At Black Hat USA 2025 in Las Vegas, security companies Sophos and Halcyon announced a partnership aimed squarely at ransomware. They agreed to share threat intelligence in real time and to have their products protect each other from being switched off by attackers. Here is what was actually announced, how anti ransomware tools work, and what small businesses and home users should do right now.
What Sophos and Halcyon announced
The two companies described the deal as a strategic threat intelligence sharing partnership with two main parts.
- Intelligence sharing: the companies exchange data from active ransomware campaigns, including indicators of compromise, attacker behaviors and the tools criminals use. Sophos said its research team would work directly with Halcyon’s researchers and engineers.
- Mutual anti tamper protection: on networks running both products, each platform watches and protects the other’s software agents, so ransomware operators have a harder time disabling security tools before they encrypt files.
According to the announcement, the shared data feeds detection models and speeds up protection updates in Sophos Central, Sophos Endpoint, its managed detection and response service, and Halcyon’s Anti Ransomware Platform. Sophos research chief Simon Reed framed it around speed, saying timely intelligence lets defenders act quickly. Neither company published pricing or a rollout schedule, because the partnership mainly improves products their business customers already use.
Why attackers try to kill your security software first
The anti tamper part of the deal targets a real pattern. Modern ransomware gangs rarely just drop a file and hope. They break in, often with stolen passwords or through unpatched remote access tools, look around quietly, steal data, and then try to disable endpoint protection and delete backups before launching encryption. If the security agent is gone, nothing stands between the attacker and your files.
Having two independent products watch each other means an attacker has to defeat both at once, which raises the cost of the attack. It is the same idea as layered physical security: one lock can be picked, two different locks take longer.
How anti ransomware tools actually work
Ransomware protection is not a single feature. Good products combine several techniques:
Flags programs that suddenly rename, rewrite or encrypt many files in a short time.
Some tools, such as the CryptoGuard feature in Sophos Intercept X, can restore files that were encrypted before the attack was stopped.
Known bad files, domains and techniques are blocked based on data from other victims.
Prevents malware or an intruder from uninstalling or disabling the security agent.
Intelligence sharing deals like this one mainly strengthen the third box. The more real attacks a vendor sees, the faster it can recognize the next one.
Practical ransomware protection for small businesses
You do not need an enterprise budget to make yourself a much harder target. Federal guidance from CISA, the US Cybersecurity and Infrastructure Security Agency, focuses on the same basics again and again:
- Keep offline backups. Follow the 3, 2, 1 approach: three copies, on two kinds of storage, with one copy offline or immutable so ransomware cannot reach it. Test a restore at least a few times a year.
- Turn on multifactor authentication for email, remote access, VPNs, cloud admin accounts and your backup system.
- Patch quickly, especially firewalls, VPN appliances and remote desktop tools that face the internet.
- Use a business grade endpoint product with behavior detection and tamper protection enabled, and make sure alerts actually reach someone.
- Limit admin rights. Staff should not use administrator accounts for everyday work.
- Write a short incident plan with who to call, how to isolate machines and where backups live.
Protection for home users
Consumers are targeted less often than businesses, but the same habits apply on a smaller scale. Keep your operating system and browser updated, use a password manager, turn on multifactor authentication for your email and cloud accounts, and keep a backup on an external drive that you disconnect after each backup. Cloud storage with version history, such as OneDrive or iCloud, can also help you roll files back to an earlier version after an attack.
If you are hit, disconnect the affected device from the network, do not delete anything, and report the incident to the FBI through its Internet Crime Complaint Center at ic3.gov. The FBI does not encourage paying a ransom, because payment does not guarantee you will get your files back and it funds further attacks.
FAQ
What did Halcyon and Sophos announce at Black Hat USA 2025?
A partnership to share ransomware threat intelligence in real time and to add mutual anti tamper protection, so each company’s product protects the other’s agent from being disabled.
Do I need both products to benefit?
No. Shared intelligence improves detection in each company’s own products. The mutual anti tamper protection applies only where both are installed together.
Is regular antivirus enough to stop ransomware?
Not on its own. Antivirus helps, but offline backups, multifactor authentication and fast patching are what keep a successful break in from turning into a disaster.
Should I pay a ransom?
Federal agencies advise against it. Report the attack to the FBI and rely on your backups wherever possible.
The verdict
The Sophos and Halcyon deal is a sensible step: security vendors sharing data and covering each other’s blind spots makes attacks harder and more expensive. But no partnership replaces the basics. Offline backups, multifactor authentication, quick patching and a protected endpoint remain the best ransomware defense for any business or household in 2026.
Updated October 2026: rewritten to explain the Sophos and Halcyon partnership, how anti ransomware tools work and current ransomware protection steps.
Featured photo: Michael Geiger on Unsplash.
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
