Sophos Reviews, Ratings & Features 2026 | Gartner Peer Insights

Identity Threat Detection and Response (ITDR) encompasses a suite of security practices and technologies dedicated to detecting, investigating, and responding to threats that target digital identities within an organization. As identity-related attacks such as compromised credentials, privilege escalation, and unauthorized access become increasingly common, ITDR solutions play a pivotal role in safeguarding sensitive systems and data. These solutions work by continuously monitoring identity activities, analyzing behavioral patterns, and identifying anomalies that may signal malicious intent. When a threat is detected, ITDR tools empower security teams to respond rapidly through measures like isolating affected accounts, enforcing multi-factor authentication, or triggering automated remediation workflows. In an era where digital identities are a primary attack vector, ITDR is essential for strengthening an organization’s overall security posture.

Who are the target users of Identity Threat Detection and Response (ITDR) solutions?

Primary users of ITDR solutions include security operations teams, IT administrators, and identity and access management (IAM) professionals within organizations of all sizes. Chief Information Security Officers (CISOs), compliance managers, and risk management teams also rely on ITDR to ensure regulatory compliance and reduce the risk of data breaches. These solutions are especially critical for, remote workforces, or heightened regulatory requirements.

What are the core capabilities of Identity Threat Detection and Response (ITDR) solutions?

Anomaly-Based Threat Detection: Tracks identity behavior to detect unusual patterns like odd login times or access spikes that may signal compromised accounts or insider threats.
Real-Time Alerting: Delivers instant notifications when identity-related risks are detected, helping security teams act before damage occurs.
Automated Threat Response: Takes immediate action such as locking accounts or triggering MFA to contain threats without waiting for manual intervention.

What are the benefits of Identity Threat Detection and Response (ITDR) solutions?

ITDR solutions help organizations proactively defend against identity-based attacks, reducing the risk of data breaches and operational disruptions. Security teams benefit from faster threat detection and response, improved visibility into identity-related risks, and reduced manual workloads through automation. Executives and compliance leaders gain confidence in their organization’s ability to meet regulatory requirements and protect sensitive information, ultimately enhancing the organization’s reputation and resilience against evolving cyber threats.

Active

Find the top Identity Threat Detection and Response (ITDR) with Gartner. Compare and filter by verified product reviews and choose the software that’s right for your organization.

Identity Threat Detection and Response (ITDR)

Sophos ITDR

Sophos

Manager Of It Services

We have implemented Sophos ITDR over our Sophos XDR solution and applied company-wide Endpoints, its core functionality to continuous detection and monitoring of identity-based threats and response within the overall enterprise environment, which gives a big relief to our SOC operation team and helps to automate most of the XDR alerts with an automated remediation process.  Now we have reduced the risk of external threats in our environment and are getting a prompt alert for any compromise activity in the environment.

<50M USD

50M - 250M USD

250M - 500M USD

CYBERSECURITY ENGINEER

Not the best endpoint protection. No visibility into events. Extremely difficult to manage offboarding of devices. 

It Services Associate

The product overall is very exceptional and satisfying. The experience with this Sophos ITDR has been positive, particularly in terms of threat detection, alerting and identity protection capabilities. The platform provides good visibility intro suspicious activities and helps strengthen overall security monitoring.

Microsoft

SentinelOne

CrowdStrike

Palo Alto Networks

Proofpoint

Silverfort

Semperis

Sophos is a global provider of advanced cybersecurity solutions. Their main focus is the delivery of an extensive range of security technologies including Managed Detection and Response (MDR), incident response services, as well as endpoint, network, email, and cloud security systems. These products and services are designed to help organizations combat various cyber threats such as active adversaries, ransomware, phishing, and malware. The company offers fully-managed, turnkey security solutions, providing cybersecurity-as-a-service to organizations worldwide. Moreover, Sophos hosts a cloud-based management console, known as Sophos Central, and supports the Sophos X-Ops, a cross-domain threat intelligence unit. The unit enriches the Sophos Adaptive Cybersecurity Ecosystem by optimizing its centralized data lake with a powerful set of open APIs. Sophos' operations are globally distributed and the company's headquarters are in Oxford, U.K.

Cybersecurity as a Service.

Sophos is a worldwide leader and innovator of advanced cybersecurity solutions, including Managed Detection and Response (MDR) and incident response services and a broad portfolio of endpoint, network, email, and cloud security technologies that help organizations defeat cyberattacks. 

As one of the largest pure-play cybersecurity providers, Sophos defends more than 500,000 organizations and more than 100 million users globally from active adversaries, ransomware, phishing, malware, and more. 

Sophos‚Äô services and products connect through‚ÄØits‚ÄØcloud-based Sophos Central management console and are powered by‚ÄØSophos X-Ops, the company‚Äôs cross-domain threat intelligence unit. Sophos X-Ops intelligence optimizes the entire Sophos Adaptive Cybersecurity Ecosystem, which includes a centralized data lake that leverages a rich set of open APIs available to customers, partners, developers, and other cybersecurity and information technology vendors. 

Sophos provides cybersecurity-as-a-service to organizations needing fully-managed, turnkey security solutions. Customers can also manage their cybersecurity directly with Sophos‚Äô security operations platform or use a hybrid approach by supplementing their in-house teams with Sophos‚Äô services, including threat hunting and remediation. 

Sophos sells through reseller partners and managed service providers (MSPs) worldwide. 

Sophos is headquartered in Oxford, U.K. More information is available at www.sophos.com

Reviews

Ratings Overview

Overall experience with

Favorable Review

User-Friendly Security Platform with Strong Detection Capabilities

Critical Review

Easy-to-navigate dashboard offset by missing features and low performance

Likes and dislikes about

likes

dislikes