Sophos Endpoint Reviews & Product Details

I like how it's implemented and that, at the level of security policies, it gives you a score to validate if you have what's recommended by the manufacturer or where you need to fine-tune the settings to ensure the protection of your endpoints. Review collected by and hosted on G2.com.

I don't like that in the FIM (File Integrity Monitoring) module, you can't see the security logs. Additionally, it has high CPU and RAM consumption; sometimes, the process can consume more than 50% of the RAM, causing the system to slow down, even if exclusions are configured, the consumption can still be perceived as high. Review collected by and hosted on G2.com.

What I like about Sophos Endpoint is that it mostly runs in the background without needing much attention. It's quite easy to use from an end-user perspective, and I don't really have to worry about manually running scans or checking for security updates. I also like that it provides protection without constantly interrupting my day-to-day work. For a tool that's mainly there to keep your device secure, that's pretty much what I'd expect. Review collected by and hosted on G2.com.

One thing I find a bit annoying is that it can sometimes use quite a bit of system resources, especially when running scans or updates. There isn't always much visibility into what's happening in the background either. Also, when something gets blocked or flagged, it's not always clear why, and you may need to reach out to IT to understand or resolve it. I feel the notifications and error messages could be a bit more helpful. Review collected by and hosted on G2.com.

As both an end-user on my daily work machine and an administrator managing a mid-sized deployment, what stands out most about Sophos Endpoint (Intercept X) is its reliable "set-it-and forget-it" nature.

From an administrator's perspective, the Sophos Central cloud dashboard is clean, unified, and remarkably straightforward to navigate. Pushing out agent packages, grouping devices, and enforcing baseline security olicies across Windows and macOS endpoints takes very little time. Features like CryptoGuard and deep-learning threat detection operate proactively in the background without constantly flooding end-users with annoying false-positive pop-ups.

As a regular user, I appreciate taht the software doesn't cripple system performance during daily tasks. The tamper protection feature also provides great peace of mind organization-wide, ensuring that settings cannot be accidentally or maliciously disabled by local users. Review collected by and hosted on G2.com.

No security suite is entirely without flaws. From an admin standpoint, the nested menus within Sophos Central can occasionally feel a bit convoluted when you are hunting for very specific, granular configuration overrides. Review collected by and hosted on G2.com.

From an operational standpoint, the biggest win with Sophos Endpoint is how much work Sophos Central Handles automatically without requiring constant manual intervention.

Ransomware & Anti-Exploit Defense : The behavioral engines (CryptoGuard and exploits mitigation) are genuinely strong. It catches fileless threats , malicious PowerShell Scripts, and unauthorized process injection at execution time rather than relying solely on legacy signature updates.

Root Cause Analysis (RCA) Graphs: When threat or suspicious file gets flagged, the threat graphs shows precisely where the vector originated , which child processes were spawned , what registry key were touched. It cuts incident triage time down from hours to minutes.

Automated Device Isolation : If an endpoint exhibits malicious behavior , Sophos isolates the machine from the local network while maintaining a management tunnel back to Sophos central. This gives as breathing room to remediate without risking lateral movement across our subnets or VPN .

Centralized Policy Management : Pushing global policies , web filtering , and USB control across remote and on premise endpoints is straightforward once you structure your device groups properly. Review collected by and hosted on G2.com.

While protection is top tier there are few practical trade offs every admin should keep in mind :

Resource Usage during Deep Scans & Compiles : Even with recent agent optimization ,heavy disk or CPU activity can still occur during full background scans. If you have developers constantly compiling code or engineers running heavy CAD/3D software, you will need to spend time configuring fine-grained application exclusions to prevent occasional slowdowns.

Granular Policy Navigation : Sophos Central is clean, but finding deep configuration toggles-like specific AMSI exemptions or subtle server policy overrides can sometimes feel buried under multiple sub minus.

False Positive on Custom Scripts: Of your internal team uses custom PowerShell deployment scripts or custom PowerShell deployment scripts or unassigned internal executables HitmanPro/behavioral monitoring may occasionally flag them as dynamic shellcode until you create explicit SHA-256 or folder exclusions. Review collected by and hosted on G2.com.

It's Easy to Deploy to Client Machines & Sophos Endpoint is advanced threat detection with centralized management through Sophos central, real time threat intelligence. Review collected by and hosted on G2.com.

Sophos Endpoint not much DLP Features its too minimal features list

Provide some more Features in list Like Screenshot capture block, Attachments not upload to via mails Review collected by and hosted on G2.com.

Crypto Guard Anti Ransomware the ransomware rollback feature is the strongest dealing point in real world scenario where executable behavior trigger a threat alert Crypto guard halts the process and automatically restores encrypted files from cache without needing to restore full disk backups.

Centralized Cloud Management Sophos central Managing endpoint policies deployment and alerts across multiple workstations and servers from a single dashboard is straightforward Global policy updates push out quickly without needing complex on premises server infrastructure.

Root cause analysis when a threat or suspicious process is detected the incident graph gives clear visibility into how the payload entered email attachment vs browser download what registry keys were modify and which child processes were spawned this saves a lot of time during post incident analysis.

Low Maintenance Day-to-day Agent updates and background definitions handle themselves reliably in the background requiring minimal manual intervention once baseline policies are set up. Review collected by and hosted on G2.com.

Learning curves for new users the admin dashboard has a lot of features so finding specific deep setting can take a little time get familiar with

Occasional false alerts Rarely, it might block a new custom script or tool but you can easily whitelist it in a few clicks. Review collected by and hosted on G2.com.

From an administrative side the automatic ransomware remediation via Crypto Guard is the absolute beast feature. We had an incident where a remote user ran an obfuscated script from a phishing email Sophos Flagged the rapid files encryption killed the malicious process immediately, isolated the machine from the network and rolled back the handful of targeted PDFs to their original state before the user even realized what happened I didn't have to restore from our cloud backups at all.

I also appreciate how stable the agent updates are in previous companies, pushing out updates for other EDR platforms would routinely trigger Blue Screen of Death (BSODs) or break legacy business software. Sopho handles minor agent updates smoothly in the background the built-in Live Discover tool is also a huge plus for running custom SQL queries across our entire fleet when checking for specific CVE vulnerabilities or active IOCs. it provides complete visibility of threat. Review collected by and hosted on G2.com.

while the protection is great the resource consumption on local endpoints can be high. If you have developers constantly compiling code, or users running heavy CAD applications, the deep-learning file scanning and behavioral monitoring can cause noticeable CPU spikes. We’ve had people complaining that their IDEs freeze up during builds.

Another annoyance is cleaning up leftover registry keys when a previous antivirus deployment didn’t uninstall properly. If a machine has a broken legacy AV entry somewhere, the Sophos installer will just error out rather than overriding it. Review collected by and hosted on G2.com.

1) My favorite thing about Sophos Endpoint is how simple it is to use and maintain on a daily basis. It was easy to set up and implement, and there were no issues integrating it with our current tools.

2) Additionally, it has a robust feature set that allows it to be adaptable to various security requirements. It is one of the tools I rely on the most because of its consistent, dependable performance, which I use often.

3) All things considered, it achieves an excellent balance between simplicity of use, strong capabilities, and straightforward integration.

4) The Sophos Central console pulls everything together, so getting things up, keeping an eye on threats, and managing policies feels straightforward. It runs smoothly without slowing things down and its detection is sharp. Review collected by and hosted on G2.com.

Nothing as much as Sophos Endpoint is ease to use Review collected by and hosted on G2.com.

Sophos Endpoint provides strong security, real-time threat detection, ransomware protection, and centralized management. It is easy to manage and helps protect all systems from malware, unauthorized applications, and cyber threats. Review collected by and hosted on G2.com.

Sophos Endpoint can sometimes use high system resources and advanced settings are difficult to understand. Review collected by and hosted on G2.com.

We use Sophos EndPoint on our fleet of Mac's. It works very effectively and doesn't cause any issues. There was a time when it would perform a system scan and really slow a machine down. But that doesn't happen anymore. Review collected by and hosted on G2.com.

The only real downside is when we need to be able to turn it off to do some troubleshooting. It's possible, but requires a trip to the admin console to retrieve a code. That's certainly not the end of the world, and it does make the product very secure and prevents users from turning their protection off. Review collected by and hosted on G2.com.