In short: Sophos CryptoGuard is the anti-ransomware technology in Sophos Intercept X (now Sophos Endpoint). It watches for files being maliciously encrypted, stops the process responsible, including remote encryption over network shares, and automatically restores the affected files. Master boot record protection, Adaptive Attack Protection and Critical Attack Warning add further layers.
How does Sophos stop ransomware?
Sophos does not rely on any single technique. Ransomware attacks have several stages, and Sophos Endpoint has a defence at each:
| Attack stage | Sophos defence |
|---|---|
| Initial access: a malicious attachment, download or exploit | Web protection, deep learning malware prevention and exploit prevention |
| Hands-on attacker: credential theft, privilege escalation, disabling security | Behavioural protection, tamper protection and Adaptive Attack Protection |
| Spread across the network | Critical Attack Warning, and device isolation with Sophos Firewall |
| Encryption of files, locally or over network shares | CryptoGuard |
| Making the machine unbootable | Master boot record protection (Windows) |
CryptoGuard is the last line: it is what saves your files if everything earlier has been bypassed, or if the encryption is launched from a machine Sophos is not running on.
How CryptoGuard works
Most security tools try to recognise ransomware by what it is. CryptoGuard looks at what it does. It monitors the contents of files as they are written, looking for the signs of malicious encryption, rather than depending on a signature for a particular ransomware family. That is why it can stop new and unknown strains.
When it detects malicious encryption, CryptoGuard:
- Blocks the process responsible for the encryption.
- Rolls the affected files back to their original, unencrypted state, automatically.
- Raises a detection in Sophos Fusion (formerly Sophos Central), with a root cause analysis threat graph showing where the attack came from.
Because the rollback is automatic, users and IT staff do not have to restore encrypted folders by hand once the attack has been stopped. Backups are still essential, as explained below.
Remote ransomware and network shares
Many modern ransomware attacks do not run the encryption on the machine holding the files. The attacker uses one compromised, often unprotected, computer to encrypt files on a file server or another device over the network. Antivirus on the file server sees nothing unusual running locally, because the malicious process is somewhere else.
CryptoGuard is built to handle this. On Windows it protects files whether the encryption process runs on the protected computer itself or on a compromised device connected over the network, blocking the remote encryption and restoring the files. This is one of the strongest reasons to put Sophos on file servers and other shared storage, covered by Intercept X for Server. Sophos's tech specs list remote ransomware protection as a Windows feature; CryptoGuard file protection itself is available on Windows and macOS.
Master boot record protection
Some ransomware and "wiper" malware goes after the disk rather than individual files, overwriting the master boot record so the computer cannot start at all. On Windows, Sophos includes master boot record protection, designed to stop ransomware from leaving machines unbootable. In the threat protection policy, the ransomware settings, including protection against remotely run ransomware and master boot record attacks, should stay switched on; we check them as part of every Sophos health check.
Adaptive Attack Protection and Critical Attack Warning
Two newer features work around CryptoGuard by catching the human attacker earlier:
- Adaptive Attack Protection watches for combinations of behaviour and the use of known attack toolkits that suggest a person is actively attacking a device. When it sees them, it switches that device to a more aggressive protection stance, blocking actions that would normally be allowed, to disrupt the attacker before they reach the encryption stage. With Sophos EDR and above, admins can also turn it on manually.
- Critical Attack Warning looks across the whole estate. When adversary activity is detected on several endpoints or servers, it alerts every administrator in Sophos Fusion with details of the attack, so a ransomware operation building up quietly over a weekend is noticed.
Both are included in every Sophos Endpoint tier. A warning is only useful if someone acts on it, which is why many organisations pair them with Sophos MDR, where Sophos's analysts respond 24/7.
CryptoGuard is not a substitute for backups
CryptoGuard is very good at what it does, but no single control stops every attack. Ransomware groups also steal data before encrypting it, and some attacks target backups, cloud services or hypervisors directly. Follow the NCSC's ransomware guidance and keep offline or immutable backups that you test, such as cloud backup, alongside endpoint protection. If you are under attack now, see Sophos Emergency Incident Response and contact us straight away.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Sophos CryptoGuard?
CryptoGuard is the anti-ransomware technology in Sophos Intercept X, now sold as Sophos Endpoint. It detects malicious encryption of files, blocks the process responsible and automatically restores the affected files.
Does CryptoGuard work on network shares?
Yes, on Windows. CryptoGuard can block encryption launched from a compromised remote computer against files on a protected machine, such as a file server, and roll those files back.
Is CryptoGuard included in every Sophos licence?
Yes. CryptoGuard and automatic ransomware rollback are part of the core prevention in every Sophos Endpoint tier, from Sophos Endpoint to Sophos MDR Plus, and in Sophos Endpoint 100.
Can ransomware get past Sophos?
No product can promise to stop every attack. Sophos layers exploit prevention, behavioural protection, Adaptive Attack Protection and CryptoGuard, but attackers who gain admin access can try to disable defences, which is why tamper protection, MFA, 24/7 monitoring and tested backups all matter.