Sophos MDR Grows Global Customers by 37% in 2024, Setting a Powerful New Standard in Cutting-edge, Expert-driven Cybersecurity Against Today’s Most Advanced Threats

OXFORD, U.K. — 一月 8, 2025 —

Sophos, a global leader of innovative security solutions for defeating cyberattacks, today announced that its Sophos Managed Detection and Response (MDR) service has reached a major milestone, now protecting more than 26,000 organizations globally, growing its customer base by 37% in 2024. This achievement highlights the increasing demand for Sophos’ proactive, expert-led security solutions, which help organizations of all sizes stay protected 24/7 against increasingly sophisticated cyber threats, including the most advanced ransomware, business email compromise (BEC) and phishing attacks.

Sophos MDR offers a comprehensive suite of capabilities that go beyond standard threat containment to include full-scale incident response, such as root cause analysis, the removal of malicious tools or artifacts used by attackers, and investigations across customers’ environments to ensure adversaries are fully ejected to prevent another attack. What further differentiates Sophos is that these incident response services are included with Sophos MDR on an unlimited basis, meaning customers are not additionally charged and there is no limit on the number of incident response hours. Sophos MDR Complete also includes a breach protection warranty covering up to $1 million USD in incident response expenses. Sophos provides flexibility for how customers can work with the MDR analysts, including the ability to pre-authorize them to contain an active threat.

Sophos Investment in MDR and New Features

Sophos has made significant investments into its MDR offering with increased analyst capacity, AI assisted workflows, new features and expanded integrations to help deliver the best possible outcomes through improved protection, detection and investigation of threats. Sophos has added the following new features:

  • Proof of Value: New Sophos MDR service insights to explain the MDR team’s actions including highlighting the human hours spent threat hunting and creating and tuning detections. High-value dashboard enhancements include details of MITRE ATT&CK tactics uncovered in proactive threat hunts conducted by Sophos’ MDR team, MDR analyst coverage, case investigation summaries and an account health check status
  • Enhanced Security for Microsoft Customers: New Sophos-proprietary detections for Microsoft Office 365 identify threats including business email compromise and adversary in the middle account takeover attacks, independent of the customer’s Microsoft license level.
  • Expanded Compatibility with Third Parties: This expanded ecosystem of turnkey integrations with third-party cybersecurity and IT tools includes a new Backup and Recovery integration category.
  • Proactive Vulnerability Mitigation: Sophos Managed Risk powered by Tenable provides attack surface vulnerability management as a new managed service option for Sophos MDR customers.
  • Efficiency and Automation: Sophos MDR has added AI-powered workflows to streamline the operational processes and drive better security outcomes for our customers. This innovation delivers a reduced mean time to respond (MTTR) through more efficient triage, while also ensuring that all legitimate threats are rapidly investigated. This enables analysts to concentrate on other tasks such as threat hunting, account health monitoring and detection engineering.

“Attackers are continuously advancing their tactics to outmanoeuvre traditional security defenses,” said Rob Harrison, senior vice president of product management at Sophos. “Our customers rely on Sophos MDR to help their organizations tackle today’s threats 24/7 with full-scale incident response to remove active adversaries and conduct root cause analysis to identify the underlying issues that led to an incident. We’re consistently evolving our solutions with new offerings and integrations, just like attackers are constantly evolving their tactics, so customers can disrupt threats before they escalate into destructive attacks.”

Better Together: Sophos MDR Integrations

Sophos has invested significantly in third party integrations for its MDR customers to ingest and analyze events and alerts from an even broader range of tools and products, while also expanding propriety detections based on suspicious behaviour identified in Microsoft environments. This includes:

  • A new Backup and Recovery integration pack with Acronis, Rubrik and Veeam integrations to strengthen defenses against ransomware.
  • Microsoft Office 365 Management Activity integrations, enabling the ingestion of audit logs and security alerts across the Microsoft ecosystem. More than 9,000 customers have this integration in the Sophos MDR solution.

Sophos MDR Accolades

Threat Landscape from Sophos MDR

In the last 12 months, Sophos shared findings from the following MDR cases it analyzed for customers:

  • In December 2024, Sophos released The Bite from Inside: The Sophos Active Adversary Report that provides an in-depth look at the changing behaviors and attack techniques that adversaries used in the first half of 2024. The data is derived from nearly 200 IR and MDR cases and found that attackers are looking for ways to hide in plain sight by abusing trusted applications or “Living off the Land” binaries or LOLbins. Sophos saw a 51% increase in abusing these applications.
  • Sophos X-Ops released information that it is seeing an uptick of Akira ransomware cases across its MDR and Incident Response customers with eight cases since November 2024 across Akira’s 127 victims disclosed in the past six months.
  • In June 2024, Sophos MDR published details on a nearly two-year long cyber espionage campaign they uncovered against a high-level government entity in Southeast Asia. The operation, which Sophos named Crimson Palace, involved three separate clusters of threat activity that overlapped with several well-known Chinese nation-state groups.

What Sophos MDR Customers Are Saying

Sophos was named a Customers’ Choice vendor in the second Gartner® Peer Insights™ Voice of the Customer Report for MDR. Sophos scored the highest overall customer rating of 4.9/5, based on 344 reviews, as of Sept. 30, 2024, with verified customer reviews celebrating Sophos MDR’s innovation.

Here’s what customers are saying about Sophos MDR:

  • “Earlier it was very difficult for us to manage the alerts and incidents generated by the tools and technology but after MDR deployment we have complete peace of mind. We also have other products from Sophos so our overall experience from a manageability point of view is also good,” from assistant director of IT in the healthcare and biotech industry (Review link)
  • “Sophos MDR is a wonderful product and services by Sophos, you don't need a SOC after getting MDR,” from an IT manager in the IT services industry (Review link)
  • “Sophos MDR is one of the best in the market. It’s a good service to have good sleep at night, as the burden of threat hunting is offloaded,” from an IT infrastructure specialist in the retail industry (Review link)
  • “We have had an incredibly positive experience using Sophos MDR. We rest more easily knowing that their team is acting as an extension of our own team in doing threat hunting/detection/remediation in our environment on a 24/7 basis,” from an operations associate (Review link)

For more information about Sophos MDR, visit https://www.sophos.com/products/managed-detection-and-response

*Doc #US50521323, February 2024

**Doc #EUR151172124, September 2024

关于 Sophos

Sophos 是全球领先的先进安全解决方案提供商和创新者，全面安全解决方案涵盖托管式侦测与响应 (MDR) 和事件响应服务，以及广泛的端点、网络、电子邮件和云安全技术。作为最大的纯网络安全厂商之一，Sophos 为全球超过 600,000 家企业和超过 1 亿用户提供防御主动攻击对手、勒索软件、网络钓鱼、恶意软件等威胁的保护。Sophos 的服务和产品通过 Sophos Central 管理控制台连接，并得到公司内部的跨领域威胁情报部门 Sophos X-Ops 的支持。Sophos X-Ops 情报优化整个 Sophos Adaptive Cybersecurity Ecosystem 自适应网络安全生态体系，包括一个中央数据湖，为客户、合作伙伴、开发人员和其他网络安全与信息技术供应商提供一组丰富的开放 API。Sophos为需要完全托管的安全解决方案的组织提供网络安全即服务。客户还可以直接利用 Sophos 的安全运行平台管理其网络安全，或者采用混合方法，为内部团队补充 Sophos 服务（包括威胁追踪与修复）。Sophos 通过世界各地的经销商合作伙伴和托管服务供应商 (MSP) 销售。Sophos 总部位于英国牛津。如欲了解更多信息，请访问 www.sophos.com。