In a bid to provides visibility into suspicious network traffic patterns, Sophos, a next-generation cybersecurity firm has announced the acquisition of Braintrace to further enhance Sophos’ Adaptive Cybersecurity Ecosystem with Braintrace’s proprietary Network Detection and Response (NDR) technology.
The decision to acquire Braintrace is based on the company’s NDR, which provides deep visibility into network traffic patterns, including encrypted traffic, without the need for Man-in-the-Middle (MitM) decryption.
“You can’t protect what you don’t know is there, and businesses of all sizes often miscalculate their assets and attack surfaces, both on-premises and in the cloud. Attackers take advantage of this, often going after weakly protected assets as a means of initial access. Defenders benefit from an ‘air traffic control system’ that sees all network activity, reveals unknown and unprotected assets, and exposes evasive malware more reliably than Intrusion Protection Systems (IPS),” comments Joe Levy, chief technology officer, Sophos.
He said Sophos is excited as Braintrace built this technology specifically to provide better security outcomes to their Managed Detection and Response (MDR) customers, stressing that it’s hard to beat the effectiveness of solutions built by teams of skilled practitioners and developers to solve real-world cybersecurity problems.
As part of the acquisition, Braintrace’s developers, data scientists and security analysts have joined Sophos’ global Managed Threat Response (MTR) and Rapid Response teams. Sophos’ MTR and Rapid Response services business has expanded rapidly, establishing Sophos as one of the largest and fastest-growing MDR providers in the world, with more than 5,000 active customers.
Braintrace’s NDR technology will support Sophos’ MTR and Rapid Response analysts and Extended Detection and Response (XDR) customers through integration into the Adaptive Cybersecurity Ecosystem, which underpins all Sophos products and services. The Braintrace technology will also serve as the launchpad to collect and forward third-party event data from firewalls, proxies, virtual private networks (VPNs), and other sources.
Sophos will deploy Braintrace’s NDR technology as a virtual machine, fed from traditional observability points such as a Switched Port Analyzer (SPAN) port or a network Test Access Point (TAP) to inspect both north-south traffic at boundaries or east-west traffic within networks.
These deployments help discover threats inside any type of network, including those that remain encrypted, serving as a complement to the decryption capabilities of Sophos Firewall.
The technology’s packet and flow engine feed a variety of machine learning models trained to detect suspicious or malicious network patterns, such as connections to Command and Control (C2) servers, lateral movement and communications with suspicious domains.
Since Braintrace built its NDR technology specifically for predictive, passive monitoring, its engine also provides intelligent network packet capture that IT security administrators and threat hunters can use as supporting evidence during investigations. The novel NDR analysis and prediction technique is patent pending.
Sophos plans to introduce Braintrace’s NDR technology for MTR and XDR in the first half of 2022.