Sophos XDR Sets New Benchmark in MITRE ATT&CK Enterprise 2025 Evaluation

Sophos XDR Demonstrates Exceptional Detection Capabilities

Sophos XDR has demonstrated remarkable performance in detecting adversary behaviors across two complex attack scenarios. The evaluation covered the Scattered Spider, tracked by Sophos X-Ops as GOLD HARVEST, a financially motivated cybercriminal collective, and Mustang Panda, tracked as BRONZE PRESIDENT, an espionage group linked to the People’s Republic of China (PRC).

The Scattered Spider scenario involved activities across Windows, Linux, and AWS cloud environments, while the Mustang Panda scenario focused solely on Windows systems. This comprehensive approach allowed for a thorough assessment of Sophos XDR's capabilities.

Key Achievements in the Evaluation

Sophos achieved 100% detection coverage for all 90 sub-steps of adversary behaviors across these scenarios. This is a significant milestone, showcasing the platform's ability to identify and respond to threats effectively. Additionally, Sophos earned the highest possible "Technique"-level rating for 86 out of 90 sub-steps, highlighting its deep visibility and actionable detections.

In the Scattered Spider scenario, which involved identity abuse, cloud exploitation, and data exfiltration, Sophos received the highest possible ratings for 61 out of 62 sub-steps. This demonstrates the platform's effectiveness in identifying and mitigating sophisticated threats.

Expert Insights on Sophos' Performance

Simon Reed, chief research and scientific officer at Sophos, commented on the results: "Scattered Spider and Mustang Panda represent distinct threat profiles that challenge defenders in very different ways. Achieving full detection coverage against both validates the accuracy and depth of Sophos’ analytics and demonstrates how the company’s AI-native XDR platform converts complex telemetry into clear, actionable intelligence."

He added, "Sophos’ consistently strong performance in these rigorous evaluations underscores the power and precision of our threat detection and response capabilities. Our commitment to stopping the world’s most sophisticated cyberthreats remains unwavering."

Over the past five years, Sophos has invested heavily in strengthening its platform, resulting in improved performance year after year. This investment has translated into stronger outcomes for customers, both in evaluations and in real-world security scenarios.

Processing Massive Amounts of Data

Every day, Sophos processes 223+ terabytes of telemetry in Sophos Central, generating 34+ million detections and automatically blocking 11+ million threats. This scale of customer insights ensures that Sophos' detections are continuously tested and refined, providing ongoing protection for organizations worldwide.

Understanding the Threat Actors

Sophos X-Ops has been tracking GOLD HARVEST (Scattered Spider) since 2022. This loosely affiliated cybercriminal collective operates with financial motives and a desire to elevate their reputation on underground forums. Despite several arrests, operators continue to launch high-profile attacks across the U.K. and U.S., sometimes partnering with major Russian-speaking ransomware groups.

Their sophisticated social engineering capabilities allow them to compromise even well-defended organizations, emphasizing the need for strong behavioral detections in modern security operations.

In parallel, Sophos X-Ops has monitored BRONZE PRESIDENT (Mustang Panda) for many years. This long-running PRC espionage group conducts intelligence-led operations aligned with priorities of China’s Ministry of State Security. Recent activities include targeting Tibetan communities surrounding the Dalai Lama’s 90th birthday and intrusions on Thai government and military offices during periods of heightened regional tension.

BRONZE PRESIDENT remains one of the most active and persistent state-aligned threat actors operating today.

MITRE ATT&CK Evaluations: A Rigorous Test

MITRE ATT&CK Evaluations are among the world’s most rigorous independent security tests. They emulate the tactics, techniques, and procedures (TTPs) used by real-world adversaries to assess each participating vendor’s ability to detect, analyze, and articulate threats in alignment with the MITRE ATT&CK Framework.

This was the seventh round of MITRE’s “Enterprise” ATT&CK Evaluation, a product-focused assessment designed to help organizations understand how security operations solutions like Sophos EDR and Sophos XDR can defend against sophisticated, multi-stage attacks.

When evaluating EDR or XDR solutions, Sophos recommends reviewing MITRE ATT&CK Evaluations alongside other independent proof points.