Sold by: Sophos
Deployed on AWS
Free Trial
Vendor Insights
AWS Free Tier
Sophos Cybersecurity as a Service combines world class products, tools, services, and expertise into one holistic solution.
4.7
Overview
Your cybersecurity. Our responsibility.
Every organization wants the best cyber defenses, but very few have all the skilled resources to deliver them. With Cybersecurity as a Service for AWS (https://soph.so/caas ) we deliver world-leading protection for you or with you. All Sophos product and services offerings can be tailored to the exact needs of your organization's security program. Our integrated cybersecurity products automatically stop 99.98% of threats before they can run, while our threat hunting and neutralization experts monitor your environment 24/7, shutting down even the most advanced attacks on your behalf. Learn more about our services integration with AWS here: https://soph.so/awsmtp .
Sophos cloud products include:
- Cloud Security Posture Management: Sophos Cloud Optix continuously scans cloud environments to identify assets, assess their security and compliance settings, and identify malicious activity that may lead to data breaches - enabling you to quickly remediate misconfigurations and respond to threats. It integrates with AWS GuardDuty and SecurityHub and provides agentless malware scanning for the S3 storage service. Learn more: https://soph.so/cloud_optix
- Cloud Workload Protection: Sophos agents protect Windows and Linux hosts running in the cloud against modern threats, including ransomware. Learn more: https://soph.so/cwp
- Cloud Edge Firewall: Sophos Firewalls provide network visibility, protection, and response across public, private, and hybrid cloud environments. With cloud native, virtual, and physical appliances, Sophos Firewalls protect networks of any kind. Learn more: https://soph.so/ngfw
- Endpoint Protection: Sophos Endpoint agents protect your users against everything from common malware to advanced fileless threats and ransomware. Learn more: https://soph.so/endpoint
- Managed Detection and Response Service: Sophos MDR is the world's most trusted MDR service. Analysts leverage telemetry from AWS together with your endpoint, firewall, network, email, and identity solutions to accelerate threat detection, investigation and response across your full environment. Learn more: https://soph.so/mdr
Designed with SMB organizations in mind, Cybersecurity as a Service provides:
- Affordable threat protection: enterprise-grade cybersecurity that's cost effective for small businesses. Learn more: https://soph.so/smb
- An instant Security Operations Center: Managed by you, by us, or together. Simple, one-time installation gets you up and running in minutes.
- World-class cybersecurity defenses: Technology that works with hybrid cloud environments. From endpoint and network security to email and cloud, we have you covered.
- An expert team of cybersecurity professionals: Available 24/7/365. Our AI, malware and security operations specialists work together to constantly improve protection and help customers respond to incidents and breaches.
- A free intuitive cloud-based security platform: Sophos Central allows you to manage all your defenses in one place for maximum efficiency and cross-estate coordination. Providing simple management and reporting, Sophos Central also includes Threat Analysis tools for customers that operate their own security operations teams. Learn more: https://soph.so/sophos-central
Sophos provides a wide range of security solutions to protect users, networks, and cloud environments. To view all products please visit our Sophos Central listing page - https://soph.so/sophos-central .
Looking for custom pricing options? Contact us publiccloudsales@sophos.com
Highlights
- 24/7 Managed Detection and Response across Sophos and 3rd party products. Sophos MDR provides the most comprehensive native security integrations on the market, bringing together signals from endpoint, workload, network, email, cloud and mobile solutions. Learn more: https://soph.so/mdr
- Cloud native and hybrid cloud cybersecurity products provide protection for customers migrating to and in the cloud. Learn more: https://soph.so/cns
- A free cloud based unified management platform that centralizes reporting and configuration for all Sophos products and cybersecurity tools. Sophos Central facilitates sharing of real time threats, health and security information between Sophos products and enables automatic response actions to contain and eradicate threats. Learn more: https://soph.so/sophos-central
Details
Sold by
Delivery method
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Skip the manual risk assessment. Get verified and regularly updated security info on this product with Vendor Insights.
Security credentials achieved
(1)
AWS Security Specialization
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free according to the free trial terms set by the vendor.
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
Cloud Workload MDR | Managed Detection Response for server OS with XDR tools | $390.72 |
Cloud Optix Advanced | Agentless CSPM for AWS, K8s | $140.04 |
Cloud Edge Firewall | Firewall/IPS/Web/WAF/Sandbox: Price per Firewall includes all features | $3,424.00 |
Sophos MDR - Endpoint | Managed Detection Response for user workstations including XDR tools | $239.64 |
Dimensions summary
You buy each of the four options by unit, and you can mix them to match your environment. Two are managed detection and response services: one covers server operating systems, the other covers user workstations, both with XDR tools. Cloud Optix Advanced prices agentless posture management for AWS and Kubernetes per unit. Cloud Edge Firewall prices per firewall, with all firewall, IPS, web, WAF, and sandbox features bundled into that single unit price. You scale spend by adding units in each category independently, so cost tracks the servers, workstations, cloud accounts, and firewalls you protect.
Top-of-mind questions for buyers
The Cloud Workload MDR unit maps to a server operating system instance, covering hosts, virtual machines, and container workloads running Linux or Windows Server. The Sophos MDR - Endpoint unit maps to a user workstation. You count each protected server or workstation separately, then buy that many units.
One Cloud Edge Firewall unit covers a single firewall with all features bundled in. That includes firewall, intrusion prevention, web protection, web application firewall, and sandbox capabilities. You do not pay separately for these functions. Adding another firewall means buying another unit at the same per-firewall price.
Cloud Optix Advanced is agentless posture management priced per unit for AWS and Kubernetes environments. Because it needs no installed agent, coverage scales by adding units rather than deploying software to each host. You add units as your cloud accounts and Kubernetes environments grow, independent of the other three options.
www.sophos.com+2
Helpful?
Vendor refund policy
Please refer to the Sophos EULA for details on our refund policies.
Custom pricing options
Request a private offer to receive a custom quote.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Support
Vendor support
Sophos support portal for licensed customers with an existing SophosID: https://support.sophos.com Toll Free: 1-888-SOPHOS-9 (1-888-767-4679)International: 1-781-494-5800 To contact Support, please log into your Sophos Central Dashboard, click on HELP in the upper right corner, then click on CREATE SUPPORT TICKET. Or, visit https://www.sophos.com/en-us/support.aspx to go to the Sophos Community to find information and resolutions on common questions and issues.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By Sophos
By Palo Alto Networks
By Juniper Networks
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
Threat Detection and Response
Automatic threat detection and neutralization with 99.98% threat interception rate, supported by 24/7 managed detection and response service with threat hunting and neutralization experts
Cloud Security Posture Management
Continuous scanning of cloud environments to identify assets, assess security and compliance settings, detect malicious activity, and identify misconfigurations with agentless malware scanning for S3 storage and integration with AWS GuardDuty and SecurityHub
Endpoint and Workload Protection
Agent-based protection for Windows and Linux hosts against modern threats including ransomware, fileless attacks, and advanced malware
Network and Firewall Protection
Cloud-native, virtual, and physical firewall appliances providing network visibility, protection, and response across public, private, and hybrid cloud environments
Unified Management and Orchestration
Cloud-based centralized management platform enabling configuration, reporting, and real-time threat information sharing across endpoint, firewall, network, email, cloud, and identity solutions with automatic response actions
Application Layer Visibility and Control
Complete application layer-7 visibility and control of traffic with next-generation firewall capabilities in AWS environments
AI/ML-Powered Threat Detection
AI/ML-powered inspection engine with researcher-grade signatures for detection of zero-day threats, exploits, malware, spyware, and command and control attacks
Dynamic Policy Management
Policy definitions that dynamically apply to cloud assets based on AWS tags, Application IDs, User IDs, geographies, or zones without manual intervention
Cloud Infrastructure Integration
Seamless integration with Gateway Load Balancer, AWS Auto Scaling, and Transit VPC with AWS Transit Gateway for protection across dynamic and large-scale deployments
Advanced Threat Prevention Service
Cloud-delivered Advanced Threat Prevention security service with market-leading threat coverage against known and zero-day threats while maintaining performance
Next Generation Firewall Architecture
High-performance firewall solution with core firewall, VPN, NAT, and advanced L4-L7 security services including application security, IPS, and anti-virus capabilities.
Anti-Virus and Malware Protection
Cloud-based anti-virus protection that detects and blocks spyware, adware, viruses, keyloggers, and other malware over POP3, HTTP, SMTP, and FTP protocols.
Intrusion Detection and Prevention
Intrusion detection and prevention (IPS) system integrated with application visibility and control through AppSecure for threat detection and workload protection.
VPN and Secure Connectivity
IPsec and full mesh VPN termination services enabling secure connectivity from on-premises data centers, campuses, and branches to AWS cloud across geographically dispersed VPCs.
AWS Cloud Service Integration
Native integration with AWS services including Elastic Load Balancer, Auto-Scaling Groups, CloudWatch, Security Hub, Key Management Service, Elastic Network Adapter support, and Gateway Load Balancer with L3 gateway and L4 load balancer capabilities.
Standard contract
No
No
No
Customer reviews
Shibu K.
Sophos MDR gives us a full expert security team working round the clock, without having own SOC
Reviewed on Aug 06, 2026
Review provided by G2
What do you like best about the product?
I have been using Sophos MDR for a good amount of time now as part of my daily work as a network security engineer at Vibs Infosol Pvt Ltd. As an admin, I check this platform regularly, and it has become one of the most valuable additions to our security setup, because we deal with thousands of clients and almost all our communication happens through email and calls, and having actual security experts watching our environment around the clock, not just tools, has given us protection we simply could not manage on our own.
The biggest value I get is 24x7 Security Operations. Before MDR, my team could only monitor security actively during working hours, and outside that time we were relying purely on automated alerts, which meant if something happened at night or over a weekend, we would only find out the next working day. Now with MDR, there is a team of security experts continuously monitoring our environment, day and night, which has genuinely changed how safe I feel about our overall security posture.
Faster Threat Detection through the combination of AI and human analysts is something I have seen work in real situations. The AI catches unusual patterns quickly, but having actual human analysts review and confirm before escalating means the detection is both fast and accurate. This has reduced the time between something suspicious happening and us actually knowing about it.
Reduced Alert Fatigue is a benefit I personally value a lot. Before MDR, my team used to get flooded with alerts from different tools, and honestly after a while it becomes hard to tell which ones are truly serious and which are just noise. Now the MDR analysts validate alerts before they even reach us, so when I get an escalation, I know it is genuinely worth my immediate attention, instead of spending my day chasing false alarms.
Expert Incident Response has been extremely helpful during actual security situations. When something serious does get detected, I don't have to handle containment and remediation completely alone, the MDR team assists directly with the response process. This has given me confidence during stressful moments, knowing I have experienced people guiding the response, not just me figuring it out under pressure.
Threat Hunting is a feature I appreciate a lot, since it means the team is not just waiting for alerts, they are proactively searching for hidden attackers that might already be sitting quietly in our network without triggering an obvious alert. This proactive approach has caught things that a purely reactive setup would have missed.
Better ROI comes from how MDR extends and works together with our existing Sophos investments through integrations, rather than replacing everything we already have. Since we already use Sophos Firewall, Endpoint, and Central, MDR builds on top of that instead of forcing us to start over, which made the value much clearer to me and to management.
Reduced Cyber Risk is the overall outcome I see from all of this together, earlier detection and faster response genuinely limits how much damage a potential incident can cause to our business, which directly protects our thousands of client relationships that depend on us handling their data and communication safely.
Compliance Support through proper reporting and monitoring has made audits and regulatory conversations much smoother for me, since I have documented proof of continuous monitoring and expert oversight, which clients and auditors take seriously.
Lower SOC Costs is a very real benefit for us. Building and staffing a full in-house security operations center with round the clock analysts would be extremely expensive and difficult for a company our size. MDR gives us that same level of protection without needing to hire and manage a large internal team, which has been a smart and practical decision for us.
Business Continuity is something I value deeply, since MDR helps reduce downtime during actual security incidents by responding quickly and effectively, which keeps our operations running smoothly even when something goes wrong.
What I find really valuable is understanding where MDR fits compared to EDR and XDR. EDR focuses purely on endpoint detection, XDR correlates data across multiple security layers, but MDR adds an actual team of experienced security analysts who monitor, investigate, hunt, and respond around the clock. For an organization like ours that wants enterprise grade security operations without building our own SOC, this has been exactly the right fit.
An unexpected benefit I found is that having MDR has actually made my own daily job less stressful, since I know I am not the only line of defense anymore, there is a whole expert team backing me up continuously, which has genuinely improved my own work life balance.
The biggest value I get is 24x7 Security Operations. Before MDR, my team could only monitor security actively during working hours, and outside that time we were relying purely on automated alerts, which meant if something happened at night or over a weekend, we would only find out the next working day. Now with MDR, there is a team of security experts continuously monitoring our environment, day and night, which has genuinely changed how safe I feel about our overall security posture.
Faster Threat Detection through the combination of AI and human analysts is something I have seen work in real situations. The AI catches unusual patterns quickly, but having actual human analysts review and confirm before escalating means the detection is both fast and accurate. This has reduced the time between something suspicious happening and us actually knowing about it.
Reduced Alert Fatigue is a benefit I personally value a lot. Before MDR, my team used to get flooded with alerts from different tools, and honestly after a while it becomes hard to tell which ones are truly serious and which are just noise. Now the MDR analysts validate alerts before they even reach us, so when I get an escalation, I know it is genuinely worth my immediate attention, instead of spending my day chasing false alarms.
Expert Incident Response has been extremely helpful during actual security situations. When something serious does get detected, I don't have to handle containment and remediation completely alone, the MDR team assists directly with the response process. This has given me confidence during stressful moments, knowing I have experienced people guiding the response, not just me figuring it out under pressure.
Threat Hunting is a feature I appreciate a lot, since it means the team is not just waiting for alerts, they are proactively searching for hidden attackers that might already be sitting quietly in our network without triggering an obvious alert. This proactive approach has caught things that a purely reactive setup would have missed.
Better ROI comes from how MDR extends and works together with our existing Sophos investments through integrations, rather than replacing everything we already have. Since we already use Sophos Firewall, Endpoint, and Central, MDR builds on top of that instead of forcing us to start over, which made the value much clearer to me and to management.
Reduced Cyber Risk is the overall outcome I see from all of this together, earlier detection and faster response genuinely limits how much damage a potential incident can cause to our business, which directly protects our thousands of client relationships that depend on us handling their data and communication safely.
Compliance Support through proper reporting and monitoring has made audits and regulatory conversations much smoother for me, since I have documented proof of continuous monitoring and expert oversight, which clients and auditors take seriously.
Lower SOC Costs is a very real benefit for us. Building and staffing a full in-house security operations center with round the clock analysts would be extremely expensive and difficult for a company our size. MDR gives us that same level of protection without needing to hire and manage a large internal team, which has been a smart and practical decision for us.
Business Continuity is something I value deeply, since MDR helps reduce downtime during actual security incidents by responding quickly and effectively, which keeps our operations running smoothly even when something goes wrong.
What I find really valuable is understanding where MDR fits compared to EDR and XDR. EDR focuses purely on endpoint detection, XDR correlates data across multiple security layers, but MDR adds an actual team of experienced security analysts who monitor, investigate, hunt, and respond around the clock. For an organization like ours that wants enterprise grade security operations without building our own SOC, this has been exactly the right fit.
An unexpected benefit I found is that having MDR has actually made my own daily job less stressful, since I know I am not the only line of defense anymore, there is a whole expert team backing me up continuously, which has genuinely improved my own work life balance.
What do you dislike about the product?
Even though Sophos MDR has genuinely strengthened our security posture, there are a few areas I feel could be improved, though these are not big enough to change my overall positive experience.
The first thing is that in the beginning, understanding exactly how communication and escalation would work between my team and the MDR analysts took some getting used to. I had to spend some time in the onboarding phase clarification our internal processes, so that escalations reached the right person in our team quickly without confusion.
Second, since MDR analysts are handling monitoring for many organizations, sometimes during the initial setup phase, I felt a few of the alert validations took slightly longer than I personally expected, though this improved once the service was properly tuned to our environment over time.
Third, I feel the reporting could offer a bit more customization for how data is presented to different stakeholders, since what I want to see as a technical admin is different from what my management wants to see in a summary report, and currently I do some manual work to translate technical reports into management friendly summaries.
Fourth, regarding pricing, since MDR is an ongoing subscription service on top of our existing security tools, the ROI is more about risk reduction and avoided cost of building our own SOC rather than a directly visible saving. Once I calculated the actual cost of hiring and maintaining an in-house 24x7 team versus the MDR subscription, the value became very clear, but this comparison and justification took some effort to present properly to management initially.
Fifth, support and coordination during non-critical situations is generally fine, but I would appreciate slightly faster turnaround for administrative or configuration related questions that are not urgent security incidents.
Even with these small points, I want to be fair, these issues are minor compared to the real peace of mind and protection MDR gives our organization every single day.
The first thing is that in the beginning, understanding exactly how communication and escalation would work between my team and the MDR analysts took some getting used to. I had to spend some time in the onboarding phase clarification our internal processes, so that escalations reached the right person in our team quickly without confusion.
Second, since MDR analysts are handling monitoring for many organizations, sometimes during the initial setup phase, I felt a few of the alert validations took slightly longer than I personally expected, though this improved once the service was properly tuned to our environment over time.
Third, I feel the reporting could offer a bit more customization for how data is presented to different stakeholders, since what I want to see as a technical admin is different from what my management wants to see in a summary report, and currently I do some manual work to translate technical reports into management friendly summaries.
Fourth, regarding pricing, since MDR is an ongoing subscription service on top of our existing security tools, the ROI is more about risk reduction and avoided cost of building our own SOC rather than a directly visible saving. Once I calculated the actual cost of hiring and maintaining an in-house 24x7 team versus the MDR subscription, the value became very clear, but this comparison and justification took some effort to present properly to management initially.
Fifth, support and coordination during non-critical situations is generally fine, but I would appreciate slightly faster turnaround for administrative or configuration related questions that are not urgent security incidents.
Even with these small points, I want to be fair, these issues are minor compared to the real peace of mind and protection MDR gives our organization every single day.
What problems is the product solving and how is that benefiting you?
Before using Sophos MDR, our organization was relying mainly on our own internal team and automated tools to monitor security, which meant our coverage was limited mostly to working hours, and we did not have the resources to build a full round the clock security operations center with experienced analysts.
We struggled with limited monitoring coverage outside working hours, but now with 24x7 Security Operations, we have continuous expert monitoring day and night, which has resulted in much stronger protection during the times we were previously most vulnerable.
We struggled with slow detection of suspicious activity, sometimes only noticing issues after they had already caused damage, but now with Faster Threat Detection combining AI and human analysts, we identify attacks much quicker, which has resulted in reduced potential impact from security incidents.
We struggled with alert fatigue, where my team spent a lot of time sorting through large volumes of alerts trying to figure out which ones were genuinely serious, but now with analysts validating alerts before escalation, we only deal with confirmed, meaningful alerts, which has resulted in significant time savings for my internal team and much less wasted effort chasing false alarms.
We struggled with handling serious security incidents largely on our own, without deep specialized incident response experience, but now with Expert Incident Response support from the MDR team, we get guided assistance with containment and remediation, which has resulted in faster and more effective handling of real security incidents.
We struggled with only reacting to alerts rather than actively searching for hidden threats, but now with proactive Threat Hunting, the MDR team searches for hidden attackers that might otherwise go unnoticed, which has resulted in catching risks earlier than we would have on our own.
We struggled with justifying the cost and complexity of building a full in-house security operations center, but now with MDR, we get enterprise-grade round the clock protection without the cost of hiring and managing a large internal SOC team, which has resulted in significant cost savings compared to building this capability ourselves.
We struggled with proving continuous security monitoring to clients and regulators, but now with proper Compliance Support through detailed reporting, audits and regulatory conversations have become noticeably smoother.
On a bigger level, since our business depends on secure and trusted communication with thousands of clients daily, Sophos MDR has given us enterprise level security operations that we simply could not have built and staffed ourselves. This has directly benefited us with reduced cyber risk, faster incident response, lower operational cost compared to an in-house SOC, and overall a much stronger and more confident security posture protecting our organization around the clock.
We struggled with limited monitoring coverage outside working hours, but now with 24x7 Security Operations, we have continuous expert monitoring day and night, which has resulted in much stronger protection during the times we were previously most vulnerable.
We struggled with slow detection of suspicious activity, sometimes only noticing issues after they had already caused damage, but now with Faster Threat Detection combining AI and human analysts, we identify attacks much quicker, which has resulted in reduced potential impact from security incidents.
We struggled with alert fatigue, where my team spent a lot of time sorting through large volumes of alerts trying to figure out which ones were genuinely serious, but now with analysts validating alerts before escalation, we only deal with confirmed, meaningful alerts, which has resulted in significant time savings for my internal team and much less wasted effort chasing false alarms.
We struggled with handling serious security incidents largely on our own, without deep specialized incident response experience, but now with Expert Incident Response support from the MDR team, we get guided assistance with containment and remediation, which has resulted in faster and more effective handling of real security incidents.
We struggled with only reacting to alerts rather than actively searching for hidden threats, but now with proactive Threat Hunting, the MDR team searches for hidden attackers that might otherwise go unnoticed, which has resulted in catching risks earlier than we would have on our own.
We struggled with justifying the cost and complexity of building a full in-house security operations center, but now with MDR, we get enterprise-grade round the clock protection without the cost of hiring and managing a large internal SOC team, which has resulted in significant cost savings compared to building this capability ourselves.
We struggled with proving continuous security monitoring to clients and regulators, but now with proper Compliance Support through detailed reporting, audits and regulatory conversations have become noticeably smoother.
On a bigger level, since our business depends on secure and trusted communication with thousands of clients daily, Sophos MDR has given us enterprise level security operations that we simply could not have built and staffed ourselves. This has directly benefited us with reduced cyber risk, faster incident response, lower operational cost compared to an in-house SOC, and overall a much stronger and more confident security posture protecting our organization around the clock.
JUNAID ABID KHAN
Integrated threat visibility has improved incident response but policy testing still needs work
Reviewed on Jul 22, 2026
Review from a verified AWS customer
What is our primary use case?
I am working with on-premises versions and hardware of Sophos Cybersecurity as a Service. I purchased Sophos Cybersecurity as a Service from the vendor and distribution. I work as a pre-sales engineer, so I participate in the implementation of Sophos Cybersecurity as a Service.
What is most valuable?
Sophos Heartbeat and the Sophos AI-driven ransomware protection for Sophos Cybersecurity as a Service are significant benefits. These are good add-ons for Sophos. The company performs well with Zero Trust Network Access, zero-day attack protection, and adaptive attack protection.
Automated Threat Response is quite beneficial in real time for Sophos Cybersecurity as a Service. It also stops the active threat response, which we call ATR. This is in sync with Sophos Managed Detection and Response, which is MDR. There is another extension feature called Security Heartbeat.
The main key feature of Sophos Cybersecurity as a Service is Sophos Heartbeat. The deep visibility provided by Sophos refers to their comprehensive real-time data collection and correlation across the organization's entire footprint, which includes Sophos EDR and Sophos Heartbeat features that enable central analysis and monitoring. This is quite easy, and Sophos MDR is also part of it, including Network Detection and Response.
What needs improvement?
In terms of improvement, Sophos testing after implementation is quite difficult. Sometimes it has software errors. When I put some policy on a network, it did not apply, and I had to check why this was happening. Sometimes this occurs because the software is not allowing it, or I could say the software is not supporting a specific policy implementation. Then sometimes I have to restart Sophos. I am talking in terms of a firewall.
There is sometimes a delay in the technical support of Sophos Cybersecurity as a Service, but I think nine out of ten is quite good from their end.
For how long have I used the solution?
I started using Sophos Cybersecurity as a Service in 2020, and it has been three years.
How are customer service and support?
There is sometimes a delay in the technical support of Sophos Cybersecurity as a Service, but I think nine out of ten is quite good from their end.
How was the initial setup?
Sophos Cybersecurity as a Service is mostly user-friendly with a GUI. I think it was not complex, and it was quite easy to pursue Sophos integration with the system.
I think it depends on the complexity and the scope of work with Sophos Cybersecurity as a Service. If I am working on a firewall and I just have to route the internet and basic policies, then it could take hours. If I have to implement some complex topology, then it could take days. The test is quite complex.
Which other solutions did I evaluate?
The other product I asked about is Secureworks Taegis XDR, a network and detection response tool.
What other advice do I have?
Sophos Cybersecurity as a Service is a quite decent product for a basic level or initial level assessment. I think it is not more appropriate, but it is good. My overall rating for this product is 7.5.
kaushal p.
Proactive 24/7 Threat Detection and Fast Containment with Sophos MDR
Reviewed on Jul 20, 2026
Review provided by G2
What do you like best about the product?
We've been using Sophos MDR for about 18 months across an environment of roughly 150-200 endpoints spread across Indore head office and smaller branch locactions in Delhi and Bhopal. It's become the backbone of our 24/7 security monitoirng since our internal IT team isn't large enough to staff a round-the-clock SOC ourselves.
The best thing I like is Threat detection and response. The analysts don't just alert and walk away — they actively investigate and take containment actions. We had an incident about 4 months ago where a workstation showed signs of suspicious PowerShell activity at around 2 AM; the Sophos team isolated the host and had a full incident summary in our inbox before our own team even logged on that morning. That kind of proactive containment has genuinely prevented what could have been a lateral-movement situation across network.
Reporting: The monthly threat summary reports are detailed enough that we've been able to use them directly in our quarterly security reviews with leadership, without needing to rebuild the data ourselves. It's saved our small security team probably 4-5 hours a month that to go into compiling that information manually.
Support: We've raised maybe 3-4 tickets over the past year for tuning false positives on a couple of internal applications. and teach was resolved within a day, usually with a clear explanation of why the detection fired in the first place.
The best thing I like is Threat detection and response. The analysts don't just alert and walk away — they actively investigate and take containment actions. We had an incident about 4 months ago where a workstation showed signs of suspicious PowerShell activity at around 2 AM; the Sophos team isolated the host and had a full incident summary in our inbox before our own team even logged on that morning. That kind of proactive containment has genuinely prevented what could have been a lateral-movement situation across network.
Reporting: The monthly threat summary reports are detailed enough that we've been able to use them directly in our quarterly security reviews with leadership, without needing to rebuild the data ourselves. It's saved our small security team probably 4-5 hours a month that to go into compiling that information manually.
Support: We've raised maybe 3-4 tickets over the past year for tuning false positives on a couple of internal applications. and teach was resolved within a day, usually with a clear explanation of why the detection fired in the first place.
What do you dislike about the product?
There isn't a major drawback we've run into, but a few smaller things stand out. The client portal, while functional, feels like it lags a generation behind some of the more modern dashboards we've seen from competitors - filtering and searching through historical incidents can take a few extra clicks compared to what we'd expect from a more polished UI.
We've also occasionally had a slight delay - maybe 10-15 minutes - in getting a callback during a mid-severity incident versus the near-instant response we get for critical ones, which is reasonable given prioritization, but worth knowing if you're expecting the same SLA across all severity tiers.
Neither of these has caused an actual security gaps for us. They're more operational friction than genuine shortcomings. For a team our size without a dedicated SOC, the value has far outweighed these minor inconveniences.
We've also occasionally had a slight delay - maybe 10-15 minutes - in getting a callback during a mid-severity incident versus the near-instant response we get for critical ones, which is reasonable given prioritization, but worth knowing if you're expecting the same SLA across all severity tiers.
Neither of these has caused an actual security gaps for us. They're more operational friction than genuine shortcomings. For a team our size without a dedicated SOC, the value has far outweighed these minor inconveniences.
What problems is the product solving and how is that benefiting you?
Sophos MDR solves the core problem of not having enough in-house security headcount to monitor threats around the clock. With 150-200 endpoints across multiple locations and only a 3-person internal IT/security team, building an equivalent 24/7 SOC ourselves would have meant hiring at least 3-4 additional analysts just to cover shifts - a cost we simply couldn't justify at our size.
Concretely, having MDR in place means incidents that occur outside business hours (evenings, weekends) get triaged and contained without waiting for someone in our office to notice next morning. Over the past year, that's included catching and containing 2 incidents that started well outside our working hours, both resolved before they could spread further.
It's also shifted our internal team's role from constantly watching dashboards to focusing on remediation and policy improvement, since the initial detection and triage work is handled for us. That's freed up roughly a day a week of internal time that used to go into manual log review, which we've redirected toward improving our patch management and access control processes instead.
Concretely, having MDR in place means incidents that occur outside business hours (evenings, weekends) get triaged and contained without waiting for someone in our office to notice next morning. Over the past year, that's included catching and containing 2 incidents that started well outside our working hours, both resolved before they could spread further.
It's also shifted our internal team's role from constantly watching dashboards to focusing on remediation and policy improvement, since the initial detection and triage work is handled for us. That's freed up roughly a day a week of internal time that used to go into manual log review, which we've redirected toward improving our patch management and access control processes instead.
Ligor Medina
Managed security service has improved endpoint protection and supports informed customer deployment
Reviewed on Jul 20, 2026
Review provided by PeerSpot
What is our primary use case?
I want to discuss the experience with Sophos Cybersecurity as a Service products. I have familiarity with the service in general, but I do not have specific experience with Sophos.
Sophos Cybersecurity as a Service on endpoint security is a standalone solution installed on the PC that can be left to customers to manage themselves. When it comes to as a service, this is something different where we subscribe to the service from the provider and then let them handle the administration of the security on the customer's end.
We do not have that service ourselves, but we resell and provide bundled solutions. This type of software allows customers with IT teams to handle the deployment themselves. Endpoint security is not complicated when it comes to deployment, and the IT team can do it on their own. The issue is that I am mentioning the need for more education because customers are using the solution, but I do not think they are maximizing the use or the functionalities of the solution.
How has it helped my organization?
Last week when we talked about Sophos Cybersecurity as a Service, I did not mention whether I was using it. However, I have a background with as a service solutions, but on a different solution.
What needs improvement?
The R&D team is very good in doing their task and continuously conducting research. I cannot comment on what could be added in future updates of Sophos Cybersecurity as a Service that they need to do. However, it is more about engagement with the customer. There are AIs and self-paced trainings available, but delivering it to the customers and forcing the customers to learn more about the product is something that needs to be addressed through customer engagement. This is not on Sophos side, because a lot of improvements have been done with your solution, so I cannot comment more about it.
The customer is looking at price perspective, but what is more important is the support. The ease of communicating with the technical support is number one. It is all about the support, and not only engaging support on some issues or concerns, but also providing education to the customers is important. Providing ways such as demo labs and online self-paced training that can be communicated by the distributor on how to access them and how to utilize and leverage all these things so that the information is properly distributed to our customers and to the partners is essential.
How are customer service and support?
When I told you that I want to talk about it, it was because I want to know more about discussing Sophos Cybersecurity as a Service that Sophos is providing.
What was our ROI?
When it comes to the return on investment with the vulnerability solution, it is nice to have in the organization. However, when it comes to compliance, a third-party assessor is required. If I buy or if I am an organization who subscribes to or buys a solution like a vulnerability assessment tool, this is just a tool for the organization. It is better to buy it, but I do not think it can be used to submit to some compliance because a third-party assessor for vulnerability and penetration testing is needed. Huge organizations can have that so they have their own assessment on their own, but services to other or third parties must be done to comply with the requirement or the regulation for security.
What other advice do I have?
Most of our customers are very cautious about the data that they are keeping, so they prefer buying Sophos Cybersecurity as a Service directly from Sophos or third-party vendors to building their infrastructure on their premises.
This is based on experience with not so huge customers. Our distributor is very supportive, and from their end, if we do not know how to escalate the problem to the support, they extend their help by doing so for us. If they can solve it on their own, then they help solve it. Support comes not only on problems in terms of security, but also on other matters such as concerns, questions, or inquiries about the license and inquiries about the best way to deploy it. The perspective comes from our distributor, and I would rate the overall review as an eight.
Abhinav Varshney
Cloud security as a service has unified threat visibility and protects hybrid workers in real time
Reviewed on Jul 20, 2026
Review from a verified AWS customer
What is our primary use case?
Sophos Cybersecurity as a Service is a product from Sophos that I sell to end customers. There is a cloud platform where they offer their product. I started my career with Sophos and have been working exclusively with Sophos from the beginning.
What is most valuable?
Sophos Cybersecurity as a Service includes antivirus, firewall, anti-spam, encryption, and multiple other features.
The best part about Sophos Cybersecurity as a Service is that customers do not have to purchase servers because it is offered as a service, allowing them to pay according to usage. They do not need to invest in infrastructure.
Sophos provides very good visibility into the network because they use XDR. Additionally, they also offer MDR services.
When any hash value is identified on any machine or is globally available, I can search for any malicious hash value across the entire network. Using the threat investigation or XDR feature of Sophos Cybersecurity as a Service, I can investigate inactive threats that may cause problems in the future and neutralize them.
This is very important because after COVID, many companies began offering work from home arrangements. In hybrid environments where users may be sitting in different office locations or at home, machines need to be protected. With the centralized cloud-based solution from Sophos Cybersecurity as a Service, users are protected in real time.
What needs improvement?
Sophos Cybersecurity as a Service could be improved by adding features such as patch management and file encryption, as these are currently missing. Nowadays, competition is providing these solutions built in with their XDR solutions.
For how long have I used the solution?
I have been selling Sophos Cybersecurity as a Service for nearly thirteen to fourteen years.
What do I think about the stability of the solution?
Sophos Cybersecurity as a Service is very stable.
What do I think about the scalability of the solution?
There are no scalability limitations with Sophos Cybersecurity as a Service. It is very scalable, and I have seen it supporting numerous customers. I have observed it supporting customer bases ranging from ten users to one hundred, one thousand, or ten thousand users. I do not think there is any challenge in scalability.
How are customer service and support?
I can say that customer support for Sophos Cybersecurity as a Service is good eighty percent of the time. Twenty percent of the time, support gets delayed as it progresses from L1 to L2 to GES. However, eighty percent of the time they are responsive.
Which solution did I use previously and why did I switch?
CoSoSys Endpoint Protector and Netwrix Endpoint Protector are the same product, as CoSoSys Endpoint Protector was acquired by Netwrix. I am not currently using this product. Earlier, I was using it when I worked at a company called Platinum Infotech, where we were selling and using it. However, now that I am running my own company, I am not using this product anymore.
How was the initial setup?
Sophos Cybersecurity as a Service is very easy to set up. It can be installed with simple next, next, next steps, or it can be deployed using Active Directory or third-party software deployment tools. The installation is very straightforward.
What's my experience with pricing, setup cost, and licensing?
Sophos Cybersecurity as a Service is very competitive in terms of pricing.
Many products are available, including CrowdStrike, SentinelOne, and Palo Alto, and most of these products are offered as Cybersecurity as a Service solutions. However, Sophos Cybersecurity as a Service is very good when targeting the SMB market. It is very affordable and price competitive.
Which other solutions did I evaluate?
There are many alternative products available, including CrowdStrike, SentinelOne, and Palo Alto. Most of these products are coming as Cybersecurity as a Service offerings.
What other advice do I have?
I personally know hundreds of customers, and I can say they are very satisfied with Sophos Cybersecurity as a Service. I gave this review a rating of nine.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)