Hi everyone! I've been lurking here for a while, learning a ton from the discussions. I work mostly with data pipelines (BigQuery, Airflow), but my team's security lead is pushing for a rollout of Sophos Intercept X on all our dev and analytics servers.
Here's my concern: a lot of our data processing VMs already have a lightweight endpoint agent from our cloud provider (like the GCP Operations Agent for monitoring). We also have some older systems with a different, legacy AV that hasn't been removed yet.
I'm really worried about conflicts or performance hits, especially during heavy data loads. From a pipeline perspective, if an endpoint agent starts scanning a file that's actively being written by a Spark job or an ETL process... that sounds like a recipe for latency or even failures.
Has anyone been in this situation? Specifically:
- Running Intercept X alongside another monitoring or cloud agent?
- Any noticeable impact on database servers or during large file operations?
- Did you have to set up exclusions for data directories (like our `/data/` or staging folders), and how did you manage that at scale?
I'm trying to gather some real-world feedback before I bring this up in our next infra meeting. The security team says it's fine, but I've seen "fine" things break in subtle ways that only show up under load 😅. Any stories or advice would be super helpful!