Sophos Cybersecurity as a Service Reviews

Sophos Cybersecurity as a Service product name is MDR, and we started using it from last year only. It has been one year now.

I use its automated threat response, which is a key feature of the service.

Sophos Cybersecurity as a Service is taking care of the complete cybersecurity, helping to mitigate potential threats by monitoring the logs and the events 24/7. Whatever events are coming, they are sharing the report over the email. Wherever they need our intervention, they give us the instructions on how to fix it. Otherwise, they take care of the complete security on their own. The MDR team takes care of all the events and every log.

It is about visibility, and the value of deep visibility into my network activities provided by Sophos Cybersecurity as a Service is significant. The reason we shortlisted the product is the reports. They keep sharing every event, every log over the email so that my team can check what the critical things are and where their intervention is required. Otherwise, Sophos Cybersecurity as a Service MDR team takes care of everything. We need not get into each and every event and check what issues are going on. Most of the events are taken care of by Sophos Cybersecurity as a Service team. Only the things which are on our part, for example, any system that needs to be patched or any OS to be upgraded, come to us. Otherwise, Sophos Cybersecurity as a Service MDR team takes care of everything.

One feature which we would like to have in the product is the inventory. For example, if I have the agent installed on each machine and server, why can't we fetch the inventory details from the console? If you look at the competition products such as CrowdStrike, they give clear visibility into what software is installed, what legitimate tools are installed, and what software is not even licensed or may not be secure to install. Those things are reported back to the concerned team, maybe the systems teams, and they can use it brilliantly. Unfortunately, Sophos Cybersecurity as a Service doesn't provide that kind of visibility into what software or tools are installed on a particular system. There is a feature which requires running what you call an XG script to fetch those kinds of details. However, it is not on the GUI as other competitor companies are providing. That is the one feature we really miss. In terms of service and support, I don't think there is an issue because it is already a brilliant five-star service support.

The visibility feature that I already mentioned is the only primary feature which we are missing. The rest is absolutely fine. I don't think there is anything else which should be there.

We started using it from last year only. It has been one year now.

Technical support by Sophos Cybersecurity as a Service is excellent, and I can grade it as a 10. I don't have one issue with the technical support.

Service support has no problems, and as a product, if you talk about it, there are a couple of features which are missing. I may deduct one and a half points, so I will give them an 8.5.

Positive

The enhanced threat hunting and forensics provided by Sophos Cybersecurity as a Service have significantly helped my organization address cyberattacks. Sophos Cybersecurity as a Service takes care of the XDR logs, and any kind of anomalies or threats which they find, they take care of it. Any policies to be updated, any IP to be blocked, or any source or domain to be blocked, they just intimate to us that these are the things we need to take care of. Most of the things are otherwise taken care of by Sophos Cybersecurity as a Service team on their part.

Most of the things are on-premise, and cloud-based operation for centralized management is not important for my organization since we are not a cloud company. We don't have any payloads on the cloud. We have a small data center where we have multiple servers and everything on-premise only. We are not using any of the cloud security, cloud vertical, or cloud features from Sophos Cybersecurity as a Service. Most of the things are on-premise only.

The metrics I use to measure the effectiveness of Sophos Cybersecurity as a Service threat intelligence capabilities are straightforward. My uptime and business continuity are very important. Since the day we started using Sophos Cybersecurity as a Service MDR, there has not been a single incident. Even before something hits us, they get alerted and they take the required measures.

We are not familiar with SophosLabs Intelix as a threat intelligence platform.

I have given Sophos Cybersecurity as a Service an overall review rating of 8.5.

Sophos Cybersecurity as a Service serves as our main solution to maintain a 24/7/365 security operations center that oversees our networks, computers, and servers, ensuring that if a breach occurs, the team will remedy it and eradicate the intruder.

A specific example of how Sophos Cybersecurity as a Service helped my team occurred three weeks ago when one of our employees clicked on a phishing link. Sophos was able to stop the employee, halt the attack, reset the user password, block all activity, and effectively counteract the situation due to their integration with M365.

Sophos Cybersecurity as a Service offers several valuable features, including weekly and monthly reports, direct communication about incidents, swift responses typically within two minutes for cases or questions, security assessments of our environment, and security posturing of our environment.

Among these features, my team relies on the reports most significantly because they provide important insights into what is happening on the machines and the network on a weekly basis.

Sophos Cybersecurity as a Service has positively impacted our organization by providing management with confidence, knowing we have one of the best MDR services overseeing our entire ecosystem. We also benefit from a breach protection warranty that can provide up to one million US dollars.

This service has allowed my team to work more efficiently on other tasks rather than constantly monitoring every single notification, report, or incident that comes in, as the Sophos team investigates these on our behalf.

Currently there are not any major upgrades necessary, but the ease of use of reports could probably be enhanced. I would suggest making the reports easier to understand.

I have been using Sophos Cybersecurity as a Service for four years.

Sophos Cybersecurity as a Service is very stable, and as of today, we have had no issues.

Its scalability is remarkable, allowing for very easy scaling up or down without any complexity. It is one of the easiest solutions we have encountered.

Customer support is fantastic, and we have never had any issues. When we create a ticket in the Sophos portal, they respond quickly based on the tier of urgency.

We previously used Fortinet before switching to Sophos Cybersecurity as a Service. The reasons for the switch include Fortinet's increase in costs and the complexity involved in licensing and additional storage required for features that Sophos offers.

Pricing for Sophos Cybersecurity as a Service was excellent, and the setup was extremely easy.

I have seen a return on investment primarily through time saved. My team can focus on core functions rather than monitoring reports or alerts that come into the Sophos Central portal daily.

Before choosing Sophos Cybersecurity as a Service, we did not evaluate other options. We went with Sophos because we heard positive feedback from others and conducted our own due diligence.

Sophos Cybersecurity as a Service's AI capabilities are impressive, as I believe its governance and security are very strong. The AI is highly intuitive, providing a lot of insights into case details and threats, breaking down complex information into layman's terms for our management to understand easily.

So far, the accuracy and reliability of the AI output have been spot on, and we have seen no real issues with it to date.

My advice to others considering Sophos Cybersecurity as a Service is to conduct a proof of concept to see what it offers. Once you try it, you will realize how easy it is to manage, how intuitive it is, and the wealth of information available from it.

In conclusion, I believe Sophos Cybersecurity as a Service is an excellent solution that simplifies cybersecurity tasks, allowing my team to focus on essential areas. I rate this solution a nine out of ten.

Sophos Cybersecurity as a Service protects our cloud workloads and endpoints from ransomware and phishing. The managed service constantly monitors for threats so we don't need a large in-house security team. It is especially useful during off-hours, since alerts and response are handled automatically, keeping our environment secure without gaps.

The best feature about Sophos Cybersecurity as a Service is threat response automation because suspicious activities are contained quickly without waiting for manual intervention, which reduces damage.

Threat response automation in Sophos Cybersecurity as a Service fits into our daily operation by cutting down reaction time. When suspicious activity is detected, the system automatically isolates affected endpoints, blocks malicious traffic, and alerts the managed team. For us, that means incidents are contained before they escalate, and we don't lose hours manually chasing threats.

It has impacted our organization very positively. The biggest improvement has been efficiency. The managed team handles alerts and incidents so our IT staff can focus on projects instead of constant monitoring. We have also seen cost savings by not needing to expand our in-house security team. Most importantly, resilience has improved. Ransomware attempts were contained quickly, giving us confidence that threats will not disrupt operations.

I have very concrete outcomes with Sophos Cybersecurity as a Service. For example, automated threat response saved our team an estimated ten to fifteen hours per month that they used to spend chasing alerts manually. By relying on the managed service instead of expanding our in-house staff, we avoided hiring at least one additional security analyst, resulting in cost savings. During the phishing incidents, containment was complete in under an hour, compared to the full day it used to take us before Sophos Cybersecurity as a Service.

There are a few areas where Sophos Cybersecurity as a Service could be improved. One area is dashboard usability, another is alert tuning, and another is reporting customization.

Alert tuning would help us focus on critical issues faster, reducing wasted time on minor notifications. More flexible report customizations would let us align outputs directly with compliance frameworks, making audits smoother.

I rate my use of Sophos Cybersecurity as a Service as a nine.

I used Check Point Security Infinity Portal in the past. However, that solution is very high cost, and I needed to switch to Sophos Cybersecurity as a Service because it is better for me.

We had a phishing attack attempt where several employees clicked a suspicious link. Sophos Cybersecurity as a Service immediately flagged the activity, isolated the affected endpoints, and blocked further spread. The managed team notified us quickly, and within the same day, everything was contained and cleaned, saving us from what could have been a major breach.

Sophos Cybersecurity as a Service really helps with day-to-day peace of mind. During patch cycles when vulnerabilities are at their highest, the managed service keeps monitoring and blocking exploit attempts automatically.

One small feature I would add is the centralized dashboard. Having all alerts, reports, and threat actions in one place makes daily monitoring much easier. I also appreciated the scalability. For example, new users or workloads inherit policies instantly.

Sophos Cybersecurity as a Service uses AI with strong governance and security controls, combining deep learning models with human oversight to ensure threats are detected, contained, and reported in a transparent, auditable way. This balance of automation and accountability makes its AI outputs trustworthy for compliance-driven organizations.

It delivers highly accurate and reliable AI outputs by combining deep learning models with human review, minimizing false positives while ensuring rapid detection of real threats. Overall, I find Sophos Cybersecurity as a Service to be very great and very fast. I rate the overall product experience as a nine.

My main use case for Sophos Cybersecurity as a Service is endpoint and network protection, ensuring that laptops, servers, and other devices and cloud workloads are monitored with Sophos Cybersecurity as a Service. I centralized threat detections and response, which is similar to a SOC.

A quick example of how I use Sophos Cybersecurity as a Service for endpoint and network protection in my day-to-day work occurred last week when Sophos Cybersecurity as a Service flagged unusual outbound traffic from one endpoint, and the automatic response isolated the device from the network so the suspicious activity did not spread. Peers often mention this kind of real-time containment as a daily benefit of using the service.

The best features that Sophos Cybersecurity as a Service offers include centralized threat monitoring and automatic response, which cut down manual efforts, along with strong endpoint protection and phishing detection that peers consistently highlight.

Centralized monitoring and automatic response have made things much easier for me and my team compared to what we used before. Previously, my team had to manually sift through logs and chase alerts across different tools, which was time-consuming and often delayed our reaction. Now with Sophos Cybersecurity as a Service, it consolidates everything in one dashboard and automatically isolates suspicious endpoints.

Sophos Cybersecurity as a Service has impacted my organization positively by streamlining how we handle threats and reducing downtime. Before, my teams spent a lot of time chasing alerts across different systems. Now, with the centralized monitoring and automatic response, incidents are contained quickly and consistently.

For improvement, I suggest dashboard flexibility, more customizable views, and reporting for different teams, along with alert precision for finer tuning to reduce false positives and noise.

I have been using Sophos Cybersecurity as a Service for around two years.

Sophos Cybersecurity as a Service is very stable.

Scalability of Sophos Cybersecurity as a Service is very good, with no problems because the cybersecurity is in the cloud.

For me, customer support has been very great.

Previously, I used Check Point as a different solution.

I think the return on investment with Sophos Cybersecurity as a Service is primarily about the time saved for my team.

Since using Sophos Cybersecurity as a Service, I have seen measurable improvements such as faster incident response, fewer successful attacks, and significant efficiency gains for IT teams, with independent evaluations showing near-perfect detection rates and response times under two minutes, translating directly into saved hours and reduced risk.

My experience with pricing, setup cost, and licensing has been great, though I do not understand the licensing very well.

Before choosing Sophos Cybersecurity as a Service, I did not evaluate other options.

I would add that Sophos Cybersecurity as a Service has become part of my daily routine by simplifying endpoint checks and network monitoring, with alerts that are clear and actionable so I do not waste time chasing noise.

Regarding Sophos Cybersecurity as a Service's AI capabilities, I find it combines advanced AI with strict governance and layered security controls, ensuring both reliable detection and response and responsible use of automation.

Accuracy and reliability of Sophos Cybersecurity as a Service AI output is generally impressive, with independent evaluations showing high detection rates with threats identified quickly and consistently, which reduces the number of incidents that reach IT teams.

My advice for others looking into using Sophos Cybersecurity as a Service would be to evaluate automation, plan integration, and customize alerts. I rate this product an 8 overall.

Sophos Cybersecurity as a Service is our main solution to ensure secure operations as we build and connect more clients successfully, while also addressing our specific requirements. We have been using Sophos Cybersecurity as a Service, which provides many functionalities, including a taskbar that shows resource consumption from PCs, leading to good customer feedback. When Sophos resources are low, customers purchase more, recognizing it as a useful product.

We use mobile device management (MDM) services, and customer feedback indicates that it works very well for their custom work apps, benefiting both us and them.

Sophos Cybersecurity as a Service is deployed in our organization for cloud security purposes. Currently, we are not utilizing any specific cloud provider; instead, we are using Sophos endpoint security.

The best feature that Sophos Cybersecurity as a Service offers is Sophos XDR.

Sophos XDR stands out as the best feature for us and our clients because of its ability to investigate issues like a MITRE attack, conduct live discovery, and perform root cause analysis to understand how attackers attempt to access PCs.

Sophos Cybersecurity as a Service has positively impacted our organization by being very beneficial for our business and serving as a valuable income source.

The AI capabilities within Sophos Cybersecurity as a Service are very good, as it effectively detects incidents and tracks how issues occurred, providing a high level of security for banking and other sectors.

Sophos AI proves to be very capable for us in terms of input and output; when it detects any anomaly or file path, we are able to investigate it utilizing Sophos AI, which is very useful for us.

Sophos Cybersecurity as a Service is continuously consuming more resources, which leads to slower PC performance, so reducing resource consumption would be better for both Sophos products and our sales.

Improving the resource consumption aspect would enhance Sophos Cybersecurity as a Service market presence.

If Sophos antivirus could reduce its resource consumption during scheduled scans, it would help address the PC slowness issue.

We have been using Sophos Cybersecurity as a Service for at least 10 years since our company was established in 2016, and we are still using it currently.

Sophos Cybersecurity as a Service is stable.

The scalability of Sophos Cybersecurity as a Service is really great.

Our customer support is excellent, with 24/7 availability, handling at least 15 calls per week to solve client issues.

We did not use a different solution before opting for Sophos Cybersecurity as a Service; we have always focused on Sophos along with options like Palo Alto, Cortex XDR, and CrowdStrike.

We experience a return on investment from using Sophos Cybersecurity as a Service; for example, when we pre-configure it during installations for devices, it proves to be working well and saves time. I cannot provide specific monetary metrics since this is handled by our product team.

We did not evaluate any other options before choosing Sophos Cybersecurity as a Service; our team has consistently used Sophos Cybersecurity engineering and has not switched to other services such as XDR or CrowdStrike.

When advising others about using Sophos Cybersecurity as a Service, I emphasize that the main reason to choose Sophos Cybersecurity as a Service is its effective incident management; unlike other providers such as CrowdStrike, which have faced issues with server hacks and resource consumption, Sophos Cybersecurity as a Service has maintained a good reputation and is our best solution. I would rate this product a 9 overall.

My main use case for Sophos Cybersecurity as a Service is to stop ransomware attacks. I work for a manufacturing company with a total of 2,500 employees across 15 locations, Microsoft 365, VMware servers, Windows laptops, OT environments, and a hybrid workspace. An employee received a phishing email with the subject around invoice payment pending, and the attachment contained malicious macros. The user enabled the macro, and PowerShell downloaded ransomware. Sophos' email security helped beyond what is expected, as it checks the SPF, DKIM, DMARC, sandboxing, reputation, and AI detection. Suppose this is a zero-day attack; the email bypasses the filtering. Overall, Sophos XDR automatically correlates all the logs from the endpoint, the firewall, the identity email, and the cloud, allowing analysts to immediately see patient zero, the download file, PowerShell command, network connections, registry changes, and lateral movement attempts. Everything appears on a single investigation timeline.

A little more on the use case: Intercept X detects the malicious behavior, and CryptoGuard stops the encryption and restores the modified files. XDR correlates telemetry, MDR validates the threat, and performs 24/7 response, while the firewall blocks the attacker's communication.

The best features Sophos Cybersecurity as a Service offers is that instead of treating endpoint, firewall, email, and mobile security as separate products, Sophos enables them to communicate automatically through Security Heartbeat. An example would be when an endpoint becomes infected; Sophos Intercept X causes the firewall to isolate the device, block the malicious IP address, and prevent lateral movement automatically, reducing response time from minutes to seconds.

Automatic communication between Sophos products helps my team day-to-day by significantly reducing manual effort and speeding up incident response. Instead of analysts having to investigate alerts across multiple consoles, Sophos shares threat intelligence automatically between endpoints, firewalls, email security, and the management platform. This means that when one product detects a threat, the others immediately take coordinated action.

Sophos Cybersecurity as a Service has positively impacted my organization by simplifying cybersecurity operations while improving our ability to detect and respond to threats. Its integrated platform reduces the need to manage multiple disconnected tools, allowing our security teams to work more efficiently. Features such as automated threat correlation, endpoint isolation, and managed detections and response help reduce incident response time and minimize the impact of cyberattacks. For organizations with limited cybersecurity resources, Sophos also provides enterprise-wide protection through its MDR services without requiring a large in-house SOC.

Sophos Cybersecurity as a Service is a mature platform with strong endpoint protection, MDR, and integrated security capabilities. However, areas exist where it can continue to evolve. I see opportunities around AI-driven automation, cloud-native security, identity protection, third-party integrations, executive reporting, and proactive risk management.

Sophos already provides a strong integrated security platform with MDR, XDR, endpoint protection, and firewall integration. The next evolution is to become even more predictive and autonomous. I would like to see deeper AI-driven response automation, enhanced cloud and identity threat detection, broader third-party integrations, executive-focused risk dashboards, automated compliance mapping, and continuous external attack surface management. These enhancements would not only improve security outcomes but also help CISOs better demonstrate cyber risk reduction and business value.

To make it a ten, I would like to see cloud-native workload protection and identity security deeper compared with some specialized competitors. Some enterprises with highly customized SOCs may prefer broader native integration and automation available from platforms such as Microsoft, Palo Alto Networks, or CrowdStrike. Further enhancement in executive reporting and exposure management capabilities is also needed.

I have been working in my current field for 20 years.

Sophos Cybersecurity as a Service is stable.

I would rate Sophos Cybersecurity as a Service scalability at 9 out of 10. It's designed to scale from small businesses to large enterprises without requiring significant changes to the underlying platform.

Customer support is really good. I would rate the customer support a 10 out of 10.

I did not previously use a different solution.

Overall, my experience with pricing, setup cost, and licensing has been positive. I would rate the pricing setup to be 8 out of 10. Sophos offers competitive pricing, especially for organizations looking for an integrated security platform rather than purchasing multiple standalone products. The licensing model is generally straightforward, with flexible subscription options based on the organization's requirements. The initial setup costs are reasonable, particularly for cloud-managed deployments through Sophos Central. Overall total cost of ownership can be lowered because endpoint, firewall, email security, and MDR services are managed through a unified platform.

I have seen a positive return on investment, primarily through improved operational efficiency and faster incident response rather than reducing headcount. Sophos centralized management, automation, and MDR capabilities allow my security team to spend less time on repetitive tasks and more time on higher-value security activities. One example was a phishing incident that resulted in malware execution on a user laptop. Sophos detected the suspicious behavior, isolated the endpoint automatically, and prevented lateral movement. Because the investigation data was already correlated in Sophos Central, the analyst completed the investigation in 20 minutes, whereas previously, it could have taken close to an hour by manually reviewing multiple security tools. The incident was contained to a single endpoint, and the user experienced minimal disruption.

Before choosing Sophos Cybersecurity as a Service, I evaluated other options, including Microsoft Sentinel.

My advice to others looking into using Sophos Cybersecurity as a Service would be to first understand their organization's security maturity, business requirements, and existing technology stack. Sophos Cybersecurity as a Service delivers the most value when you leverage it as an integrated platform rather than deploying individual products in isolation. If you're looking for centralized management, strong ransomware protection, 24/7 managed detection and response, and reduced operational complexity, it's a compelling choice. I would also recommend planning the deployment carefully, defining security policies upfront, and investing time in tuning the alerts during the initial rollout to maximize effectiveness and minimize unnecessary noise. I would rate this solution an 8 out of 10.