External reviews are not included in the AWS star rating for the product.
As I am from a service-based company, my main use case for Sophos Central is that I am taking care of all of our security needs.
I use Sophos Central to block any website or application. For example, if I want to block WhatsApp, I simply call that specific application through Sophos Central.
I can manage Sophos firewall from Sophos Central, along with managing ZTNA, encryption, mobile MDM, and Sophos MDM.
The best feature of Sophos Central is that I can use all of the solutions from Sophos in a single pane of glass, which means I can manage all the services of Sophos from one console.
Having everything in one console makes my work easier because if I want to make a change on the firewall, I can simply go to the firewall management and make the changes. If I want to change anything related to Sophos wireless, I can directly change it from Sophos firewall without needing to access multiple consoles.
Sophos Central has positively impacted my organization because it allows us to utilize Sophos products in a single pane of glass, and with its synchronized security, it helps to protect our environment more effectively by isolating infected devices from the internet.
I think Sophos Central could be improved by offering an on-premises option because some users prefer to keep their data locally rather than in the cloud.
I think if there were a new licensing model for Linux endpoints, it would be very helpful for us.
I have been working in my current field for the last two years.
Sophos Central is stable.
Sophos Central's scalability is excellent because I can add any licenses at any time without needing to create a new console. For example, if I have 100 endpoints and need 20 more licenses, I can simply purchase them and continue to use them within the same console.
The customer support for Sophos Central is very good. If I call support at any time, they will assign a new engineer according to SLA immediately or within one to three hours.
I previously used Trend Micro before switching to Sophos Central because Trend Micro did not integrate with the console like Sophos Central does.
The experience with pricing, setup cost, and licensing for Sophos Central has been very good. Additionally, there is no license required for Linux EDR machines, and if Sophos were to add Linux EDR licensing, it would be very helpful for my organization and others.
The data is already stored in Sophos cloud, specifically in Sophos database.
I have not seen a return on investment yet.
I evaluated CrowdStrike as well, but I found that CrowdStrike does not provide the same level of protection with site management and application control as Sophos Central does.
I would advise others to use Sophos Central because of its performance and customer support. It works in real-time, making it beneficial for many organizations. I can add that we can manage Sophos firewall from Sophos Central, along with managing ZTNA, encryption, mobile MDM, and Sophos MDM. My review rating for Sophos Central is 10.
My main use case for Sophos Central involves utilizing it as an endpoint, EDR, and email gateway.
In my day-to-day work, I use Sophos Central by installing the agent on our clients. We have around 40 to 50 clients that are using Sophos as their EDR. We have created the alerting system in our ServiceNow, which is integrated with Sophos Central, so we get tickets in ServiceNow whenever something is triggered. I log into Sophos to investigate the alert, reviewing the alerts on that device from Sophos, and if required, I manually log into the device to check the alert and take actions accordingly.
Regarding my main use case or how I use Sophos Central day to day, the most useful feature is that Sophos blocks threats. As a senior engineer, my main work involving Sophos is handling situations when it blocks something that is legitimate, such as a ServiceNow MID Server. Every time this happens, Sophos blocks it as a malicious file, so we dive into Sophos and create exclusions, especially path exclusions, and if necessary, we also create hash exclusions to ensure that the legitimate file can be accessed and run by the user without any issues.
The best features Sophos Central offers, in my opinion, involve its excellent ability to block threats in endpoint protection. While it is not as effective in handling exclusion cases, it excels at successfully blocking almost all files that seem suspicious, which is really good and provides strong security.
What I appreciate most about the blocking features in Sophos Central is its real-time detection and the variety of threat types it can catch. Many other endpoints miss files that don't have a bad reputation, but Sophos finds a way to catch those malicious files, and if there's even a small suspicion, it blocks them. The real-time detection is really great in Sophos Central.
Sophos Central has positively impacted our organization by being a desired EDR solution for our many clients. As an MSSP, we have a significant number of clients utilizing Sophos Central, and it provides excellent service as an EDR. Even when we use it as an email gateway, it continues to perform well, making it beneficial for our organization with a wide client base.
One way Sophos Central can be improved is in its exclusion capabilities. When we try to exclude legitimate files, we find that it requires a lot of effort, as we cannot simply exclude one file from every detection. Due to the layered approach, it takes time to exclude even one file, indicating that the exclusion process could definitely be enhanced.
I would add that the logs in Sophos Central should be more detailed. Sometimes, when we're checking the logs, they simply state that a file is blocked, but we can't find out why that is the case. More detailed logs could significantly improve the log collecting aspect.
Areas for improvement in Sophos Central are log collection, exclusion processes, and customer support. Aside from these points, I believe the overall product is great.
I have been using Sophos Central for the last six years.
Sophos Central is stable, which is a positive attribute.
I believe Sophos Central's scalability is good compared to other EDR solutions that we have.
Customer support for Sophos Central is a bit slow. When I create a support ticket, it takes a while for them to respond. In my recent experience with a support ticket, the engineer was not very effective and took longer than I expected. When we reach out to the support team, we anticipate quick answers, especially since the client is waiting for a resolution. The vendor seems to take time contacting other teams, so I feel the support team could improve their response times.
Before using Sophos Central, we had utilized CrowdStrike; however, due to an outbreak, some clients wanted to switch away from CrowdStrike. We provided clients with options, including Sophos Central and SentinelOne, with SentinelOne being fairly costly. Ultimately, most clients preferred Sophos Central, leading us to switch a few clients from CrowdStrike to Sophos Central.
I have seen a return on investment with Sophos Central in terms of needing fewer employees because Sophos Central is handling many tasks itself. Previously, we had to monitor other endpoints and faced issues integrating with ServiceNow, requiring separate monitoring. After adopting Sophos Central, we can easily integrate with ServiceNow, which means fewer employees, and that translates to money saved.
Before choosing Sophos Central, we evaluated other options such as SentinelOne and Microsoft Defender.
My advice to others looking into using Sophos Central is that it is beneficial in terms of cost efficiency and time efficiency. I recommend using Sophos Central and digging into the logs more thoroughly, and if possible, incorporating syslogs or other kinds of logs. I would rate this product a 7 out of 10.
I am still using Sophos Central for everything. I am a reseller of Sophos Central products.
For end-customer workstations, I use Sophos Central for antivirus through the central administration console and installation. I also import all of my firewalls into Sophos Central for remote management and those functions.
I do work with Intercept X technology.
Intercept X technology helps with my malware detection and response. If it detects malware, it blocks it and then it sends it through to Sophos Central, which then sends me an email notification that one of the workstations picked up an infection or encountered an issue.
Synchronization security capability contributes to threat identification in my company.
I assess the benefit of a single pane of glass interface positively.
On a couple of older machines, Intercept X does tend to slow a computer down significantly, but on new, modern Windows 11 machines, I have not detected this issue yet.
Intercept X tends to pick up a very common program, Hard Disk Sentinel, as malware, specifically the executable file. For the purpose of installation, I have to disable Intercept X from Sophos Central to complete the install. Once the install is done, I can re-enable it and everything works fine. It creates extra work to make something function, but that is all.
I have been dealing with the product for approximately six to eight years.
I give a stability score of ten.
I would give a scalability score of ten for the product.
If I interact with technical support, I would give them a score of ten as they are good.
Positive
I have worked with other products. For instance, Symantec from Broadcom was a nightmare because having to install a separate server module for the management of workstations is not centrally accessible. If something happens, I have to either use TeamViewer to connect to the server to see what is going on or use VPN or another method. The biggest advantage for me is that I can log in from anywhere and see what is going on on the central dashboard with my customer's networks.
I find the installation of Sophos Central easy.
My clients have it on-cloud.
The biggest return on investment is securing my customer's networks.
I have not come across something that is better when I compare Sophos Central with other products.
I have so many workstations and, as a reseller, I am not only working on one Sophos Central. I probably have about 35 to 40 different customers that are on Sophos Central. Each one is set up differently according to customer needs.
I would say Sophos Central is a good solution for all customers, from small to enterprise.
I have not integrated Sophos Central with any third-party applications, so I do not have experience with that functionality.
The machine learning features are enabled. We have picked up a false positive now and again, but then I report it to Sophos and they rectify the issue in upcoming release builds.
The biggest benefit in Sophos Central is the central functionality where I can have my Intercept X integrate the workstations, the servers, and the firewalls I import into Sophos Central. I always enable the RED functionality so that if a machine picks up an issue, it notifies the firewall immediately, and then the two combined rectify the issue if there are any threats or something picked up.
I would say Sophos Central is an affordable product.
They are using Sophos cloud instead of cloud providers like AWS, Azure, or GCP.
I buy the product directly from Sophos.
I am a Senior IT Consultant here in the company. My overall review rating for this product is ten.
The main use cases for Sophos Central involve monitoring my client, viewing the events, and seeing reports of the detections and events. I will probably integrate with an XDR application before the end of this year, and I will likely integrate Sophos Central with Cisco's Splunk for some projects from Cisco Splunk.
The best features of Sophos Central are that it is very friendly and manageable.
Sophos Central is very user-friendly and easy to manage. A good response from support makes it easy, and it is not a heavy client on my workstation. We have had no issues with other products; we never had an issue in three years and seven months with other products.
Regarding the Intercept X technology in Sophos Central, we have had no issues with that support.
I have read some information a few months ago about the machine learning features in Sophos Central, and I saw that they added an AI tool, AI feature in the Sophos Central console. However, I haven't used it too much.
Regarding the data lake feature in Sophos Central, I saw how I can query history from my workstation to do threat intelligence. At this moment, I would want to see improvements; in this case, I wouldn't want to see products that I don't have.
I don't have a Sophos firewall or many products that appear in the console, even though I don't have them enabled. This is the only thing I don't appreciate about Sophos Central. I see Sophos Switch, Sophos Firewall, and I would prefer that if I don't have that product, it doesn't appear or is hidden from the main menu unless I select it to add.
I have used Sophos Central for three years and seven months.
Sophos Central integrates effectively with other products.
In terms of support, I would rate the support for Sophos Central a nine out of ten.
Positive
Before Sophos Central, we had Trend Micro.
I have seen a return on investment with Sophos Central. We returned our investment within the first year.
My thoughts on the pricing or licensing with Sophos Central are that it is very good.
Currently, we are using Fortinet for firewall and Cisco Firepower, and we are implementing some products from Cisco at this time including Cisco Secure Access, Cisco Webex, Cisco Duo, and Meraki. We are now implementing about six products from security from Cisco.
I am extremely satisfied with Sophos Central. On a scale of one to ten, I rate Sophos Central a ten out of ten.
