Cybersecurity as a Service for AWS

Sophos Heartbeat and the Sophos AI-driven ransomware protection for Sophos Cybersecurity as a Service are significant benefits. These are good add-ons for Sophos. The company performs well with Zero Trust Network Access, zero-day attack protection, and adaptive attack protection.

Automated Threat Response is quite beneficial in real time for Sophos Cybersecurity as a Service. It also stops the active threat response, which we call ATR. This is in sync with Sophos Managed Detection and Response, which is MDR. There is another extension feature called Security Heartbeat.

The main key feature of Sophos Cybersecurity as a Service is Sophos Heartbeat. The deep visibility provided by Sophos refers to their comprehensive real-time data collection and correlation across the organization's entire footprint, which includes Sophos EDR and Sophos Heartbeat features that enable central analysis and monitoring. This is quite easy, and Sophos MDR is also part of it, including Network Detection and Response.

In terms of improvement, Sophos testing after implementation is quite difficult. Sometimes it has software errors. When I put some policy on a network, it did not apply, and I had to check why this was happening. Sometimes this occurs because the software is not allowing it, or I could say the software is not supporting a specific policy implementation. Then sometimes I have to restart Sophos. I am talking in terms of a firewall.

There is sometimes a delay in the technical support of Sophos Cybersecurity as a Service, but I think nine out of ten is quite good from their end.

I started using Sophos Cybersecurity as a Service in 2020, and it has been three years.

There is sometimes a delay in the technical support of Sophos Cybersecurity as a Service, but I think nine out of ten is quite good from their end.

Sophos Cybersecurity as a Service is mostly user-friendly with a GUI. I think it was not complex, and it was quite easy to pursue Sophos integration with the system.

I think it depends on the complexity and the scope of work with Sophos Cybersecurity as a Service. If I am working on a firewall and I just have to route the internet and basic policies, then it could take hours. If I have to implement some complex topology, then it could take days. The test is quite complex.

The other product I asked about is Secureworks Taegis XDR, a network and detection response tool.

Sophos Cybersecurity as a Service is a quite decent product for a basic level or initial level assessment. I think it is not more appropriate, but it is good. My overall rating for this product is 7.5.

I want to discuss the experience with Sophos Cybersecurity as a Service products. I have familiarity with the service in general, but I do not have specific experience with Sophos.

Sophos Cybersecurity as a Service on endpoint security is a standalone solution installed on the PC that can be left to customers to manage themselves. When it comes to as a service, this is something different where we subscribe to the service from the provider and then let them handle the administration of the security on the customer's end.

We do not have that service ourselves, but we resell and provide bundled solutions. This type of software allows customers with IT teams to handle the deployment themselves. Endpoint security is not complicated when it comes to deployment, and the IT team can do it on their own. The issue is that I am mentioning the need for more education because customers are using the solution, but I do not think they are maximizing the use or the functionalities of the solution.

Last week when we talked about Sophos Cybersecurity as a Service, I did not mention whether I was using it. However, I have a background with as a service solutions, but on a different solution.

The R&D team is very good in doing their task and continuously conducting research. I cannot comment on what could be added in future updates of Sophos Cybersecurity as a Service that they need to do. However, it is more about engagement with the customer. There are AIs and self-paced trainings available, but delivering it to the customers and forcing the customers to learn more about the product is something that needs to be addressed through customer engagement. This is not on Sophos side, because a lot of improvements have been done with your solution, so I cannot comment more about it.

The customer is looking at price perspective, but what is more important is the support. The ease of communicating with the technical support is number one. It is all about the support, and not only engaging support on some issues or concerns, but also providing education to the customers is important. Providing ways such as demo labs and online self-paced training that can be communicated by the distributor on how to access them and how to utilize and leverage all these things so that the information is properly distributed to our customers and to the partners is essential.

When I told you that I want to talk about it, it was because I want to know more about discussing Sophos Cybersecurity as a Service that Sophos is providing.

When it comes to the return on investment with the vulnerability solution, it is nice to have in the organization. However, when it comes to compliance, a third-party assessor is required. If I buy or if I am an organization who subscribes to or buys a solution like a vulnerability assessment tool, this is just a tool for the organization. It is better to buy it, but I do not think it can be used to submit to some compliance because a third-party assessor for vulnerability and penetration testing is needed. Huge organizations can have that so they have their own assessment on their own, but services to other or third parties must be done to comply with the requirement or the regulation for security.

Most of our customers are very cautious about the data that they are keeping, so they prefer buying Sophos Cybersecurity as a Service directly from Sophos or third-party vendors to building their infrastructure on their premises.

This is based on experience with not so huge customers. Our distributor is very supportive, and from their end, if we do not know how to escalate the problem to the support, they extend their help by doing so for us. If they can solve it on their own, then they help solve it. Support comes not only on problems in terms of security, but also on other matters such as concerns, questions, or inquiries about the license and inquiries about the best way to deploy it. The perspective comes from our distributor, and I would rate the overall review as an eight.

Sophos Cybersecurity as a Service is an on-premise solution. This is the first implementation of Sophos Cybersecurity as a Service with Citrix, and otherwise we are going with the Sophos XDR solution instead of a third party, as we are currently using Trend Micro, which is not working properly with Sophos.

The thin client is not compatible with the Sophos firewall, and we found the fault in the Sophos solution. They have now released a light version of the XDR, and that type of activity is what we are coordinating in the backend.

The best feature of Sophos Cybersecurity as a Service is the XDR, along with remote management, which is particularly beneficial for small and medium environments.

We and our customers use the automated threat response feature, which is included but requires a license. For example, one of the banks using XDR provided by Sophos is very happy, and we conduct remote sessions with XDR, ensuring our involvement is minimal, leading to customer satisfaction.

I assess the value of deep visibility into network activities provided by Sophos Cybersecurity as a Service as good enough, especially regarding firewall and wireless aspects, with new switching features introduced that are acceptable.

There are a lot of technical issues with the implementation of Sophos Cybersecurity as a Service, particularly because we are currently implementing the XG series, where Citrix is the endpoint, leading to a lot of confusion. The XDR client is not working, so we are taking time for research and development, and they are providing us with whatever solutions from the company, even a lighter version of the XDR for this particular Citrix thin client.

Product-wise, improvements need to be made in Sophos Cybersecurity as a Service, particularly because they do not have a testing lab for the implemented customer environments. We have implemented a large environment where a number of problems occur, and they are unable to provide on-the-spot solutions, often taking five to ten days to set up a lab at the customer's premises to identify solutions.

I have been working with Sophos Cybersecurity as a Service since 1994, almost 30 years, starting with Astaro, which is the original security company that Sophos has taken over, and nowadays Sophos is the product.

I do not face many challenges, but we did encounter ransomware attacks at two to three locations, and Sophos Cybersecurity as a Service protected us immediately, within three to four seconds, providing alerts about ransomware threats, leading to automatic disconnections when necessary.

Cloud-based operation is nowadays required for centralized management since all servers and resources are being kept in the cloud, and future developments must trend towards cloud solutions.

However, we are not promoting cloud solutions to our customers, as our business remains focused on on-premise setups.

I rate the technical support of Sophos Cybersecurity as a Service an eight compared to Juniper, also an eight, but primarily due to timing issues. They are technically strong, but their resources are problematic, and timing is also an issue as nowadays people require solutions on-demand.

I am also a partner with Juniper, Cisco, and everything, because I am a system integrator, so I have to maintain relationships with all OEMs.

There is definitely a return on investment when using Sophos products; it all comes down to how deployment is managed, as policy is crucial. Initiating a deny everything approach before gradually allowing access is the best way to ensure security.

The pricing of Sophos Cybersecurity as a Service is approximately 60 percent that of Cisco, as Cisco requires a greater number of licenses to meet its requirements, while Sophos and Juniper, along with Fortinet, offer lower prices. In negotiations, Fortinet and Sophos have almost equal prices, allowing for competitiveness in order acquisition at the negotiation table, leading to price reductions.

This is the first implementation of Sophos Cybersecurity as a Service with Citrix, and otherwise we are going with the Sophos XDR solution instead of a third party, as we are currently using Trend Micro, which is not working properly with Sophos. The thin client is not compatible with the Sophos firewall, and we found the fault in the Sophos solution. They have now released a light version of the XDR, and that type of activity is what we are coordinating in the backend.

I do not fully understand the metric used to measure the effectiveness of Sophos threat intelligence capabilities. However, we do have one scheme, which involves dedicating manpower for customer support. For larger customers, we assign dedicated personnel who understand the ins and outs of their needs, which helps streamline processes without needing repeated explanations.

We work with Sophos XG Firewall including Sophos Agent for Servers. Most of my customers are maintaining developer environments and want to secure their developer environments by preventing uploading and use of phishing websites and outbound emails to public email services like Hotmail and Gmail. They want to secure their environment to block users from sending emails to public email addresses and prevent uploads with this security measure.

Sophos Cybersecurity as a Service offers very tight security and compliance. If anybody applies Sophos at their premises, the environment is completely secure and sound.

The biggest advantage I achieved with Sophos Cybersecurity as a Service is the upload block. I never achieved it with other products, and Sophos completely delivered on this. We completely block uploads from any website and anywhere in the environment. No one can upload without our permission.

There are many reasons why Sophos is better in comparison with other solutions, but our focus was blocking uploads. The most important thing in our environment is blocking uploads, and we achieved this target with Sophos. Sophos Cybersecurity as a Service also protects against malicious websites and performs antivirus scanning and blocks all threats that any XG firewall is supposed to achieve.

The automated response is excellent because the portal handles almost everything on a single dashboard, and we can manage and control everything automatically. This is really systematic and automated. It is absolutely highly scalable.

I don't think there is anything to improve in my experience because I found Sophos already maintains regular updates and provides support portals in proper order. I don't find anything to recommend for improvement.

I have been working with Sophos Cybersecurity as a Service for around five years.

It is 99% stable.

The support I experienced is extremely good. I always found the support persons very friendly and helpful, and they always try to fix the service at any cost and are available anytime.

Before using Sophos Cybersecurity as a Service, we tried Cisco and other firewalls, but when we experienced Sophos, it really did what we wanted to achieve.

Previously we were using AWS, but recently we have moved to a hosting service. Both are compatible with using Sophos Cybersecurity as a Service.

I found the installation is very simple. I just need to run the installer and it completes in one go by itself. There is no complex installation required.

Our service provider in Canada is the company NE Format. The representative is Saif Khan. He provides all Sophos Cybersecurity as a Service-related services to us. He controls many things on his end, including the portal management of Sophos Cybersecurity as a Service, and I just look after the user environment. The provider manages it at their end, and Mr. Saif Khan from NE Format in Canada handles the implementation.

For the Pakistan region, this is very expensive. Not anyone can afford it. It is expensive, but it is worthwhile for paying the investment. However, it is not affordable for everyone. Only very high and large enterprises can afford it.

I never bought any service of Sophos Cybersecurity as a Service from anywhere else because we bought it from a reseller located in Canada who handles everything for us.

Users never prefer to be blocked from performing activities. If you block users from doing activities, they do not prefer it. That is a security requirement, but as a technical provider, I understand this is important to do. We are using a product that offers EDR as well. I rate this review as a 10 out of 10.

We are working with Trend Micro as a competitor, and it is also a great experience. I am using Trend AI Vision One. I know the Secureworks product for XDR and EDR; I know they acquired Secureworks. We do not have any customers of Secureworks yet, but we are trying to pitch it and develop some business with Secureworks as well. We are working with Sophos Cybersecurity as a Service.

We started working with Sophos Cybersecurity as a Service last year and we have some customers for Sophos in the resolution which is Cybersecurity as a Service. Sophos teams work with these customers to secure them and integrate them in case of any issues, and they are really satisfied with the product; it is a good one.

Customers basically use Sophos Cybersecurity as a Service against ransomware attacks, especially when they are not in their operational hours such as during the night, on weekends, or holidays when their team is not directly available in the premises to secure something. In that case, they need these services so that someone reliable is watching their network to avoid any ransomware attacks.

There are multiple benefits of Sophos Cybersecurity as a Service. The biggest one is that it will save any stoppage of services; for example, if there is a hospital environment that faces any ransomware attack, it may stop their operations. This solution helps them to maintain their uptime and ensure business continuity 100%, which is a very good thing. Secondly, it helps avoid financial losses; once the data of the company is encrypted due to a ransomware attack, they obviously face financial losses and may be asked for bigger ransom amounts. Sometimes a company has to pay them; to avoid these issues, there is no surety of getting data back even after paying the ransom. Additionally, there are various kinds of attacks nowadays, such as CNC attacks, where someone may be using their resources for bad purposes; these services stop any unethical behavior, ultimately helping the customer to increase their productivity and financial growth.

The automated threat response feature of Sophos Cybersecurity as a Service is definitely very helpful.

Most of the companies do not have cybersecurity experts, particularly mid-level or small enterprises; they cannot afford cybersecurity experts or SOC teams. With this product, they do not need to go through extensive learning in cybersecurity; the automatic mitigation helps them to focus on their work and avoid problematic behaviors. There are some IT staff who do not have any security background, which means they do not need to get involved when reliable products are handling this.

Network visibility with Sophos Cybersecurity as a Service is positive and brings benefits; they are connected with your network, providing a larger view and a dedicated team who understands all the ins and outs. For instance, some equipment such as PBX systems or CCTV cameras in the network typically are not viewed as potential threats, but these services help monitor even those, ensuring protection.

Features such as threat hunting and forensics are definitely effective for cybersecurity; for example, we might not know if our management team addresses, such as our CFO or CEO email addresses, are being misused on the dark web for phishing attacks. These solutions help us to see any misuse of our resources, effectively preventing such issues.

I would suggest improvements such as integrating a third-party platform or making the products mature enough for customers who do not use Sophos switches or similar hardware, allowing security integration. If a firewall or another security solution could learn logs from attacks originating from switches or CCTV systems, it should be accessible enough for a regular network engineer or security engineer to understand and handle.

Sophos Cybersecurity as a Service does not have any glitches; it is very stable.

It is very scalable without any limitations.

The customer support from Sophos is great; they are very supportive and available 24/7. It depends upon the region, but they are accessible whenever we approach them, and they engage their development team and a global escalation team when needed, providing an exceptionally strong support system.

We work with other products as well, but we are the Platinum Partner of Sophos in Pakistan.

It is very easy to install, and I give full marks for the easiness of the solution.

I believe it is more than 30% ROI. While it is hard to quantify exactly, when you consider data theft and customers protecting billion-dollar data assets, the price of the solution is only about $4,000 to $5,000 per year. The ROI provided by these solutions is more than 100%, making it a very economical choice, thus worth buying.

The price for Sophos is somewhere in the middle; it is a good price. They offer good discounts for customers and have competitive pricing when compared to their competition such as Trend Micro and other high-end products. It is very aggressive pricing.

Sophos Cybersecurity as a Service utilizes its own cloud, which may have integrations with other services, but they provide their cloud for customer console access.

Centralized management is very important for cloud-based operations because most companies have multiple branches and offices in different cities. It really helps us manage, especially if a customer has 300 firewalls and 2000 endpoints spread across various offices; it becomes much easier to manage everything centrally. If they need to push a policy for internet validation, all their endpoints or users can be managed from a single interface, which is very effective.

It is not exactly a disadvantage, but it does impact the company financially. These are services that the company must purchase, whether from Sophos or other providers, which impacts their finances. Thirty or forty years ago, without internet or network connectivity, companies did not have to worry about data theft and could focus on operations. Now, no solution can guarantee 100% security. Unless a company invests in a firewall for network security, endpoint protection, network detection and response, MDR, security-as-services, and patch management, their finances are heavily drained due to these cybersecurity solutions, and this burden will only increase over time. Other than that, I do not find any disadvantages; the products are very good and competitive.

I give this solution a rating of 9 out of 10. It is worth buying and definitely provides ROI.

My main use case for Sophos Cybersecurity as a Service is to stop ransomware attacks. I work for a manufacturing company with a total of 2,500 employees across 15 locations, Microsoft 365, VMware servers, Windows laptops, OT environments, and a hybrid workspace. An employee received a phishing email with the subject around invoice payment pending, and the attachment contained malicious macros. The user enabled the macro, and PowerShell downloaded ransomware. Sophos' email security helped beyond what is expected, as it checks the SPF, DKIM, DMARC, sandboxing, reputation, and AI detection. Suppose this is a zero-day attack; the email bypasses the filtering. Overall, Sophos XDR automatically correlates all the logs from the endpoint, the firewall, the identity email, and the cloud, allowing analysts to immediately see patient zero, the download file, PowerShell command, network connections, registry changes, and lateral movement attempts. Everything appears on a single investigation timeline.

A little more on the use case: Intercept X detects the malicious behavior, and CryptoGuard stops the encryption and restores the modified files. XDR correlates telemetry, MDR validates the threat, and performs 24/7 response, while the firewall blocks the attacker's communication.

The best features Sophos Cybersecurity as a Service offers is that instead of treating endpoint, firewall, email, and mobile security as separate products, Sophos enables them to communicate automatically through Security Heartbeat. An example would be when an endpoint becomes infected; Sophos Intercept X causes the firewall to isolate the device, block the malicious IP address, and prevent lateral movement automatically, reducing response time from minutes to seconds.

Automatic communication between Sophos products helps my team day-to-day by significantly reducing manual effort and speeding up incident response. Instead of analysts having to investigate alerts across multiple consoles, Sophos shares threat intelligence automatically between endpoints, firewalls, email security, and the management platform. This means that when one product detects a threat, the others immediately take coordinated action.

Sophos Cybersecurity as a Service has positively impacted my organization by simplifying cybersecurity operations while improving our ability to detect and respond to threats. Its integrated platform reduces the need to manage multiple disconnected tools, allowing our security teams to work more efficiently. Features such as automated threat correlation, endpoint isolation, and managed detections and response help reduce incident response time and minimize the impact of cyberattacks. For organizations with limited cybersecurity resources, Sophos also provides enterprise-wide protection through its MDR services without requiring a large in-house SOC.

Sophos Cybersecurity as a Service is a mature platform with strong endpoint protection, MDR, and integrated security capabilities. However, areas exist where it can continue to evolve. I see opportunities around AI-driven automation, cloud-native security, identity protection, third-party integrations, executive reporting, and proactive risk management.

Sophos already provides a strong integrated security platform with MDR, XDR, endpoint protection, and firewall integration. The next evolution is to become even more predictive and autonomous. I would like to see deeper AI-driven response automation, enhanced cloud and identity threat detection, broader third-party integrations, executive-focused risk dashboards, automated compliance mapping, and continuous external attack surface management. These enhancements would not only improve security outcomes but also help CISOs better demonstrate cyber risk reduction and business value.

To make it a ten, I would like to see cloud-native workload protection and identity security deeper compared with some specialized competitors. Some enterprises with highly customized SOCs may prefer broader native integration and automation available from platforms such as Microsoft, Palo Alto Networks, or CrowdStrike. Further enhancement in executive reporting and exposure management capabilities is also needed.

I have been working in my current field for 20 years.

Sophos Cybersecurity as a Service is stable.

I would rate Sophos Cybersecurity as a Service scalability at 9 out of 10. It's designed to scale from small businesses to large enterprises without requiring significant changes to the underlying platform.

Customer support is really good. I would rate the customer support a 10 out of 10.

I did not previously use a different solution.

Overall, my experience with pricing, setup cost, and licensing has been positive. I would rate the pricing setup to be 8 out of 10. Sophos offers competitive pricing, especially for organizations looking for an integrated security platform rather than purchasing multiple standalone products. The licensing model is generally straightforward, with flexible subscription options based on the organization's requirements. The initial setup costs are reasonable, particularly for cloud-managed deployments through Sophos Central. Overall total cost of ownership can be lowered because endpoint, firewall, email security, and MDR services are managed through a unified platform.

I have seen a positive return on investment, primarily through improved operational efficiency and faster incident response rather than reducing headcount. Sophos centralized management, automation, and MDR capabilities allow my security team to spend less time on repetitive tasks and more time on higher-value security activities. One example was a phishing incident that resulted in malware execution on a user laptop. Sophos detected the suspicious behavior, isolated the endpoint automatically, and prevented lateral movement. Because the investigation data was already correlated in Sophos Central, the analyst completed the investigation in 20 minutes, whereas previously, it could have taken close to an hour by manually reviewing multiple security tools. The incident was contained to a single endpoint, and the user experienced minimal disruption.

Before choosing Sophos Cybersecurity as a Service, I evaluated other options, including Microsoft Sentinel.

My advice to others looking into using Sophos Cybersecurity as a Service would be to first understand their organization's security maturity, business requirements, and existing technology stack. Sophos Cybersecurity as a Service delivers the most value when you leverage it as an integrated platform rather than deploying individual products in isolation. If you're looking for centralized management, strong ransomware protection, 24/7 managed detection and response, and reduced operational complexity, it's a compelling choice. I would also recommend planning the deployment carefully, defining security policies upfront, and investing time in tuning the alerts during the initial rollout to maximize effectiveness and minimize unnecessary noise. I would rate this solution an 8 out of 10.

Sophos Cybersecurity as a Service serves as our main solution to maintain a 24/7/365 security operations center that oversees our networks, computers, and servers, ensuring that if a breach occurs, the team will remedy it and eradicate the intruder.

A specific example of how Sophos Cybersecurity as a Service helped my team occurred three weeks ago when one of our employees clicked on a phishing link. Sophos was able to stop the employee, halt the attack, reset the user password, block all activity, and effectively counteract the situation due to their integration with M365.

Sophos Cybersecurity as a Service offers several valuable features, including weekly and monthly reports, direct communication about incidents, swift responses typically within two minutes for cases or questions, security assessments of our environment, and security posturing of our environment.

Among these features, my team relies on the reports most significantly because they provide important insights into what is happening on the machines and the network on a weekly basis.

Sophos Cybersecurity as a Service has positively impacted our organization by providing management with confidence, knowing we have one of the best MDR services overseeing our entire ecosystem. We also benefit from a breach protection warranty that can provide up to one million US dollars.

This service has allowed my team to work more efficiently on other tasks rather than constantly monitoring every single notification, report, or incident that comes in, as the Sophos team investigates these on our behalf.

Currently there are not any major upgrades necessary, but the ease of use of reports could probably be enhanced. I would suggest making the reports easier to understand.

I have been using Sophos Cybersecurity as a Service for four years.

Sophos Cybersecurity as a Service is very stable, and as of today, we have had no issues.

Its scalability is remarkable, allowing for very easy scaling up or down without any complexity. It is one of the easiest solutions we have encountered.

Customer support is fantastic, and we have never had any issues. When we create a ticket in the Sophos portal, they respond quickly based on the tier of urgency.

We previously used Fortinet before switching to Sophos Cybersecurity as a Service. The reasons for the switch include Fortinet's increase in costs and the complexity involved in licensing and additional storage required for features that Sophos offers.

Pricing for Sophos Cybersecurity as a Service was excellent, and the setup was extremely easy.

I have seen a return on investment primarily through time saved. My team can focus on core functions rather than monitoring reports or alerts that come into the Sophos Central portal daily.

Before choosing Sophos Cybersecurity as a Service, we did not evaluate other options. We went with Sophos because we heard positive feedback from others and conducted our own due diligence.

Sophos Cybersecurity as a Service's AI capabilities are impressive, as I believe its governance and security are very strong. The AI is highly intuitive, providing a lot of insights into case details and threats, breaking down complex information into layman's terms for our management to understand easily.

So far, the accuracy and reliability of the AI output have been spot on, and we have seen no real issues with it to date.

My advice to others considering Sophos Cybersecurity as a Service is to conduct a proof of concept to see what it offers. Once you try it, you will realize how easy it is to manage, how intuitive it is, and the wealth of information available from it.

In conclusion, I believe Sophos Cybersecurity as a Service is an excellent solution that simplifies cybersecurity tasks, allowing my team to focus on essential areas. I rate this solution a nine out of ten.