Sophos MDR Reviews & Product Details

What I like most about Sophos MDR is its 24/7 proactive monitoring and rapid threat response. It gives me confidence that our environment is being continuously watched by security experts who can identify, investigate, and respond to potential threats before they turn into major incidents. Review collected by and hosted on G2.com.

One area where Sophos MDR could improve is the level of detail and clarity in its alerts and incident reports. At times, providing more technical context—along with clearer explanations of the investigation steps and remediation actions taken—would help our internal IT team better understand what happened and carry out any necessary follow-up. Review collected by and hosted on G2.com.

Real-time threat detection and response.

Proactive threat hunting and investigation.

Detailed incident analysis and actionable recommendations.

Reduced workload for internal IT and security teams.

Integration with the Sophos security ecosystem.

Improved visibility into security threats and suspicious activities. Review collected by and hosted on G2.com.

Dependence on Sophos support for certain advanced investigations.

Limited control over some automated response actions.

Incident reports could provide more detailed technical insights. Occasional delays in incident updates and communication.

Better integration with third-party security and network monitoring tools would be beneficial.

Pricing can be a concern for larger environments. Review collected by and hosted on G2.com.

I find Sophos MDR easy to use. Our long relationship with Sophos gives me a lot of comfort because of its track record and its blueprint for the future, which aligns with where we hope to go as an organization. I really enjoy working with our account team; they’re proactive about letting us know what’s new, including product expansions, and the support team keeps us informed about global threats. I enjoy the close working relationship and see Sophos as an extension of our team. The price is right. Sophos MDR extends our small IT security team, protects us from threats, alerts us to potential security issues, and gives us peace of mind as a healthcare system that’s open 24/7, 365 days a year. Sophos Central’s dashboard connects the tools we use, including MDR, NDR, managed risk, and endpoint, and we’re trying to leverage everything the platform offers. Since we were already customers, setup was extremely easy; it was mostly a matter of expanding modules or turning them on in the dashboard. Consolidating under Sophos also made management easier, and cost was a major consideration. Review collected by and hosted on G2.com.

I find there’s a learning curve to fully understanding and taking advantage of everything available in Sophos Central. As the platform expands, clear documentation and guidance around new capabilities are important. We do proactive optimization reviews, but they can fall by the wayside when our team isn’t available, so they take some management attention. I don’t think it’s specifically a downside; it’s just something to be aware of as a manager or administrator. Review collected by and hosted on G2.com.

What I appreciate most about Sophos MDR is the visibility and flexibility it provides when investigating security events. The threat detection capabilities are comprehensive, while the platform remains intuitive and easy to use. The onboarding process was very smooth, and Live Response has proven particularly valuable because it allows me to carry out my own endpoint investigations in parallel with the MDR team’s analysis. I also find the AI Assistant very useful for quickly summarizing case findings and reviewing the most relevant details. Review collected by and hosted on G2.com.

The main area I would like to see improved is Live Discover, as query response times can occasionally be a bit slow, possibly due to their impact on endpoint resources. The Threat Detection Dashboard also has a slight learning curve and can initially feel somewhat confusing. That said, after working through a few cases and detections, the interface becomes much easier to understand and navigate. Review collected by and hosted on G2.com.

It gives me peace of mind to have a comprehensive solution that protects our endpoints and servers. I like the ease of the platform's visual environment and the prevention, with an immediate reaction to events. The response team is very proactive: they execute the action and then notify our engineers, which gives us greater security for the organization. Additionally, the agents are lightweight, about 2 MB, and the initial deployment was extremely simple and practical through Active Directory. Review collected by and hosted on G2.com.

I would like the Sophos MDR response team to also have staff who speak Spanish, because most cases are reported by staff who only speak English. Review collected by and hosted on G2.com.

We run Intercept X with EDR and XDR, Email Security, Endpoint Protection, and MDR, all managed from a single console, enabling integration across services. The MDR service provides 24/7 monitoring and response that a small IT team couldn’t provide on its own, and their analysts are responsive and knowledgeable. Sophos lets us focus on supporting our students and programs instead of putting out fires. Review collected by and hosted on G2.com.

I do not have anything at this time. The MDR has been great for detecting and investigating potential issues. Their team is very knowledgeable and quick to react. Review collected by and hosted on G2.com.

What I love most about Sophos MDR is its continuous monitoring and protection, early threat detection, and rapid response to security incidents. I also appreciate having cybersecurity experts who help reduce risks, improve environment visibility, and provide greater peace of mind to the IT team. Review collected by and hosted on G2.com.

One of the main areas of opportunity for Sophos MDR is that its implementation and configuration can require time and technical knowledge. Additionally, reliance on an external provider for managing certain incidents can limit the direct control of the IT team. It would also be useful to have greater flexibility in customizing alerts and reports, as well as improving integration with some existing tools. Review collected by and hosted on G2.com.

What I like most about Sophos MDR is the continuous monitoring of the environment, the ability to identify threats, and the specialized support in incident analysis and response. The centralization of alerts and visibility over potential risks facilitate security monitoring, reduce the operational burden on the IT team, and contribute to a more preventive posture in protecting corporate infrastructure. Review collected by and hosted on G2.com.

I believe the reports could be more detailed and customizable, making it easier for management to analyze incidents and identified threats. The visualization of alert history and actions taken by the response team could also be more intuitive. Additionally, greater transparency about response times and incident evolution would help the internal IT team monitor security. Review collected by and hosted on G2.com.

What stands out the most is that it doesn't rely solely on the tool but involves human intervention through experts who monitor 24/7, unlike a traditional antivirus. They not only monitor but also add value by investigating and responding to security incidents 365 days a year, 24 hours a day, ensuring business continuity. Among its main advantages, I could highlight: - Reduction of cyber risk - Continuous coverage without the need to increase staff - Greater operational resilience Review collected by and hosted on G2.com.

Analyzing from the perspective of risk management and IT operations, I could mention the following disadvantages: - Dependence on a third party, which implies relying on responses or escalation processes, communication, and coordination with the provider. - Risk of loss of internal knowledge - Recurring cost If I had to mention a less valuable aspect for a mature organization, it might be the generation of informational alerts or low-criticality events that require administrative review but do not represent real threats. Review collected by and hosted on G2.com.

I like the architecture of Sophos MDR, the incident management, and the automation that alerts me to events and keeps specialists on hand to resolve them. I value the engineering service and that there are always specialists available, knowledgeable to help and advise us on cybersecurity issues. I also like the AI part and access to libraries to find solutions or resolve doubts. The ecosystem fits our needs very well. The integration with our other cybersecurity solutions has been wonderful, and we have had no problems; moreover, it has complemented our infrastructure well. The implementation was very simple: the professional services guided us, the integrations were native, and the engineering support helped us understand the ecosystem. The transition was transparent. I also value the innovation and updates, the value it brings to the business, and that its costs are below what is on the market. Review collected by and hosted on G2.com.

I think there is a lack of better positioning in the industry; until this year, we did not know about this great product. Review collected by and hosted on G2.com.