Quartus did not start

I should also ask - is anyone is running CyberArk in addition to Sophos?

Updated the Sophos endpoint to version FTS 2025.2.3.32.2-MR5 (This per our IT dept, I don't know exactly which products we're running). QuartusPro now runs OK, but we're still having an issue with some of the utilities such as quartus_sign.exe.  We still have an open ticket with Sophos.

For us it is currently resolved with a workaround of updating Sophos to 

• 2025.2.3.32.2-MR5 core
• 2025.2.3.9.3-MR5 intercept

and also adding exclusions to the Quartus bin64 executables folder. Specifically:

• Add a Process Exclusion
• Add a File/Folder Exclusion
• Add an Exploit Mitigation Exclusion for the process and path

The form of the exception entry is also sensitive, and works with (for example) 

D:\intelFPGA_pro\24.1\quartus\bin64\*.exe but not D:\intelFPGA_pro\24.1\quartus\bin64\* 

Sophos has not said whether the exceptions are permanent or whether they will work to resolve the underlying false detections related to Quartus.

Different engineers in our group have different versions of Quartus installed. One of them has also successfully tested Pro version 25.3 after explicit Sophos exclusions were added. We have not had any issues with Quartus Prime or Lite. I will update the solution post above if I find that additional steps were needed beyond what's listed there.  Note that the exclusion is drive specific - if one user has installed on C:\ and another on D:\ that requires two explicit exclusions.

Below is a part of our discussion with Sophos - adding exclusions seems to be their position on cases like this.

• Sophos continuously improves its detection capabilities to enhance protection against new and emerging threats. As part of these updates, detection logic may be strengthened or newly introduced. This can sometimes result in legitimate applications being flagged if their behavior matches known exploit techniques.
• Additionally, if the application (such as Altera Quartus Prime Pro) performs actions that resemble exploit techniques or if certain components of the application are considered vulnerable, Sophos may begin monitoring or blocking those behaviors.
• Some legitimate applications perform low-level operations (e.g., DLL loading behavior, memory manipulation, command execution, or dynamic code execution) that are similar to techniques used by malware.
• In such cases, Sophos detects the behavior as a potential exploit, which may use advanced system-level operations as part of its normal functionality, even if the application itself is trusted. When you add an exploit or process exclusion Sophos stops monitoring or blocking those specific behaviors for that application. This prevents the Sophos endpoint agent from triggering alerts or blocking execution.