Sophos Central Cybersecurity - Secure Workloads, Data, Apps, and Access

My main use case for Sophos Central  involves utilizing it as an endpoint, EDR, and email gateway.

In my day-to-day work, I use Sophos Central  by installing the agent on our clients. We have around 40 to 50 clients that are using Sophos as their EDR. We have created the alerting system in our ServiceNow , which is integrated with Sophos Central, so we get tickets in ServiceNow  whenever something is triggered. I log into Sophos to investigate the alert, reviewing the alerts on that device from Sophos, and if required, I manually log into the device to check the alert and take actions accordingly.

Regarding my main use case or how I use Sophos Central day to day, the most useful feature is that Sophos blocks threats. As a senior engineer, my main work involving Sophos is handling situations when it blocks something that is legitimate, such as a ServiceNow MID Server. Every time this happens, Sophos blocks it as a malicious file, so we dive into Sophos and create exclusions, especially path exclusions, and if necessary, we also create hash exclusions to ensure that the legitimate file can be accessed and run by the user without any issues.

The best features Sophos Central offers, in my opinion, involve its excellent ability to block threats in endpoint protection. While it is not as effective in handling exclusion cases, it excels at successfully blocking almost all files that seem suspicious, which is really good and provides strong security.

What I appreciate most about the blocking features in Sophos Central is its real-time detection and the variety of threat types it can catch. Many other endpoints miss files that don't have a bad reputation, but Sophos finds a way to catch those malicious files, and if there's even a small suspicion, it blocks them. The real-time detection is really great in Sophos Central.

Sophos Central has positively impacted our organization by being a desired EDR solution for our many clients. As an MSSP , we have a significant number of clients utilizing Sophos Central, and it provides excellent service as an EDR. Even when we use it as an email gateway, it continues to perform well, making it beneficial for our organization with a wide client base.

One way Sophos Central can be improved is in its exclusion capabilities. When we try to exclude legitimate files, we find that it requires a lot of effort, as we cannot simply exclude one file from every detection. Due to the layered approach, it takes time to exclude even one file, indicating that the exclusion process could definitely be enhanced.

I would add that the logs in Sophos Central should be more detailed. Sometimes, when we're checking the logs, they simply state that a file is blocked, but we can't find out why that is the case. More detailed logs could significantly improve the log collecting aspect.

Areas for improvement in Sophos Central are log collection, exclusion processes, and customer support. Aside from these points, I believe the overall product is great.

I have been using Sophos Central for the last six years.

Sophos Central is stable, which is a positive attribute.

I believe Sophos Central's scalability is good compared to other EDR solutions that we have.

Customer support for Sophos Central is a bit slow. When I create a support ticket, it takes a while for them to respond. In my recent experience with a support ticket, the engineer was not very effective and took longer than I expected. When we reach out to the support team, we anticipate quick answers, especially since the client is waiting for a resolution. The vendor seems to take time contacting other teams, so I feel the support team could improve their response times.

Before using Sophos Central, we had utilized CrowdStrike; however, due to an outbreak, some clients wanted to switch away from CrowdStrike. We provided clients with options, including Sophos Central and SentinelOne, with SentinelOne being fairly costly. Ultimately, most clients preferred Sophos Central, leading us to switch a few clients from CrowdStrike to Sophos Central.

I have seen a return on investment with Sophos Central in terms of needing fewer employees because Sophos Central is handling many tasks itself. Previously, we had to monitor other endpoints and faced issues integrating with ServiceNow, requiring separate monitoring. After adopting Sophos Central, we can easily integrate with ServiceNow, which means fewer employees, and that translates to money saved.

Before choosing Sophos Central, we evaluated other options such as SentinelOne and Microsoft Defender.

My advice to others looking into using Sophos Central is that it is beneficial in terms of cost efficiency and time efficiency. I recommend using Sophos Central and digging into the logs more thoroughly, and if possible, incorporating syslogs or other kinds of logs. I would rate this product a 7 out of 10.

Hybrid Cloud

Amazon Web Services  (AWS )

Positive

What do you like best about the product?

Single glass of pane to view and maintain all the Sophos products

What do you dislike about the product?

Support is not good
Very resource intensive

What problems is the product solving and how is that benefiting you?

Providing single glass of pane to maintain all the sophos products

What do you like best about the product?

Sophos Central is that it lets me manage everything—like computers, firewalls, and mobile devices—from one easy-to-use dashboard. I don’t have to jump between different tools; everything is in one place.The integration with other Sophos products is seamless, and their support team is always responsive whenever help is needed. It’s simple, clean, and gives real-time protection updates, so I always know my systems are safe.

What do you dislike about the product?

The initial setup can feel slightly technical for beginners.But overall, it’s still very reliable and easy to manage once everything is set up.

What problems is the product solving and how is that benefiting you?

Sophos Central helps us manage all our security needs from one place, which saves a lot of time and effort. Earlier, it was difficult to track and update multiple devices individually, but now everything is centralized and automated. It quickly detects and stops threats before they spread, keeping our systems safe. The real-time monitoring and detailed reports make it easy to spot issues early. Overall, it has improved our network visibility, reduced manual work, and strengthened our organization’s security posture.

What do you like best about the product?

It's very easy to centrally manage all of our Sophos customers from one location.

What do you dislike about the product?

The only thing I wish was different would be to either be able to access multiple clients at a time, or let it be easier to switch between clients.

What problems is the product solving and how is that benefiting you?

It gives us a central location where we can manage all our customers and their devices & firewalls.