’ security stacks beyond the sum of the individual parts while also maximizing ROI on existing security investments.

Putting the R (Response) into MDR for Microsoft Defender

Identifying a threat is just part of the security operations process; unless you respond in a timely and effective manner, you remain fully exposed to attack. Yet all too often, third-party providers offer only minimal threat response capabilities in Microsoft Defender environments.

Sophos MDR for Microsoft Defender is different. It includes full threat response, containing threats to disrupt malicious activity. The non-exhaustive list of response actions that our analysts are capable of with Sophos MDR for Microsoft Defender includes:

• Terminating processes
• Disabling user accounts
• Forcing log off of user sessions
• Isolating host(s) utilizing Sophos Central
• Applying host-based firewall IP blocks
• Removing malicious artifacts

With Sophos MDR, you can relax knowing that we don’t just tell you about issues, we deal with them for you.

Future-proof your Microsoft defenses with the world’s most trusted MDR service

Testament to the superior outcomes our customers enjoy, Sophos MDR is the world’s most popular and most reviewed MDR solution, with a 4.8/5 rating on Gartner Peer Insights as of July 10, 2023, and a top rating on G2.

We secure more organizations than any other MDR provider, and this extensive experience across all industries and sectors enables us to provide unique “community immunity” to all our customers.

To learn more about Sophos MDR for Microsoft Defender and how it can support you, visit our website, read the service brief, or speak with a security expert today.