Cybersecurity as a Service for AWS

Sophos Cybersecurity as a Service  is an on-premise solution. This is the first implementation of Sophos Cybersecurity as a Service  with Citrix, and otherwise we are going with the Sophos XDR  solution instead of a third party, as we are currently using Trend Micro, which is not working properly with Sophos.

The thin client is not compatible with the Sophos firewall, and we found the fault in the Sophos solution. They have now released a light version of the XDR , and that type of activity is what we are coordinating in the backend.

The best feature of Sophos Cybersecurity as a Service is the XDR, along with remote management, which is particularly beneficial for small and medium environments.

We and our customers use the automated threat response feature, which is included but requires a license. For example, one of the banks using XDR provided by Sophos is very happy, and we conduct remote sessions with XDR, ensuring our involvement is minimal, leading to customer satisfaction.

I assess the value of deep visibility into network activities provided by Sophos Cybersecurity as a Service as good enough, especially regarding firewall and wireless aspects, with new switching features introduced that are acceptable.

There are a lot of technical issues with the implementation of Sophos Cybersecurity as a Service, particularly because we are currently implementing the XG series, where Citrix is the endpoint, leading to a lot of confusion. The XDR client is not working, so we are taking time for research and development, and they are providing us with whatever solutions from the company, even a lighter version of the XDR for this particular Citrix thin client.

Product-wise, improvements need to be made in Sophos Cybersecurity as a Service, particularly because they do not have a testing lab for the implemented customer environments. We have implemented a large environment where a number of problems occur, and they are unable to provide on-the-spot solutions, often taking five to ten days to set up a lab at the customer's premises to identify solutions.

I have been working with Sophos Cybersecurity as a Service since 1994, almost 30 years, starting with Astaro , which is the original security company that Sophos has taken over, and nowadays Sophos is the product.

I do not face many challenges, but we did encounter ransomware attacks at two to three locations, and Sophos Cybersecurity as a Service protected us immediately, within three to four seconds, providing alerts about ransomware threats, leading to automatic disconnections when necessary.

Cloud-based operation is nowadays required for centralized management since all servers and resources are being kept in the cloud, and future developments must trend towards cloud solutions.

However, we are not promoting cloud solutions to our customers, as our business remains focused on on-premise setups.

I rate the technical support of Sophos Cybersecurity as a Service an eight compared to Juniper, also an eight, but primarily due to timing issues. They are technically strong, but their resources are problematic, and timing is also an issue as nowadays people require solutions on-demand.

I am also a partner with Juniper, Cisco, and everything, because I am a system integrator, so I have to maintain relationships with all OEMs.

There is definitely a return on investment when using Sophos products; it all comes down to how deployment is managed, as policy is crucial. Initiating a deny everything approach before gradually allowing access is the best way to ensure security.

The pricing of Sophos Cybersecurity as a Service is approximately 60 percent that of Cisco, as Cisco requires a greater number of licenses to meet its requirements, while Sophos and Juniper, along with Fortinet, offer lower prices. In negotiations, Fortinet and Sophos have almost equal prices, allowing for competitiveness in order acquisition at the negotiation table, leading to price reductions.

This is the first implementation of Sophos Cybersecurity as a Service with Citrix, and otherwise we are going with the Sophos XDR solution instead of a third party, as we are currently using Trend Micro, which is not working properly with Sophos. The thin client is not compatible with the Sophos firewall, and we found the fault in the Sophos solution. They have now released a light version of the XDR, and that type of activity is what we are coordinating in the backend.

I do not fully understand the metric used to measure the effectiveness of Sophos threat intelligence capabilities. However, we do have one scheme, which involves dedicating manpower for customer support. For larger customers, we assign dedicated personnel who understand the ins and outs of their needs, which helps streamline processes without needing repeated explanations.

We work with Sophos XG  Firewall including Sophos Agent for Servers. Most of my customers are maintaining developer environments and want to secure their developer environments by preventing uploading and use of phishing websites and outbound emails to public email services like Hotmail and Gmail. They want to secure their environment to block users from sending emails to public email addresses and prevent uploads with this security measure.

Sophos Cybersecurity as a Service  offers very tight security and compliance. If anybody applies Sophos at their premises, the environment is completely secure and sound.

The biggest advantage I achieved with Sophos Cybersecurity as a Service  is the upload block. I never achieved it with other products, and Sophos completely delivered on this. We completely block uploads from any website and anywhere in the environment. No one can upload without our permission.

There are many reasons why Sophos is better in comparison with other solutions, but our focus was blocking uploads. The most important thing in our environment is blocking uploads, and we achieved this target with Sophos. Sophos Cybersecurity as a Service also protects against malicious websites and performs antivirus scanning and blocks all threats that any XG firewall is supposed to achieve.

The automated response is excellent because the portal handles almost everything on a single dashboard, and we can manage and control everything automatically. This is really systematic and automated. It is absolutely highly scalable.

I don't think there is anything to improve in my experience because I found Sophos already maintains regular updates and provides support portals in proper order. I don't find anything to recommend for improvement.

I have been working with Sophos Cybersecurity as a Service for around five years.

It is 99% stable.

The support I experienced is extremely good. I always found the support persons very friendly and helpful, and they always try to fix the service at any cost and are available anytime.

Before using Sophos Cybersecurity as a Service, we tried Cisco and other firewalls, but when we experienced Sophos, it really did what we wanted to achieve.

Previously we were using AWS , but recently we have moved to a hosting service. Both are compatible with using Sophos Cybersecurity as a Service.

I found the installation is very simple. I just need to run the installer and it completes in one go by itself. There is no complex installation required.

Our service provider in Canada is the company NE Format. The representative is Saif Khan. He provides all Sophos Cybersecurity as a Service-related services to us. He controls many things on his end, including the portal management of Sophos Cybersecurity as a Service, and I just look after the user environment. The provider manages it at their end, and Mr. Saif Khan from NE Format in Canada handles the implementation.

For the Pakistan region, this is very expensive. Not anyone can afford it. It is expensive, but it is worthwhile for paying the investment. However, it is not affordable for everyone. Only very high and large enterprises can afford it.

I never bought any service of Sophos Cybersecurity as a Service from anywhere else because we bought it from a reseller located in Canada who handles everything for us.

Users never prefer to be blocked from performing activities. If you block users from doing activities, they do not prefer it. That is a security requirement, but as a technical provider, I understand this is important to do. We are using a product that offers EDR as well. I rate this review as a 10 out of 10.

We are working with Trend Micro as a competitor, and it is also a great experience. I am using Trend AI Vision One. I know the Secureworks product for XDR  and EDR; I know they acquired Secureworks. We do not have any customers of Secureworks yet, but we are trying to pitch it and develop some business with Secureworks as well. We are working with Sophos Cybersecurity as a Service .

We started working with Sophos Cybersecurity as a Service  last year and we have some customers for Sophos in the resolution which is Cybersecurity as a Service. Sophos teams work with these customers to secure them and integrate them in case of any issues, and they are really satisfied with the product; it is a good one.

Customers basically use Sophos Cybersecurity as a Service against ransomware attacks, especially when they are not in their operational hours such as during the night, on weekends, or holidays when their team is not directly available in the premises to secure something. In that case, they need these services so that someone reliable is watching their network to avoid any ransomware attacks.

There are multiple benefits of Sophos Cybersecurity as a Service. The biggest one is that it will save any stoppage of services; for example, if there is a hospital environment that faces any ransomware attack, it may stop their operations. This solution helps them to maintain their uptime and ensure business continuity 100%, which is a very good thing. Secondly, it helps avoid financial losses; once the data of the company is encrypted due to a ransomware attack, they obviously face financial losses and may be asked for bigger ransom amounts. Sometimes a company has to pay them; to avoid these issues, there is no surety of getting data back even after paying the ransom. Additionally, there are various kinds of attacks nowadays, such as CNC attacks, where someone may be using their resources for bad purposes; these services stop any unethical behavior, ultimately helping the customer to increase their productivity and financial growth.

The automated threat response feature of Sophos Cybersecurity as a Service is definitely very helpful.

Most of the companies do not have cybersecurity experts, particularly mid-level or small enterprises; they cannot afford cybersecurity experts or SOC teams. With this product, they do not need to go through extensive learning in cybersecurity; the automatic mitigation helps them to focus on their work and avoid problematic behaviors. There are some IT staff who do not have any security background, which means they do not need to get involved when reliable products are handling this.

Network visibility with Sophos Cybersecurity as a Service is positive and brings benefits; they are connected with your network, providing a larger view and a dedicated team who understands all the ins and outs. For instance, some equipment such as PBX systems or CCTV cameras in the network typically are not viewed as potential threats, but these services help monitor even those, ensuring protection.

Features such as threat hunting and forensics are definitely effective for cybersecurity; for example, we might not know if our management team addresses, such as our CFO or CEO email addresses, are being misused on the dark web for phishing attacks. These solutions help us to see any misuse of our resources, effectively preventing such issues.

I would suggest improvements such as integrating a third-party platform or making the products mature enough for customers who do not use Sophos switches or similar hardware, allowing security integration. If a firewall or another security solution could learn logs from attacks originating from switches or CCTV systems, it should be accessible enough for a regular network engineer or security engineer to understand and handle.

Sophos Cybersecurity as a Service does not have any glitches; it is very stable.

It is very scalable without any limitations.

The customer support from Sophos is great; they are very supportive and available 24/7. It depends upon the region, but they are accessible whenever we approach them, and they engage their development team and a global escalation team when needed, providing an exceptionally strong support system.

We work with other products as well, but we are the Platinum Partner of Sophos in Pakistan.

It is very easy to install, and I give full marks for the easiness of the solution.

I believe it is more than 30% ROI. While it is hard to quantify exactly, when you consider data theft and customers protecting billion-dollar data assets, the price of the solution is only about $4,000 to $5,000 per year. The ROI provided by these solutions is more than 100%, making it a very economical choice, thus worth buying.

The price for Sophos is somewhere in the middle; it is a good price. They offer good discounts for customers and have competitive pricing when compared to their competition such as Trend Micro and other high-end products. It is very aggressive pricing.

Sophos Cybersecurity as a Service utilizes its own cloud, which may have integrations with other services, but they provide their cloud for customer console access.

Centralized management is very important for cloud-based operations because most companies have multiple branches and offices in different cities. It really helps us manage, especially if a customer has 300 firewalls and 2000 endpoints spread across various offices; it becomes much easier to manage everything centrally. If they need to push a policy for internet validation, all their endpoints or users can be managed from a single interface, which is very effective.

It is not exactly a disadvantage, but it does impact the company financially. These are services that the company must purchase, whether from Sophos or other providers, which impacts their finances. Thirty or forty years ago, without internet or network connectivity, companies did not have to worry about data theft and could focus on operations. Now, no solution can guarantee 100% security. Unless a company invests in a firewall for network security, endpoint protection, network detection and response, MDR, security-as-services, and patch management, their finances are heavily drained due to these cybersecurity solutions, and this burden will only increase over time. Other than that, I do not find any disadvantages; the products are very good and competitive.

I give this solution a rating of 9 out of 10. It is worth buying and definitely provides ROI.

My main use case for Sophos Cybersecurity as a Service  is to stop ransomware attacks. I work for a manufacturing company with a total of 2,500 employees across 15 locations, Microsoft 365, VMware servers, Windows laptops, OT environments, and a hybrid workspace. An employee received a phishing email with the subject around invoice payment pending, and the attachment contained malicious macros. The user enabled the macro, and PowerShell downloaded ransomware. Sophos' email security helped beyond what is expected, as it checks the SPF, DKIM, DMARC, sandboxing, reputation, and AI detection. Suppose this is a zero-day attack; the email bypasses the filtering. Overall, Sophos XDR  automatically correlates all the logs from the endpoint, the firewall, the identity email, and the cloud, allowing analysts to immediately see patient zero, the download file, PowerShell command, network connections, registry changes, and lateral movement attempts. Everything appears on a single investigation timeline.

A little more on the use case: Intercept X detects the malicious behavior, and CryptoGuard stops the encryption and restores the modified files. XDR  correlates telemetry, MDR validates the threat, and performs 24/7 response, while the firewall blocks the attacker's communication.

The best features Sophos Cybersecurity as a Service  offers is that instead of treating endpoint, firewall, email, and mobile security as separate products, Sophos enables them to communicate automatically through Security Heartbeat. An example would be when an endpoint becomes infected; Sophos Intercept X  causes the firewall to isolate the device, block the malicious IP address, and prevent lateral movement automatically, reducing response time from minutes to seconds.

Automatic communication between Sophos products helps my team day-to-day by significantly reducing manual effort and speeding up incident response. Instead of analysts having to investigate alerts across multiple consoles, Sophos shares threat intelligence automatically between endpoints, firewalls, email security, and the management platform. This means that when one product detects a threat, the others immediately take coordinated action.

Sophos Cybersecurity as a Service has positively impacted my organization by simplifying cybersecurity operations while improving our ability to detect and respond to threats. Its integrated platform reduces the need to manage multiple disconnected tools, allowing our security teams to work more efficiently. Features such as automated threat correlation, endpoint isolation, and managed detections and response help reduce incident response time and minimize the impact of cyberattacks. For organizations with limited cybersecurity resources, Sophos also provides enterprise-wide protection through its MDR services without requiring a large in-house SOC.

Sophos Cybersecurity as a Service is a mature platform with strong endpoint protection, MDR, and integrated security capabilities. However, areas exist where it can continue to evolve. I see opportunities around AI-driven automation, cloud-native security, identity protection, third-party integrations, executive reporting, and proactive risk management.

Sophos already provides a strong integrated security platform with MDR, XDR, endpoint protection, and firewall integration. The next evolution is to become even more predictive and autonomous. I would like to see deeper AI-driven response automation, enhanced cloud and identity threat detection, broader third-party integrations, executive-focused risk dashboards, automated compliance mapping, and continuous external attack surface management. These enhancements would not only improve security outcomes but also help CISOs better demonstrate cyber risk reduction and business value.

To make it a ten, I would like to see cloud-native workload protection and identity security deeper compared with some specialized competitors. Some enterprises with highly customized SOCs may prefer broader native integration and automation available from platforms such as Microsoft, Palo Alto Networks, or CrowdStrike. Further enhancement in executive reporting and exposure management capabilities is also needed.

I have been working in my current field for 20 years.

Sophos Cybersecurity as a Service is stable.

I would rate Sophos Cybersecurity as a Service scalability at 9 out of 10. It's designed to scale from small businesses to large enterprises without requiring significant changes to the underlying platform.

Customer support is really good. I would rate the customer support a 10 out of 10.

I did not previously use a different solution.

Overall, my experience with pricing, setup cost, and licensing has been positive. I would rate the pricing setup to be 8 out of 10. Sophos offers competitive pricing, especially for organizations looking for an integrated security platform rather than purchasing multiple standalone products. The licensing model is generally straightforward, with flexible subscription options based on the organization's requirements. The initial setup costs are reasonable, particularly for cloud-managed deployments through Sophos Central . Overall total cost of ownership can be lowered because endpoint, firewall, email security, and MDR services are managed through a unified platform.

I have seen a positive return on investment, primarily through improved operational efficiency and faster incident response rather than reducing headcount. Sophos centralized management, automation, and MDR capabilities allow my security team to spend less time on repetitive tasks and more time on higher-value security activities. One example was a phishing incident that resulted in malware execution on a user laptop. Sophos detected the suspicious behavior, isolated the endpoint automatically, and prevented lateral movement. Because the investigation data was already correlated in Sophos Central , the analyst completed the investigation in 20 minutes, whereas previously, it could have taken close to an hour by manually reviewing multiple security tools. The incident was contained to a single endpoint, and the user experienced minimal disruption.

Before choosing Sophos Cybersecurity as a Service, I evaluated other options, including Microsoft Sentinel .

My advice to others looking into using Sophos Cybersecurity as a Service would be to first understand their organization's security maturity, business requirements, and existing technology stack. Sophos Cybersecurity as a Service delivers the most value when you leverage it as an integrated platform rather than deploying individual products in isolation. If you're looking for centralized management, strong ransomware protection, 24/7 managed detection and response, and reduced operational complexity, it's a compelling choice. I would also recommend planning the deployment carefully, defining security policies upfront, and investing time in tuning the alerts during the initial rollout to maximize effectiveness and minimize unnecessary noise. I would rate this solution an 8 out of 10.