The Standout feature for me is Synchronized Security / security Heartbeat functionality across our endpoints and firewalls . Having Intercept X talking directly to the Sophos XGS firewall in real -time has saved out team multiple times . if users laptop pick something suspicious or triggers an alert, the firewall immediately isolates that host from the rest of the VLAN without requiring us to jump in manually out of hours .

from a management standpoint :

Centralized Policy Deployment : Pushing global polices or overriding settings for specific user groups (like developers vs general staff) is straightforward once you understand policy inheritance.

Live Discover(XDR): Being able to execute quick sql queries across our entire fleet to look for specific IOCs or missing KB updates saves us from running separate PowerShell scripts via RMM.

BitLocker Recovery: Helpdesk agents can grab BitLocker recovery keys in under 10 seconds straight from the users object page, which trimmed down our lock out ticket times significantly .

Threat Graphs : The root cause analysis visualization (Showing process parentage , modified files , and network connections) makes post-incident write-ups fast and easy to explain to non technical managers . Review collected by and hosted on G2.com.

While the core detection and cloud UI work well overall, there are definitely areas where it feels unpolished :

Local Resource Usage : On older machines or developer workstations, the deep learning files scanning and memory protection can lead to noticeable CPU/disk usage spikes.

Developers compiling local code or running Docker containers frequently hit false positives or slowdowns until we set up granular folder exclusions .

Support Turnaround : Opening a ticket directly through the portal of technical glitch or false positive reviews can feel like a black hole. Standard tier support takes too long to escalate beyond initial "have you restart the agent" scripts.

Deep Navigation & Reporting Constraints : Basic dashboard are great, but custom scheduled reporting feels clunky . Finding specific nested setting like Tamper Protection overrides or specific web control sb categories often takes 3 to 4 clicks deeper than it should. Review collected by and hosted on G2.com.

I have been using Sophos Central for a long time now as part of my daily work as a network security engineer at Vibs Infosol Pvt Ltd. I work as an admin on this platform, and honestly it has changed the way I manage security for my company completely.

The biggest thing I like is that it is a true all in one management platform. Before Sophos Central, I had to log in separately to manage firewall, then separately for endpoint protection, then separately for mobile device management (MDM). This used to take a lot of time and it was easy to miss something because everything was scattered in different places. Now with Sophos Central, I log in just once and I can manage firewall, endpoint protection, MDM, email protection, everything from one single dashboard. This one change alone has saved me at least 1-2 hours daily, because earlier switching between different logins and consoles used to break my focus and waste time.

I currently manage more than 200 users at one time through Sophos Central, and honestly without this centralized platform, that would have been very difficult to handle manually. I can push policies to all users or specific groups of users in just a few clicks, instead of configuring each device one by one. For example, when we need to update a web filtering policy or a device encryption policy, I create it once in Central and apply it to all relevant devices together, which used to take a full day earlier if done device by device, now it takes less than 30 minutes.

The endpoint protection management inside Central is something I use daily. I can see the health status of all endpoints, which devices are updated, which devices have threats detected, all in one view. If any device shows a red or risky status, I get alerted immediately and I can take action, either isolate the device or push an update remotely, without physically going to that system.

MDM (Mobile Device Management) is another feature I use regularly, especially since more employees now use mobile devices and laptops for work from different locations. I can enforce security policies on mobile devices, track compliance, and even remotely wipe a device if it is lost or stolen. This gives me peace of mind knowing company data is protected even outside the office network.

The reporting feature in Central is also something I rely on heavily for my monthly and weekly management reports. Instead of manually preparing data from multiple sources, Central gives me ready graphs and summaries for threats detected, policy compliance, and device health, which I directly use for reporting to my seniors. This alone saves me several hours every month that I used to spend on manual reporting work.

An unexpected benefit I discovered is the alert and notification system. Even when I am not actively logged in, I get email alerts for critical issues, so I don't have to constantly monitor the dashboard, I get informed automatically the moment something needs my attention.

Performance wise, the platform loads quickly and even with 200+ users and multiple products connected, I have not faced major slowdown or lag while navigating between sections.

Overall, the biggest value for me is time saving, better visibility, and centralized control which has made my daily admin work much more manageable and less stressful. Review collected by and hosted on G2.com.

Even though I rely on Sophos Central heavily every day, there are a few things I feel could be improved, though none of these are big enough to make me want to switch to a different product.

The first thing is the initial learning curve. When I started using Central, understanding the structure of policies, groups, and how different products (firewall, endpoint, MDM) connect within Central took me some time. The interface has a lot of options, and for a new user it can feel a little overwhelming initially. Better guided onboarding or in-app tutorials would help new admins get comfortable faster.

Second, sometimes when there are updates or changes happening on the Sophos backend, the dashboard becomes a little slow to load for a short period. It is not very frequent, but when it happens during an urgent task, it becomes slightly frustrating.

Third, I feel some advanced settings still require you to jump into individual product consoles rather than being fully available inside Central itself. For a platform that promises everything in one place, a few deep configuration settings still need separate access, which slightly breaks the fully centralized experience.

Fourth, on pricing, since we manage 200+ users, the licensing cost adds up when you combine firewall, endpoint, and MDM licenses together under Central. For a growing company, understanding the total cost and getting the right ROI clarity took some effort initially. Once I understood the value, the time saved and improved security clearly justified the cost, but the initial pricing structure could be presented more simply.

Fifth, support response time is sometimes a bit delayed for non-critical tickets. For urgent security issues, I usually get quick help, but for smaller configuration doubts, I sometimes wait longer than expected.

Even with these points, I want to be fair and say these are minor issues compared to the overall value I get daily. I consider these areas for improvement rather than reasons to stop using the product. Review collected by and hosted on G2.com.

Unified Management (Single Pane of glass) Managing endpoint protection server defense email filtering and firewall policies from one central console significantly cuts down on context switching pushing global policies setting up exclusions and pushing agent updates across device groups is straightforward once the tenant structure is established.

Intercept X & Crypto guard feature are top tier in instances halts the process and automatically rolls back targeted files from local shadow copies before damage occurs.

Synchronized security (Security Heartbeat) If you run Sophos Firewall alongside Sophos Central endpoint the security Heartbeat Features is an operational game changer If a device drops to a Red Helt status due to a threat the firewall automatically restricts its lateral network access until remediated. Review collected by and hosted on G2.com.

Minor Resource Impact on older Hardware

On legacy or budget-tier client machines (especially those with spinning HDDs) background deep scans can cause occasional CPU spikes modern machines with standard SSDs and 16 GB RAM run the agent without any noticeable lag.

Reporting Customization limits

The built-in Executive summaries and compliance reporting dashboards requires upgrading complex Highly customized reporting Dashboards requires upgrading to full XDR or Exporting logs to an external SIEM. Review collected by and hosted on G2.com.

Th biggest selling point for our team is heaving the firewall (XGS series)and our endpoint protection living in the exact same dashboard. The "Synchronized Security" Feature specifically the security heartbeat is incredibly useful If an endpoint gets infected or starts showing suspicious behavior, it automatically drops its heartbeat, and the Sophos firewall Isolates it from the rest of the VLAN instantly without me having to LOG in manually after hours to kill the switch port.

From an Admin perspective managing global policies is straightforward. If i need to create a peripheral control policy to block rogue USB drives or add a global threat exclusion for a quirky legacy line-of-business app I can push it out to the entire tenant in a few clicks. tamper protection is also robust: they know IT can't easily kill the service or tamper with the registry to disable it. Review collected by and hosted on G2.com.

My main complaint is the resource footprint of the endpoint agent on our older endpoint if you have users running older laptops or developer machines doing heavy compiles, they will absolutely notice a slowdown during a full scheduled scan when or when Sophos is processing deep learning malware analysis on localized files. CPU spikes are a common helpdesk ticket item for us on those specific machines. Review collected by and hosted on G2.com.

In my experience, using Sophos has been a very good decision. It has allowed me to have everything centralized in Sophos Central, which makes it much easier for me to control and manage security.

Additionally, I greatly value its product integrations, because everything works together and improves incident response. The performance is quite stable and does not significantly affect the devices. As for the price, I consider it competitive for everything it offers. I have also had good experiences with technical support, which usually responds efficiently. And something that adds a lot is the use of artificial intelligence to detect threats more quickly and accurately.

in addition to its interactive and efficient UI. Review collected by and hosted on G2.com.

they could improve the sections on reporting and the generation of more up-to-date reports. Review collected by and hosted on G2.com.

The portal is easy to use, and each module is explained with clear, specific details. Integration with the endpoints is straightforward and accessible whenever needed.

Sophos installed on each endpoint receives updates at regular intervals, and the same status is visible in the admin console as well. Overall, the performance has been consistently reliable and never disappoints.

The pricing has gone down, which is a positive change, and it now meets all the expectations we had.

The vendor NetNxt, which we collaborate with for Sophos, has been helpful and responsive, and they answer whenever we need support.

I haven’t used the AI feature in the console yet, so I don’t have much to say about it.

The protection it gives for the endpoints is magnificent along with the tune able policies as per our needs. Review collected by and hosted on G2.com.

Few time there is a lag between the policy which are pushed to the endpoints and have to wait a long time to get it reflected.

IF this could be Improved that would be a great help. Review collected by and hosted on G2.com.

What I like most about Sophos Central is its unified management platform, which gives me full visibility and control across all security layers from a single console. It streamlines day-to-day operations by bringing firewall, endpoint, MDR, and email protection together in one place. The real-time alerts, synchronized security, and detailed reporting also make a noticeable difference in incident response and threat detection. On top of that, the cloud-based management makes it easy to deploy, manage policies, and troubleshoot remotely, which saves time and improves overall efficiency. Review collected by and hosted on G2.com.

Some advanced configurations require switching to the local firewall, and reporting/customization options could be improved. There can also be occasional sync delays between devices and Sophos Central. Review collected by and hosted on G2.com.

What I like best about Sophos Central is the single cloud-based console that lets me manage all the endpoints from one place without any on-premise setup. The most helpful feature has been the automated threat response, it isolates infected devices instantly without any manual intervention, strong threat detection with low false positives, and synchronised security between endpoints and the firewall, making it a well rounded and efficient solution for day-to-day IT management. Review collected by and hosted on G2.com.

The reporting features feel a bit limited out of the box getting detailed or customised reports often requires extra steps or third party integrations. First line support can also be inconsistent at times, where resloving issues sometimes takes longer than expected. Licensing costs can add up as the number of devices grows, which may be a concern for budget conscious environment Review collected by and hosted on G2.com.

One of the best aspects is the single dashboard view, where I can monitor firewall, endpoint, and user security status in real time. I frequently use the Alerts & Events section to quickly identify critical threats and take immediate action.

The Device Management panel is very helpful for checking endpoint health, applying policies, and isolating compromised systems remotely. I also rely on the Threat Analysis Center to investigate malware detections and review root cause analysis.

The policy management feature allows me to modify web control, application control, and threat protection policies easily without logging into multiple systems. Additionally, the reporting section helps me generate scheduled reports for management and customers.

Overall, the centralized control, real-time visibility, easy policy deployment, and detailed reporting are the features I use the most, and they significantly reduce administrative workload. Review collected by and hosted on G2.com.

All good, full fill my all requirements. Review collected by and hosted on G2.com.

The unified cloud dashboard makes managing endpoint security across multiple devices effortless. Rolling out agents, pushing policies and viewing threat alerts happen in real-time without managing on-premise servers. The integration with intercept X provides solid anti-ransomware protection out of the box. Review collected by and hosted on G2.com.

The interface can occasionally feel sluggish during high traffic updates, and search query filters in the logs could be more intuitive, initial deployment on legacy OS machines can also require occasional manual troubleshooting. Review collected by and hosted on G2.com.