Sophos Endpoint Threat Protection best practices

The Threat Protection policy is the most important Endpoint policy in Sophos Fusion (formerly Sophos Central). It controls not only traditional malware scans but also behavioural detection, exploit mitigation, CryptoGuard, web protection, Event Journals and other runtime protections.

Sophos-recommended settings are the best starting point. Keep deviations small, targeted and measurable. A broadly weakened Base Policy may fix compatibility briefly, but it enlarges the blind spot for every endpoint.

Scope and platform limits

This page covers only the Threat Protection policy for endpoint computers. Servers use different policy settings. In the policy, Show filters > Operating System separates Windows and Mac settings, so don’t assume that a control shown for one platform exists on the other.

First identify the effective Threat Protection policy under My Products > Endpoint > Policies, then answer:

1. Which platforms and agent modes receive it?
2. Do its settings match current Sophos recommendations?
3. Are deviations and old exclusions documented?
4. Are Event Journals and Threat Graphs available for investigation?

Account Health Check highlights deviations. Fix automatically applies the recommended values to every option in the affected endpoint Threat Protection policies on affected computers; the changes can then be reviewed in the audit log. To assess each change individually, open the policy from the warning and correct the settings highlighted in red.

Protection areas and recommendation

The detailed list grows with agent versions. Compare the current policy using the Recommended and Not Recommended filters rather than treating an old screenshot as permanent truth. “Recommended” does not mean that every switch is on. The current policy help identifies Prevent malicious network traffic with packet inspection (IPS) and Block QUIC browser connections as off by default. The separate fix page, however, describes Reset broadly as turning on all settings except Device Isolation and SSL/TLS decryption. After a reset, check the actual switches and recommendation markers rather than inferring the resulting state from the word “default”.

Restore recommended values

For the Base Policy, Reset restores Sophos recommendations. In other policies, correct the red-highlighted deviations individually and select Save. Before using Fix automatically or Reset, record the scope, starting values, and documented compatibility deviations because either action can change several protection areas at once. Do not use an automatic fix or a reset of the production Base Policy as the pilot. First reproduce the intended recommended values manually in a separate policy assigned only to representative pilot devices. After acceptance, apply the bulk action to the intended scope. If a problem occurs, restore the recorded values, then recheck policy, health, events, and the affected business workflow.

Real-time and download protection

Real-time scanning checks files on access. Download Reputation additionally evaluates downloads by source and prevalence. The policy separates Action to take from Reputation level: Prompt User is the documented default action; Recommended blocks low-reputation files, while Strict also blocks medium-reputation files. Strict can therefore affect more legitimate downloads.

Test Strict in a pilot group first. Base the decision on real download workflows and events, not merely on choosing the strictest switch.

Sophos Live Protection checks the current reputation of unknown files with Sophos. Deep Learning uses its model to detect suspicious files even without traditional signatures. Both functions remain part of the baseline.

Limits of Download Reputation

Download Reputation is a Windows feature for files downloaded through supported browsers. Firefox downloads are currently not assessed through this path. Sophos derives reputation from hash, prevalence, age and source URL; full reputation queries mainly apply to executable files or files recognised as applications.

The query uses SXL4 over HTTPS. Scheduled scans can send hash information to Sophos and populate a local cache, but do not enforce a Download Reputation decision. The cache is limited to 200 MB and then removes older entries.

⚠️ If the endpoint cannot reach SXL and the query times out, the download is allowed without a reputation prompt. Download Reputation therefore does not replace file scanning, Deep Learning, or working network and proxy requirements.

For troubleshooting, distinguish three changes: set the action to Log only, disable Detect low-reputation files, or disable Live Protection and therefore the online query. Their security impact differs. Use them only in a small test policy with a fixed rollback time, never as a permanent workaround.

The policy distinguishes local, network and removable media. Scan network drives only as broadly as the business process requires because duplicate scanning on client and file server can reduce performance. Removable media and newly downloaded files remain important entry paths.

Internet scanning can inspect HTTP downloads directly. For encrypted HTTPS, visibility depends on SNI and enabled SSL/TLS decryption. A successfully blocked HTTP test therefore does not prove equivalent content inspection for HTTPS.

Cleanup and SafeStore

Sophos can clean detected malware automatically. Windows cleans detected items regardless of the visible setting. Cleaned files are held in SafeStore and can be restored through a controlled allow process.

Restoration is not a routine user action. Verify the detection name, source, hash, signature, business need and SophosLabs assessment first. Sophos Endpoint threat cleanup and malware remediation explains the false-positive process.

SafeStore has fixed limits: an individual file can be no larger than 100 GB, and no more than 200 GB or 2,000 files are retained in total. These limits are not a backup strategy. Business data must be backed up independently.

Event Journals and Threat Graphs

Keep Enable event journals on. Journals provide activity data for Threat Graphs, Live Discover and Forensic Snapshots.

Turning them off removes data for the exact period that may later require investigation. Enabling them afterwards cannot reconstruct missing history.

Enable Threat Graph creation helps reconstruct the chain of events around a detection and belongs in an XDR and incident-response baseline.

On Windows, Sophos Data Recorder uses the shared NT Kernel Logger session. If another tracing tool reports 0xb7 or “file already exists”, that session is occupied. Disabling Enable Threat Graph creation releases the logger but also stops Threat Graph generation. Use this only as a documented, time-limited diagnostic window, then re-enable the policy and verify telemetry.

Ransomware protection

CryptoGuard protects documents against unauthorised encryption. Protection from remotely run ransomware should also remain enabled because a compromised device can encrypt files on network shares.

Additional options protect against EFS and master boot record attacks. A ransomware detection requires investigation of the device, user, source process, network shares and neighbouring systems, not just the individual file.

Runtime Protection and exploit mitigation

Depending on platform and agent version, Runtime Protection can include:

• protection against process hollowing and DLL injection
• blocking untrusted DLL paths
• credential-theft protection
• protection for MFA browser cookies
• detection of malicious beacons
• protection against ETW tampering
• monitoring of abused drivers and system calls

Do not disable individual protections simply because an application crashes. First associate the event with a protection component and narrow the issue using a pilot or targeted policy exclusion.

Other current areas include AMSI Protection for script and memory content, Intrusion Prevention for malicious network traffic, Driver Detection and protection events on Domain Controllers. Prevent malicious network traffic with packet inspection (IPS) is off by default and should therefore be piloted deliberately. It inspects network traffic on the Windows device and is not the same as IPS on a network firewall.

Block QUIC browser connections forces supported browsers away from QUIC so website checking and SSL/TLS decryption can apply. On Macs, the current help makes this control and SSL/TLS decryption available only through an Early Access Program.

Adaptive Attack Protection

Adaptive Attack Protection automatically strengthens defences when Sophos detects an active attack. Additional protections can remain permanently enabled, including Safe Mode protection, vulnerable-driver blocking and additional audit policy logging.

Older specialist drivers and administrative security tools need careful piloting. Address incompatibility with a tightly scoped exception rather than disabling the entire area globally.

If Self Help reports that Anti-Ransomware and every Exploit Mitigation feature are disabled by policy, verify the effective Threat Protection policy. Registry values such as disabled KernelFeatures or NoCryptoGuard describe the resulting local state, but are not the repair location. Correct the policy in Sophos Fusion and verify locally after synchronisation.

Disrupt detections and Safe Mode

A detection prefixed Disrupt_ means Adaptive Attack Protection interrupted behaviour that may belong to an active attack or penetration test. Before an exclusion, review device, user, detection, TTP classification and planned test together. If legitimate, authorise the specific rule instance where possible. Globally disabling Adaptive Attack Protection is the last option. It prevents further Disrupt_* rules, while TTP classifications for XDR remain.

Block safe mode abuse prevents suspicious programmatic Safe Mode activation as Prevent_1a (T1562.009). The rule does not clean malware; it only blocks the transition. For planned maintenance, temporarily disable the setting on that device using Override Sophos Central Policy, use a narrow device policy, or start Safe Mode from an authorised Live Response session. A local override expires after four hours but should still be ended deliberately.

Do not permanently authorise a single Prevent_1a detection because an attacker could later reuse the technique. After maintenance, recheck policy, Tamper Protection and Health State.

Additional Windows audit logging

With Core Agent 2026.1, Sophos enables Enable additional audit policy logging by default. It extends the Windows Security Event Log with Events relevant to Detection and Threat Hunting, including Kerberos sign-ins, account and group changes, logons, scheduled tasks, Credential Manager access, service installations and audit-policy changes.

The underlying Event list cannot be configured individually. On Domain Controllers, terminal servers and other heavily used systems, the Security Log can therefore grow considerably faster. Check SIEM ingestion, retention, Event Log size and existing Windows audit GPOs before a broad rollout.

The switch can be disabled, but doing so reduces the data available for advanced Detection and Threat Hunting. Disable it only after measuring the impact and documenting the trade-off, not merely because the Event count increased.

HTTPS decryption

Decrypt websites using SSL/TLS enables content inspection of encrypted websites. It is off by default and can slow browsing or interfere with certificate-pinned applications.

The compact click path is My Products > Endpoint > Policies > Threat Protection. Open the pilot policy, turn on Decrypt websites using SSL/TLS under SSL/TLS decryption of HTTPS websites, and select Save.

The privacy and compliance review is a concrete data-processing decision: decrypted traffic can contain personal information that may be recorded and visible to authorised administrators in logs. Before enabling the feature, define the purpose and legal basis, affected user groups, sensitive categories, log access, and retention. Sophos Fusion excludes categories including banking and webmail from decryption by default; compare those defaults with your own requirements before rollout.

Avanet recommends enabling decryption when that review permits inspection, another security service does not already decrypt the same traffic, and the pilot remains stable with important browsers and business applications. Otherwise, leave it off and document the decision. Keep certificate-pinning or category exclusions narrow and manage their lifecycle as described in Configure Sophos Endpoint exclusions safely. This article covers only the Sophos Fusion Endpoint policy.

Scheduled Scan

A weekly scheduled scan can inspect rarely used data. The configured time is the endpoint’s local time. If the device is off, it waits until the next scheduled time.

Scheduled scans do not replace real-time protection. The current background option is limited to Windows. A missed scheduled scan does not run repeatedly without limit; test the exact behaviour of the selected scan option on an offline pilot. For mobile devices, select a time when they are usually online without unnecessarily affecting core working hours.

Exclusions

Policy exclusions affect only that policy’s target and are preferable to global exclusions. Every exclusion reduces protection and must be as specific as possible.

Broad drive, profile, temporary-folder or process exclusions are particularly risky. Configure Sophos Endpoint exclusions safely covers types, wildcards and lifecycle control.

Development tools such as WinDbg Time Travel Debugging cannot attach to protected processes while Exploit Mitigation is active. If required, give only the investigated process a time-limited Exploit Mitigation and Activity Monitoring exclusion in a separate device policy. Remove or disable that policy after capture and verify protection again.

Pilot and acceptance

After a change, verify the effective policy, health and compliance, new events, business workflows, performance, browser behaviour and availability of Threat Graph and Event Journal data on pilot devices.

Only then expand the target group in stages. When problems arise, isolate the last change instead of resetting the whole policy to an unsafe state.

Use only test methods approved by your organisation. At minimum, acceptance means Sophos Fusion shows the expected policy on the pilot device, the endpoint remains healthy and reachable, and relevant events and business workflows behave as documented. This policy check does not replace the separate scan workflow or an incident-response runbook.

Frequently asked questions