Security Testing

Penetration testing engagements

While we aim to identify and prevent security bugs in our software development pipeline, no system is perfect. That’s why we also run regular security assessments on our products. These assessments are typically performed in a white box scenario with access to architecture details and source code. Our approach results in more efficient and effective testing when compared to a black box scenario where little information about the product is provided.

For our recent assessments, we have started collecting and publishing letters of attestation. For the older assessments, we are happy to share details upon request. We aim to collect letters for subsequent/future tests as they are completed.

Assessment letters of attestation

Tabletop exercises

At Sophos, we believe that it’s very important to test our capabilities regularly. We do this by developing tabletop scenarios with input from experts across the business and our risk management team.

The chart below details some of the recent tabletop scenarios we have run.

Recent tabletop scenarios

SecurityScorecard vendor risk management

IT vendor risk management (VRM) solutions support enterprises that assess, monitor, and manage risks associated with using third-party IT products, services, and vendors that can access their data. There are many IT VRM solutions available, all of which vary in their ability to accurately identify a vendor’s assets and the potential risks associated with those assets.

Sophos engages with SecurityScorecard and its VRM platform to support customers who use IT VRM tools as part of their procurement process. To see our current rating, visit  https://securityscorecard.com/security-rating/sophos.com.