Sophos Rapid Response – immediate response to active threats
How do you think an IT administrator or CEO (who doesn’t have an IT administrator) reacts when he realizes that a malware is just spreading in the company network and the whole operation is slowly coming to a halt?
When such a situation occurs, every second counts to stop the attack as quickly as possible and limit the damage. And this is exactly where Sophos wants to make its contribution with Rapid Response.
What exactly is Rapid Response?
Sophos Rapid Response provides lightning-fast help when you find yourself in the situation of an active threat. The service is available to all customers, whether they already have a Sophos product or not.
The only ones among you who will never need Rapid Response are those who have a Sophos Central Intercept X Advanced with EDR and MTR license. This means that an elite security team is already taking care of threat detection in your company 7×24 and will intervene immediately in delicate situations.
7×24 available for you
Since every second counts during an attack, the cyber security analysts, as well as the onboarding team, work 7×24 to get customers out of the tricky situation immediately. The high availability is absolutely necessary for such a service, because such attacks usually don’t happen at 9:00 on a Monday morning, but rather at 9:00 in the evening on a Friday, or even gladly on Christmas Eve. 😬
Stopping the damage is the first priority
Fittingly in times of a pandemic, the service is performed completely remotely. The goal is always to stop the damage, but not to restore the original environment. You have to think of it like a fire department operation, for example. If a house is on fire, Sophos would be the fire department, so to speak, and see that the fire can be brought under control and extinguished. But Sophos is not responsible for rebuilding the house at the end.
Fast onboarding
In order for the Rapid Response Team to stop the attack on your organization, they first go through an onboarding process. This involves rolling out Intercept X Advanced with EDR Agent to all endpoints and servers to get the initial data to assess the situation as quickly as possible.
For customers who previously relied on another security vendor, the software will be temporarily deactivated or uninstalled immediately.
All the while the Rapid Response Team is working to contain the threat on your network and stop the attack, you’ll enjoy VIP status with a dedicated point of contact. Note, however, that the service is currently only available in English.
Fixed price without hidden costs
Rapid Response is provided for 45 days at a fixed price. The price is calculated based on the number of users and the number of servers in the company.
For the 45 days, the customer is covered by the MTR Advanced Service. It does not matter whether the unauthorized access was already brought under control after two days. The “patient” nevertheless remains under constant observation for the remaining 43 days.
After these 45 days, the customer is free to decide whether he wants to continue protecting his computers and servers with the MTR Advanced license or switch back to his previous security vendor. However, the latter is probably only seriously considered in the fewest cases. 😅
Of course, it would also be possible to upgrade to a lower license, such as MTR Standard or Intercept X Advanced with EDR to switch. However, I would not recommend anything below that.
Conclusion
I don’t think anyone would like to be in the situation of being hit by a nasty malware that is not detected by the installed endpoint protection and can diligently collect data undisturbed for months. And this is just one example of the behavior of a modern malware. When faced with such a shambles, there is probably nothing more reassuring than having an expert in the field take care of it and get the situation under control as quickly as possible. So now, with Rapid Response, Sophos has a solution.
But just because there’s a service like this now doesn’t mean you should be negligent about protecting your network. You don’t light a fire in your home with the thought: “The fire department will be there if it gets out of control.
The goal must be to never have to deploy the Sophos Rapid Response Service. So for customers who already protect their computers and Server with Sophos Central, they should at least license Intercept X Advanced with EDR. Only with EDR will you have professional tools to detect suspicious activity on the network that is not directly detected by Intercept X Advanced.
If you don’t have the time to regularly scan your network for suspicious activity, the MTR license lets you sit back and let Sophos’s team of experts do the work for you 24/7! You get the same service as with Rapid Response. The only difference is that you can already count on the best protection from Sophos before the child has fallen into the well. 😎
More information
