Containment with safeguards your team sets.

Helm watches your files and acts on the rules you set. When it detects ransomware, it can have Sophos Central isolate the endpoints involved, with safeguards that keep the response in proportion to the attack.

Remote encryption is a common ransomware technique, where the attack runs on one device and encrypts files somewhere else. Helm doesn’t need to be on the device that started it. It sees the encryption where the data lives, detects it in under a second and contains the attack on rules your team can read.

Sophos Endpoint, managed through Sophos Central, combines anti-ransomware, exploit prevention and behavioural detection, with EDR in Sophos XDR. Its CryptoGuard technology also watches for remote encryption and can block the device behind it and roll files back, on machines running Sophos Endpoint. Helm covers the data, including storage where no agent runs. Sophos protects the devices it runs on.

When Helm contains an attack, it can find the endpoints involved in Sophos Central, by user name or host name, and have Sophos isolate them through its own API. Built-in safeguards keep the action precise. Protected accounts are left alone, and each run is capped at ten devices, so a single alert cannot take your estate offline.

Every action is recorded in the Helm incident, and endpoints are reconnected once they are confirmed clean.

Helm adds the data layer and acts on the rules you set, while Sophos carries out the isolation on each endpoint. If parts of your estate run another endpoint tool, see how Helm works with Microsoft Defender and CrowdStrike.

See all integrations, or talk to us about adding Helm to your Sophos environment.