Intercept X releasing any new updates for Wannacry ransomware

Umm......

if you look here:

https://community.sophos.com/kb/en-us/126733

I think Intercept X would have stopped it but Sophos AV & Endpoint wouldn't have until the updates were applied. To be fair, Sophos did come out with the update fairly quickly for the AV & endpoint.

I also think there will be a flood of variants coming out very quickly with this as the scale of unpatched systems have been revealed and time is of the essence for these hackers/script kiddies to make the most of it before the windows (parden the pun) close.

The spread has been mitigated for now but the new variant will probably not succumb to such an easy halting of it.
Problem is, with a new variant, AV's etc have to wait for new signatures/definitions to catch it whereas an intercept X product can catch it via its behavior without specific definitions.

This is why our company will be investing in the endpoint exploitation plugin. It's something we were considering doing anyway but this episode has just brought it forward. Problem is, it's not cheap and I'm not sure of the cost for single/home users. Ultimately, I think AV vendors will just have to include it in their product as standard but that will be a little bit away I think and will only come into effect when one vendor releases a system that can and people start to jump ship.

Umm......

if you look here:

https://community.sophos.com/kb/en-us/126733

I think Intercept X would have stopped it but Sophos AV & Endpoint wouldn't have until the updates were applied. To be fair, Sophos did come out with the update fairly quickly for the AV & endpoint.

I also think there will be a flood of variants coming out very quickly with this as the scale of unpatched systems have been revealed and time is of the essence for these hackers/script kiddies to make the most of it before the windows (parden the pun) close.

The spread has been mitigated for now but the new variant will probably not succumb to such an easy halting of it.
Problem is, with a new variant, AV's etc have to wait for new signatures/definitions to catch it whereas an intercept X product can catch it via its behavior without specific definitions.

This is why our company will be investing in the endpoint exploitation plugin. It's something we were considering doing anyway but this episode has just brought it forward. Problem is, it's not cheap and I'm not sure of the cost for single/home users. Ultimately, I think AV vendors will just have to include it in their product as standard but that will be a little bit away I think and will only come into effect when one vendor releases a system that can and people start to jump ship.