Sophos Compromise Assessment
Uncover evidence of a breach before it can impact your business
Last year, enterprises spent a median of 37 days and a mean of $2.4 million
to find and recover from security breaches. Delivered by an expert team ofincident response specialists, the Sophos Compromise Assessment, is thefastest, most effective means of identifying ongoing or past attacker activity
in your environment, enabling your organization to take swift, decisive action.

Identify Active or Recent Attacker Activity

Highlights

Delivered by an expert team of threat hunters and incident response experts, the Sophos
Compromise Assessment rapidly identifies if an attacker has breached your defenses,
quantifies the level of risk to your organization, and provides detailed guidance on what
actions need to be taken to eliminate the threat.

Ì Rapidly identify if an attacker
is operating undetected inyour environment

Extensive experience responding to today’s most advanced threats enables the Sophos
Incident Response (IR) Services team to identify indicators of compromise (IoCs) througha targeted investigation of potentially compromised assets. The result is a fast, thoroughassessment that helps your organization manage risk and compliance while maintaining
operational efficiency.

Sophos Compromise Assessment Methodology
The Sophos IR Services team maintains direct communication with your organization
through each phase of the Compromise Assessment, providing clarity on the threat, risk
exposure, and actions to be taken to resolve the incident and address the root cause.
1. Initial Coordination Call – the assessment begins with the efficient exchange of
information about the potential threat, identification of key points of contact, andconfirmation of the deployment scope and investigation process to be followed.
2. Deployment of Investigation Tools – guided installation of the awardwinning, clouddelivered Sophos platform ensures data on designateddevices is captured immediately, enabling the Sophos IR Services
team to conduct a thorough assessment of device health.
3. Threat Investigation and Risk Assessment – if an active threat isconfirmed, the Sophos IR Services team will conduct an immediate
Active Threat Call with your key points of contact to discuss the risk ofa widespread security incident and urgent actions to be taken.
4. Summary Call and Written Report –receive technical documentation and a
non-technical executive summary detailing evidence of attacker activity, risk
exposure, and guidance on eliminating the threat and addressing the root cause.
All four phases of the Sophos Compromise Assessment are typically completed within 7days of the Initial Coordination Call.

Ì Quantify the potential risk of awidespread security incident
Ì Communicate directly with anexpert team of threat hunters
and incident response
specialists throughout eachstage of the investigation
Ì Receive a comprehensive
analysis of attacker activity,
risk exposure, and guidanceon eliminating the threat andaddressing the root causeÌ Support risk management
and compliance initiatives, aswell as due diligence efforts
associated with mergers andacquisitions activity

Sophos Compromise Assessment

Fast, Thorough Investigation

Experiencing an Active Breach?

The Sophos Compromise Assessment investigates andidentifies a complete spectrum of attacker activities,
including:

Sophos Rapid Response gets you out of the danger zone fastwith our 24/7 team of remote incident responders, threatanalysts, and threat hunters. Onboarding starts within hours,
and the majority of customers are triaged in 48 hours. If you
are in the middle of an active threat, call your regional numberbelow at any time to speak with one of our Incident Advisors.

Ì Suspicious network activity
Ì Lateral movement
Ì Anomalous or malicious files

If you are in the middle of an active threat, email the Rapid
Response team at rapidresponse@sophos.com or call yourregional number below:

Ì Automated malware execution
Ì Unauthorized access

Australia: +61 272084454

Ì Privilege escalation

Austria: +43 73265575520

Ì Defense evasion

Canada: +1 7785897255

Ì Credential theft

France: +33 186539880

Ì Data exfiltration

Germany: +49 61171186766

Ì Unverified scripts

Italy: +39 02 947 52897

After the Assessment

Netherlands: +31 162708600

If the Sophos IR Services team confirms that an attacker
has breached your defenses, compromising your dataand business, there is an option for priority onboarding toSophos Rapid Response. This full-scale incident response
service will triage, contain, and neutralize the active threatacross your entire IT environment. An expert team of 24/7,
remote incident responders will quickly act to eject theadversary from your environment and recommend real-time
preventative actions to address the root cause.

Spain: +34 913758065
Sweden: +46 858400610
Switzerland: +41 445152286
United Kingdom: +44 1235635329
USA: +1 4087461064

If no signs of a breach are found, Sophos Managed Detection
and Response (MDR) can arm your organization with ongoing
24/7 detection and response services. Our round-the-clockteam of threat hunters and response experts proactively hunt
for and validate potential threats and incidents. The teamcontinually takes actions to disrupt, contain, and neutralize
evolving threats, and provides actionable advice to address
the root cause of incidents and improve your security
hygiene.

Experiencing an Active Breach?
Get lightning-fast support fromSophos Rapid Response

United Kingdom and Worldwide Sales
Tel: +44 (0)8447 671131
Email: sales@sophos.com

North American Sales
Toll Free: 1-866-866-2802
Email: nasales@sophos.com© Copyright 2023. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UKSophos is the registered trademark of Sophos Ltd. All other product and company names mentioned aretrademarks or registered trademarks of their respective owners.
2023-06-26 DS-EN (PC)

Australia and New Zealand Sales
Tel: +61 2 9409 9100
Email: sales@sophos.com.auAsia Sales
Tel: +65 62244168
Email: salesasia@sophos.com