Reviews

One of the strongest aspects of Sophos is its mature integration marketplace, which helps provide excellent XDR visibility across the wider security ecosystem. The acquisition of Secureworks should further strengthen this capability, particularly around event correlation and threat intelligence. This is especially valuable when combined with MDR services, where the SOC may not have direct access to every security tool in the customer environment. Another key strength is that Sophos encourages broad data ingestion rather than penalising customers for it. The Sophos Data Lake can retain a substantial volume of endpoint telemetry, alongside additional logs forwarded from third-party providers. This makes investigations more comprehensive and gives administrators the context needed to understand activity across the environment. The default 90-day retention period is also generous, with the option to extend it further if required. The platform also helps reduce operational overhead. Although Sophos collects and analyses a large amount of detection data to identify infection chains and behavioural patterns, day-to-day management remains relatively light. Its built-in threat logic, severity ratings and case grouping help prioritise what matters, reducing time spent investigating false positive alerts. Please see above the overall experience section for the additional benefits gained with Sophos Central.

June 24, 2026