Sophos Interceptx - Worth it?

[petben]

Hello, has anyone got any good/bad/warnings to say about Sophos Interceptx (their Ransomware protection add-on) Our 3 year Endpoint license is up for renewal:

 

£3.45 - Sophos Endpoint\device\3 years

£5.45 - Sophos Interceptx addon\device\3 years

 

so it isn't hugely expensive, but of course an extra cost.

 

Any opinions on it's relevance and worth?

 

Thanks

[Ex-MGSTech]

I'll most likely be renewing ours in December

[howartp]

Sophos Interceptx - Worth it?

If you get hit by something it intercepts, or get hit by something after you had cancelled the renewal... absolutely!

[network41]

Have had it a while now , currently on a 3 year subscription. Will be renewing again.

[Jaan]

Have had it a while now , currently on a 3 year subscription. Will be renewing again.

 

same here..... we've had it 4 years now.

[Wave9_Lee]

Hello, has anyone got any good/bad/warnings to say about Sophos Interceptx (their Ransomware protection add-on) Our 3 year Endpoint license is up for renewal:

 

£3.45 - Sophos Endpoint\device\3 years

£5.45 - Sophos Interceptx addon\device\3 years

 

so it isn't hugely expensive, but of course an extra cost.

 

Any opinions on it's relevance and worth?

 

Thanks

 

We offer annual charging for a 3 year licence, which takes the sting out of it.

 

I'm biased, but do think it's worth it. Ransomware can have a massive impact both from a cost and dowtime perspective.

[petben]

Ok, so we bought the interceptx add on, some new settings have appeared in the policies, can anyone advise on possible problems when enabling the new settings? What do you recommend enabling from default settings server policy screenshot.

 

Thanks

[Wave9_Lee]

[ATTACH=CONFIG]59588[/ATTACH]Ok, so we bought the interceptx add on, some new settings have appeared in the policies, can anyone advise on possible problems when enabling the new settings? What do you recommend enabling from default settings server policy screenshot.

 

Thanks

 

Turn all the features on,

 

 

[Edu-IT]

Hello, has anyone got any good/bad/warnings to say about Sophos Interceptx (their Ransomware protection add-on) Our 3 year Endpoint license is up for renewal:

 

£3.45 - Sophos Endpoint\device\3 years

£5.45 - Sophos Interceptx addon\device\3 years

 

so it isn't hugely expensive, but of course an extra cost.

 

Any opinions on it's relevance and worth?

 

Thanks

Where is that pricing from? Seems cheap!

[Steve21]

Where is that pricing from? Seems cheap!

 

It's under a Grid scheme normally, like we have the SWGfL Phoenix one:

https://www.phoenixs.co.uk/swgfl-sophos/

 

Steve

[Koldov]

For anyone that has it currently and will be renewing it...

 

I can obviously see the benefit in an extra layer of security, but can you quantify it?

 

Does it give you any stats, or are you just presuming it is doing its job?

[Primus]

For anyone that has it currently and will be renewing it...

 

I can obviously see the benefit in an extra layer of security, but can you quantify it?

 

Does it give you any stats, or are you just presuming it is doing its job?

 

This is my thing - I've been looking at CrowdStrike but the same nagging doubt in my head - we've (touch wood) had no issues so far running Defender and managing it using SCCM.

[petben]

Following on from my settings Q..

 

Can anyone say what their Real Time scanning settings are for servers and workstations? Do you have just Local only enabled for both? I def. don't want to be scanning things twice. Historically we have disabled Real-time scanning on our servers, but maybe that's not recommended.

 

Thanks

[Wave9_Lee]

Following on from my settings Q..

 

Can anyone say what their Real Time scanning settings are for servers and workstations? Do you have just Local only enabled for both? I def. don't want to be scanning things twice. Historically we have disabled Real-time scanning on our servers, but maybe that's not recommended.

 

Thanks

Hi Petben,

 

If you ping me a PM with your contact details I can get someone to help you set this up.

 

cheers

[ArtemisLion]

It's hard to prove a negative but for laptops and desktop devices it seems great.

 

The server version on the other hand has been a pita. It uses a lot of CPU and disk time and setting up all the exclusions is harder than the sales rep made out.

 

Still if it stops one ransom ware attack it'll be worth it.

 

(Just like my tiger repellant amulet I spent all that money on)

[petben]

what exclusions do you setup?

Thanks

[Jamman960]

I seem to remember there being exclusion templates available within Sophos Central depending upon what services the server runs etc

[network41]

What @Jamman960 said , if I remember correctly when we installed it on to say, a SQL server , it added the exemptions automatically using the built in templates.

[ArtemisLion]

Specifically for SQL databases and some avigilon locations.

 

InterceptX mostly detects your sql databases and excludes them but it missed some. Probably because our sims server has a bunch of different databases on different versions of management studio.