I am changing Symantec AV for Sophos Intercept X, and I used to control the AV definitions/signatures. But now with Sophos I have found that we can control Sophos updates, but I wonder if it also includes the update of AV definitions, please could you clarify it?. Can I just control update AV definitions?
TIA,
Jaime L
Hello Jaime L,
in the past we had a situation
who hadn't 
.
Understandable, but it's not the best idea considering actual probabilities, possible kinds of "corruption" and whether your approach can detect all of them in time (well, you could just wait if other users encounter problems, you don't have to endanger your devices), and last but not least what difference a few hours can make in case of a malware campaign. Sure, there's Live Protection so a little updating latency is not as bad - but also are timely updates not as moot as one might think. The latter provide a "baseline" for Live Protection.
it is not possible
AFAIK - no. It never was, IIRC, all you could do (in the on-premise product) was stretching the interval between updates to a maximum of 1440 minutes. This feature has been withdrawn with Central/Intercept x (and for a reason, I assume). Botched definitions that cause big problems are very rare, veeeery veeeery rare. Late or missed updates have much more adverse potential.
Christian
