Sophos, a global leader in innovative security solutions, today announced its best-ever results in the MITRE ATT&CK Enterprise 2025 Evaluation, validating the strength of its Extended Detection and Response (XDR) platform.
Sophos XDR successfully detected 100% of adversary behaviors (sub-steps) across two complex, real-world attack scenarios, setting a new benchmark for visibility and detection fidelity.
The evaluation emulated the tactics of two distinct threat actors:
- Scattered Spider (tracked by Sophos X-Ops as GOLD HARVEST), a financially motivated cybercriminal collective.
- Mustang Panda (tracked by Sophos X-Ops as BRONZE PRESIDENT), a People’s Republic of China (PRC) espionage group.
The scenarios involved activity across Windows, Linux, and AWS cloud environments, showcasing the platform’s multi-platform capability.
Key Performance Highlights
Sophos achieved the highest-possible “Technique”-level rating for 86 out of 90 total sub-steps in the evaluation. This rating signifies high-fidelity detections that provide rich context on the execution, impact, and behavior of the adversary, delivering clear insights into the who, what, when, where, how, and why of an attack.
“Scattered Spider and Mustang Panda represent distinct threat profiles that challenge defenders in very different ways,” said Simon Reed, Chief Research and Scientific Officer, Sophos. “Achieving full detection coverage against both validates the accuracy and depth of Sophos’ analytics and demonstrates how the company’s AI-native XDR platform converts complex telemetry into clear, actionable intelligence.”
The Power of Sophos XDR
Sophos’ consistently strong performance in these rigorous evaluations underscores the precision of its threat detection and response capabilities. The company attributes its success to continuous investment and the sheer scale of real-world insights it leverages.
Every day, Sophos processes 223+ terabytes of telemetry in Sophos Central, generating 34+ million detections and automatically blocking 11+ million threats. This ensures that Sophos’ detections are continuously tested and improved to deliver stronger security outcomes for organizations worldwide.
Understanding the Adversaries
GOLD HARVEST (Scattered Spider): This loosely affiliated cybercriminal collective is financially motivated and uses sophisticated social engineering to compromise even well-defended organizations across the U.K. and U.S.
BRONZE PRESIDENT (Mustang Panda): This long-running PRC espionage group conducts intelligence-led operations aligned with the priorities of China’s Ministry of State Security. They remain one of the most active and persistent state-aligned threat actors operating today.