Sophos

Market position

Sophos describes itself as operating one of the largest MDR operations in the world, with 40,000+ MDR customers and more than 625,000 protected organizations. Analysts and review platforms cited by the company include IDC (Leader, MarketScape for Worldwide MDR Services for Midmarket 2026), Frost & Sullivan (Leader, 2025 Frost Radar for MDR), Gartner Voice of the Customer (2026 Customers' Choice for MDR, 4.8/5.0 from 290 reviews, the most-reviewed vendor) and G2, where Sophos ranked #1 overall in endpoint protection, EDR, XDR, MDR and firewall software categories in the Spring and Fall 2026 grid reports. The company is best known for serving SMB and midmarket customers, with the Secureworks acquisition intended to strengthen enterprise and SIEM competencies.

Sophos positions its MDR service on the combination of agentic AI for speed and scale with human analysts who own response decisions, alongside vendor-agnostic coverage that allows customers to retain existing tooling. The company cites scale-based advantages: threat intelligence compounded across more than 625,000 protected organizations, over 500 included integrations, and what it describes as the most complete Microsoft security integration on the market. Full-scale threat removal without hourly caps or extra fees and customizable engagement models are also cited as differentiators.

Technology

Sophos MDR is built around an agentic security operations center in which autonomous AI agents perform investigation, threat hunting and automated response, escalating to human analysts for judgment-dependent decisions. The company reports that 52% of MDR cases are resolved end-to-end by AI and that automated response follows an alert in 89 seconds. The platform ingests telemetry from more than 500 third-party and first-party security and IT products across endpoint, network, cloud, identity, email and business applications; alert consolidation and clustering capabilities came in part from the 2022 SOC.OS acquisition, and the Taegis XDR platform came from Secureworks. Other assets include Sophos Firewall and XGS hardware, HitmanPro anti-malware technology, and an OpenAI integration announced in June 2026.

Go-to-market

Sophos sells largely through a global partner ecosystem of managed service providers, MSSPs, resellers and distributors, complemented by direct enterprise engagement. Channel-oriented programs include MSP Flex monthly billing and Firewall Hardware as a Service. Marketing leans on analyst and peer-review recognition, including Gartner Voice of the Customer, Frost Radar, IDC MarketScape and G2 grid rankings, and on case studies such as security support for the COP30 climate summit.

Organizations of all sizes across every industry and region, with particular strength in SMB and midmarket customers and growing enterprise coverage following the Secureworks acquisition. Customers include those running mixed vendor estates built on Microsoft, CrowdStrike, SentinelOne and other tooling, as well as channel partners and managed service providers.

Geography

Sophos is headquartered in Abingdon, England, with a UK corporate base and operations spanning Europe, Asia and North America across six continents. Acquisitions have added operations in the United States, Canada, Germany and India, and the company markets its services across every region. A 2025 partnership with IMS Networks delivers a Taegis-based 24/7 detection and response service from France.

History

Sophos was founded in 1985 by Jan Hruska and Peter Lammer and shipped its first antivirus and encryption products that year. Through the late 1980s and 1990s it sold security technologies primarily in the UK before concentrating on antivirus and expanding internationally. Apax Partners took a majority interest in 2010; Sophos listed on the London Stock Exchange in 2015 and was taken private by Thoma Bravo in a deal completed on 2 March 2020 at US$7.40 per share, an enterprise value of roughly US$3.9 billion. The company has grown substantially by acquisition, including ActiveState (2003), ENDFORCE (2007), Utimaco (2008, later divested), Astaro (2011), Cyberoam (2014), Surfright (2015), Barricade (2016), Invincea (2017), SOC.OS (2022) and Secureworks (announced October 2024, closed February 2025 for $859 million). Kris Hagerman resigned as CEO in February 2024 and Joe Levy, then president, became acting and later permanent CEO in May 2024.

Risks & controversies

In 2011 Utimaco Safeware AG, acquired by Sophos in 2008, was accused of supplying data monitoring and tracking software to partners that sold to governments including Syria; Sophos apologised, suspended the partner relationships and opened an investigation. Sophos disclosed in October 2024 that it had been targeted for years by China-linked adversaries, with attacks attributed to groups including APT41, APT31 and Volt Typhoon and links reported to the University of Electronic Science and Technology of China and Sichuan Silence Information Technology; the FBI sought public assistance in identifying the attackers. The company has also carried out workforce reductions, including a 10% cut reported in January 2023 and a 6% reduction of the combined workforce after the Secureworks acquisition closed in February 2025.