Sophos MDR Reviews & Product Details

What I like most about Sophos MDR is the continuous monitoring of the environment, the ability to identify threats, and the specialized support in incident analysis and response. The centralization of alerts and visibility over potential risks facilitate security monitoring, reduce the operational burden on the IT team, and contribute to a more preventive posture in protecting corporate infrastructure. Review collected by and hosted on G2.com.

I believe the reports could be more detailed and customizable, making it easier for management to analyze incidents and identified threats. The visualization of alert history and actions taken by the response team could also be more intuitive. Additionally, greater transparency about response times and incident evolution would help the internal IT team monitor security. Review collected by and hosted on G2.com.

What stands out the most is that it doesn't rely solely on the tool but involves human intervention through experts who monitor 24/7, unlike a traditional antivirus. They not only monitor but also add value by investigating and responding to security incidents 365 days a year, 24 hours a day, ensuring business continuity. Among its main advantages, I could highlight: - Reduction of cyber risk - Continuous coverage without the need to increase staff - Greater operational resilience Review collected by and hosted on G2.com.

Analyzing from the perspective of risk management and IT operations, I could mention the following disadvantages: - Dependence on a third party, which implies relying on responses or escalation processes, communication, and coordination with the provider. - Risk of loss of internal knowledge - Recurring cost If I had to mention a less valuable aspect for a mature organization, it might be the generation of informational alerts or low-criticality events that require administrative review but do not represent real threats. Review collected by and hosted on G2.com.

I like the architecture of Sophos MDR, the incident management, and the automation that alerts me to events and keeps specialists on hand to resolve them. I value the engineering service and that there are always specialists available, knowledgeable to help and advise us on cybersecurity issues. I also like the AI part and access to libraries to find solutions or resolve doubts. The ecosystem fits our needs very well. The integration with our other cybersecurity solutions has been wonderful, and we have had no problems; moreover, it has complemented our infrastructure well. The implementation was very simple: the professional services guided us, the integrations were native, and the engineering support helped us understand the ecosystem. The transition was transparent. I also value the innovation and updates, the value it brings to the business, and that its costs are below what is on the market. Review collected by and hosted on G2.com.

I think there is a lack of better positioning in the industry; until this year, we did not know about this great product. Review collected by and hosted on G2.com.

24/7 proactive monitoring gives our team huge peace of mind. Knowing their threat team is actively hunting for suspicious activity in the background lets our internal IT focus on daily operations instead of constantly staring at logs. The interface is clean and the automated threat isolation works really well without breaking false positives Review collected by and hosted on G2.com.

The biggest drawback is that threat graph alerts under threat analysis centre - they can't be emailed to us directly. We have to log into sophos central manually to check for them. If we review everything in the morning, new alerts can pop up by the afternoon and we won't know unless we manually jump back into the console. Having real time email notifications for these would save us from having to constantly babysit the dashboard throughout the day Review collected by and hosted on G2.com.

Easy of use, the UI is clear. It has a large number of integrations and the platform performs well. It is a high cost product but not the most expensive and worth the investment from a security standpoint. Onboarding was great most of this was done via the POV, only downside was the training did take a bit of time to get organised and we had to chase it. Review collected by and hosted on G2.com.

Nothing I really dislike, would probably say we had to chase the onboarding training which I don't think we should have needed do. Also for the M365 integration it doesn't nativley alert of impossible travel although Sophos do say that they are more accurate and can tell when it is a false positive. Review collected by and hosted on G2.com.

In my experience, Sophos MDR is a quite comprehensive solution.

In UI/UX, I find it clear and easy to use within Sophos Central. The integrations work well with the rest of the ecosystem, which greatly enhances visibility. The performance is stable and does not significantly impact operations.

Regarding price/ROI, I consider it worthwhile for the level of protection and 24/7 monitoring it offers. The support and onboarding have been positive, with good guidance from the start. And something I highlight is the use of AI, which helps to detect and respond to threats more quickly and accurately. Review collected by and hosted on G2.com.

They could improve the reporting after a case is resolved for tracking purposes. Review collected by and hosted on G2.com.

Sophos Managed Detection and Response (MDR) provides an excellent cybersecurity solution with proactive threat monitoring, rapid incident detection, and effective response capabilities. The service significantly enhances our organization's security posture by offering 24/7 protection, expert threat analysis, and reliable incident management. Its user-friendly management platform and professional security team make it a valuable solution for organizations seeking comprehensive cybersecurity protection. Overall, we are highly satisfied with Sophos MDR and would confidently recommend it to other businesses.While Sophos MDR delivers a high level of cybersecurity protection, its pricing is relatively expensive, particularly for organizations managing multiple security solutions and IT budgets. Although the service provides significant value through continuous monitoring and threat response, a more competitive and flexible pricing model would make it more attractive. The overall return on investment is positive, but cost remains an important The technical support and onboarding experience with Sophos MDR has been very satisfactory. The support team is professional, responsive, and knowledgeable, providing effective assistance whenever needed. The onboarding process is well-structured, and the availability of experienced security specialists contributes significantly to the overall quality and reliability of the service.consideration.Although we currently do not have a significant operational need for advanced AI-driven functionalities within our cybersecurity processes, Sophos MDR demonstrates a strong ability to adapt to the evolving artificial intelligence landscape. Its approach to integrating AI and intelligent threat detection technologies is promising and shows that the platform is keeping pace with industry developments. We believe these capabilities will become increasingly valuable as our security requirements evolve.Sophos MDR delivers excellent overall performance with reliable threat monitoring, rapid detection, and efficient incident response capabilities. The platform operates smoothly without negatively impacting our existing IT infrastructure or daily business operations. Its continuous 24/7 monitoring and proactive security approach provide confidence in our organization's cybersecurity posture. Overall, we are highly satisfied with the stability, efficiency, and reliability of the service. Review collected by and hosted on G2.com.

One area for improvement is the reporting and customization capabilities. While Sophos MDR provides strong threat detection and incident response, more detailed reporting options and greater flexibility in data exchange with third-party security solutions would further enhance the overall user experience. Also, cost point of view it is higher than a lot of competitor of Sophos. Review collected by and hosted on G2.com.

Implementing Sophos MDR has completely transformed our security posture and the operational burden on our team. Its greatest value lies not just in real-time visibility, but in active, 24/7 response: the team of analysts does more than simply forward alerts—they intervene and contain incidents before they can escalate.

Regarding integrations, its ability to seamlessly correlate third-party telemetry is outstanding; it connects cleanly with our Microsoft 365 environment, Entra ID identities, and network traffic from our perimeter firewalls, consolidating everything into a single data lake. The interface (Sophos Central) is clean and fast, offering clear workflows for auditing the root causes of any event—drastically reducing the alert fatigue we previously experienced.

The combination of artificial intelligence for predictive threat filtering and the expert judgment of a human threat-hunting team elevates effectiveness to a whole new level. The onboarding and support process was well-guided and free of technical friction, allowing the solution to be fully operational in a very short time. In terms of ROI, the service pays for itself by eliminating the need to fund and implement an in-house, 24/7 SOC, while delivering a level of protection and peace of mind for leadership that is hard to match. Review collected by and hosted on G2.com.

Overall, our experience with Sophos MDR has been overwhelmingly positive, and it consistently delivers on its core promise. If there is an area for constructive feedback regarding Performance, it would be the endpoint agent's resource footprint on older or resource constrained machines: during initial deep scans or heavy telemetry indexing, a brief spike in CPU/disk usage can be noticed, though it stabilizes completely once it enters standard real-time monitoring mode. A welcome enhancement would be more granular scheduling controls or adaptive throttling profiles to further smooth out performance across legacy endpoints. Additionally, while Sophos Central provides exceptional technical telemetry, having more out of the box, high level executive dashboard templates would make board-level reporting even quicker. These are minor refinement opportunities for an already rock solid, highly recommended MDR service. Review collected by and hosted on G2.com.

The most useful thing is to have a team of experts working in the background, detecting and responding to incidents before they become serious problems. The 24/7 analysis capability, detailed reports, and smooth communication with the Sophos team make a big difference. Review collected by and hosted on G2.com.

Overall, the experience has been very good, but if there's something I would improve, it would be that some reports could be presented in a simpler way so that non-technical people can also understand them without difficulty. Sometimes the amount of technical information can be overwhelming if one is not familiar with certain terms. Review collected by and hosted on G2.com.

What I like most about Sophos MDR is how it improves threat visibility and strengthens our organization’s overall security posture. Its centralized management features, along with integration across the Sophos security ecosystem, make it easier for us to monitor security events, spot potential threats early, and maintain stronger control over our IT infrastructure. I also appreciate the proactive approach to threat detection and the potential for a faster incident response, which helps reduce both the risk and the impact of security incidents. Review collected by and hosted on G2.com.

The main areas for improvement are the complexity when investigating certain security events, the level of detail and clarity of incident reports, and the flexibility in reporting and customization. Resolving complex threats and understanding the specific actions taken during incident response sometimes require additional technical effort. Having more detailed remediation guidance, clearer incident timelines, and greater transparency about threat analysis and response activities would improve the overall user experience and help IT teams manage security incidents more efficiently. Review collected by and hosted on G2.com.