Sophos Acquires Braintrace – Global Security Mag Online

Sophos announced that it has acquired Braintrace, further enhancing Sophos’ Adaptive Cybersecurity Ecosystem with Braintrace’s proprietary Network Detection and Response (NDR) technology. Braintrace’s NDR provides deep visibility into network traffic patterns, including encrypted traffic, without the need for Man-in-the-Middle (MitM) decryption. Located in Salt Lake City, Utah, Braintrace launched in 2016 and is privately held.

As part of the acquisition, Braintrace’s developers, data scientists and security analysts have joined Sophos’ global Managed Threat Response (MTR) and Rapid Response teams. Sophos’ MTR and Rapid Response services business has expanded rapidly, establishing Sophos as one of the largest and fastest-growing MDR providers in the world, with more than 5,000 active customers.

Braintrace’s NDR technology will support Sophos’ MTR and Rapid Response analysts and Extended Detection and Response (XDR) customers through integration into the Adaptive Cybersecurity Ecosystem, which underpins all Sophos products and services. The Braintrace technology will also serve as the launchpad to collect and forward third-party event data from firewalls, proxies, virtual private networks (VPNs), and other sources. These additional layers of visibility and event ingestion will significantly improve threat detection, threat hunting and response to suspicious activity.

Sophos will deploy Braintrace’s NDR technology as a virtual machine, fed from traditional observability points such as a Switched Port Analyzer (SPAN) port or a network Test Access Point (TAP) to inspect both north-south traffic at boundaries or east-west traffic within networks. These deployments help discover threats inside any type of network, including those that remain encrypted, serving as a complement to the decryption capabilities of Sophos Firewall. The technology’s packet and flow engine feeds a variety of machine learning models trained to detect suspicious or malicious network patterns, such as connections to Command and Control (C2) servers, lateral movement and communications with suspicious domains. Since Braintrace built its NDR technology specifically for predictive, passive monitoring, its engine also provides intelligent network packet capture that IT security administrators and threat hunters can use as supporting evidence during investigations. The novel NDR analysis and prediction technique is patent pending.

According to Gartner, “compared with traditional approaches, where malicious behavior is defined ahead of time in the form of prebuilt signatures and detection engines inspecting traffic looking for matches, NDR takes a different approach. Instead of only inspecting traffic against a list of known bad payloads or behaviors, NDR also focuses on looking for unknown patterns in the network traffic, calculating a probability as to whether that anomaly is malicious.” Gartner further notes that, “the machine learning algorithms that are at the core of many NDR products help to detect anomalous traffic that is often missed by other detection techniques. The optional automated response capabilities help to offload some of the workload for incident responders. The threat hunting functionality provides valuable tools for incident responders.”

Braintrace’s NDR technology is a key component for defending against cyberattacks today and in the future. Sophos research demonstrates how adversaries aggressively and constantly change tactics to evade detection and execute their attacks. Braintrace’s technology helps uncover malicious C2 traffic from malware, such as ColbaltStrike, BazaLoader and TrickBot, as well as zero-days, that could lead to ransomware and other attacks. This visibility allows threat hunters and analysts to pre-empt any potential ransomware attack, including recent strikes by REvil and DarkSide.

Sophos plans to introduce Braintrace’s NDR technology for MTR and XDR in the first half of 2022.

Braintrace is a sole-source security provider specializing in the development of customized, cutting-edge solutions for its clients with its Network Detection and Response (NDR) technology. In addition to providing Extended Detection and Response (XDR) and IT services, Braintrace has vast experience in advising customers in broad areas of security-related business risks, including government compliance and regulatory issues. With this knowledge, Braintrace is positioned to provide unique expertise and technology to help businesses in any industry remain safe.