IT Security Conference 2025 | Chester Wisniewski | Sophos
summary
Sophos reports its MDR protects more than 35,000 companies, ingesting about 223 TB of telemetry per day and producing ~34 million detections, with ~1,100 alerts a day escalated to hunts; trend: infections start with identity stealers (passwords, session/API tokens) rather than immediate ransomware. Replacing the internal level‑1 SOC with MDR cuts average incident resolution from 3.5 hours to 38 minutes, enabling faster containment and lower breach costs.
AI-written summary · about
chapters (8)
- 0:00Introduction and background
- 1:48Risk management over technical focus
- 4:16Time to detect and respond importance
- 6:45MDR service adoption at Sophos
- 8:50Impact of MDR on incident resolution
- 10:35Open platform and business context
- 11:59Defense in depth of people and response
- 13:03Call to action for proactive security
related talks
14mBehind the scenes w/ SentinelOne’s MDR: Detecting cloud ransomware
28mScaling Your Defenses: Next Level Security Automation for Enterprise
47mIs Increasing Security Maturity And Decreasing Operational Load Possible?
20mSIEM There, Done That: Rising Up in the SecOps Revolution
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce
44mEXPOSURE: The 5th Annual RSAC SOC Report
37mTake Down Cyberthreat Dwell Time With Kaspersky Optimum Security
01h 27mSecuring at Scale Building Resilient Defences for a Growing Digital World