Sophos Endpoint

Single console platform with protection against zero-day malware and advanced threats with Cryptoguard and exploit prevention with local support and data localization and their Adaptive attack protection with critical attack warning helping us a lot and now Sophos EPP is powered with AI Deep learning.

The policies are easy to configure for assets, and the fact that it's easy to both include and exclude specific assets from various policies is helpful. The overall health status and dashboard is also helpful in showing compliance across the estate. Moving assets between sub-estates is possible, however slightly tricky as it needs to be done via the API. The console is fairly intuitive to navigate and use.

I enjoy having Sophos Central so that I can centrally manage and see what is going on amount our Sophos products. Their support has been helpful as well when we have had to call upon them. I've really enjoyed having a robust graphic interface as well.

Overall the product is good, full of advanced security features the only missing what I feel is that patch management.

Alerts are not clear within the console and are not easily sortable (i.e. you can't search across alerts to see which assets have had a Network Extension error) Additionally, interacting with the API's can be troublesome when performing integrations with SIEM or other security solutions if you have multiple sub-estates. XDR alerting is also done per sub-estate and can't be pushed to the top-level estate and currently cannot be extracted to a SIEM solution, so this is less than ideal.

I would like the filters on the firewall to support more than just one or two items max when filtering. If I'm looking for something, it looks like I can filter as many things as I want, but in reality it starts overwriting the other filter items. I would also love to see more straightforward solutions for things like the CAA and the RED devices. I have spent a lot of time struggling to get these to work and even ended up on a 2 hour call with support to get a RED device set up. It's great that the RED devices should be able to just connect and go, but when they don't, you have zero capability to troubleshoot it from the device that I could find. Looks like you used to be able to but that got taken away in recent iterations. The CAA as mentioned was also fairly confusing and once set up, I just gave up on implementing the multi factor authentication option. It did not work well and although I get having them authenticate every day as being secure, they needed to authenticate every time they logged out of their computers. Could use some work to make it easier to use. I also think there should be integrations with products like Cisco and Ubiquity to help make VLANing a lot easier. That or make your switches more competitive in pricing as many organizations like ourselves find it hard to pay double or triple to get the same switch just from Sophos instead of others.