Sophos, a global leader in next-generation cybersecurity, announced that it has acquired Refactr
Refactr develops and markets a versatile DevSecOps automation platform that bridges the gap between DevOps and cybersecurity. Sophos is optimising Refactr’s DevSecOps automation platform to add Security Orchestration Automation and Response (SOAR) capabilities to its Managed Threat Response (MTR) and Extended Detection and Response (XDR) solutions.
As DevOps and security teams continue to adopt “IT-as-Code” approaches to managing their environments, Refactr’s ability to automate any of these processes enables teams to scale. For example, with Refactr’s platform, DevOps teams can augment existing continuous integration, continuous delivery and continuous deployment (CI/CD) workflows, and cybersecurity teams can leverage the platform’s visual drag and drop builder. Refactr has leading customers in both the private and government/public sectors, including the Center for Internet Security and the U.S. Air Force’s Platform One.
“First-generation SOAR solutions have moved our industry forward in significant ways, but we’re now witnessing an evolution where more and more businesses are becoming software companies, and our security solutions need to evolve in parallel. As we’ve seen in recent supply-chain incidents, attackers are increasingly targeting software development pipelines, and defenders need the ability to shift further left of attackers. The industry needs SOAR to mature into more capable and generalizable DevSecOps solutions, and Sophos’ acquisition of Refactr will help us lead the way,” said Joe Levy, chief technology officer, Sophos.
Sophos’ Active Adversary Playbook 2021 has identified clear correlations among the top five tools used by adversaries that IT administrators and security professionals use in their everyday tasks. The report also revealed that 37 attack groups used more than 400 different tools between them. The median attacker dwell time before detection was 11 days, providing attackers with up to 264 hours for malicious activity, from lateral movement, reconnaissance, credential dumping, data exfiltration, and more. Early detection and response through automation can help minimize these statistics and improve security against attackers who are constantly looking for new ways to gain entry and a foothold.
