False negative or false positive?

Now the support agent sent me a complete answer and I understood the situation. This really isn't a Sophos false negative.

Thank you for your help Qoosh 

No problem at all. I inquired internally to get some more information on this as well. 

As I understand you're running a honeypot device, I'd suggest looking into implementing some of our email security solutions on the test environment you have as well. 

The level of email scanning that will occur from the endpoint may not go as in-depth into the attached files until those files are run on the local device. As Sophos Endpoint uses a layered approach, even if the initial check of file signatures on attachments does not catch the file, other layers such as behavioural detection from Intercept X will likely catch malicious behaviour. 

The addition of Email protection will help you replicate a real-world test scenario where our entire suite is being used.

If you require a trial of Sophos Email, you can request one for up to 30 days. This trial can also be extended up to 60 days for testing.

No problem at all. I inquired internally to get some more information on this as well. 

As I understand you're running a honeypot device, I'd suggest looking into implementing some of our email security solutions on the test environment you have as well. 

The level of email scanning that will occur from the endpoint may not go as in-depth into the attached files until those files are run on the local device. As Sophos Endpoint uses a layered approach, even if the initial check of file signatures on attachments does not catch the file, other layers such as behavioural detection from Intercept X will likely catch malicious behaviour. 

The addition of Email protection will help you replicate a real-world test scenario where our entire suite is being used.

If you require a trial of Sophos Email, you can request one for up to 30 days. This trial can also be extended up to 60 days for testing.