Sophos Endpoint integrated with Taegis after USD $859m deal

Sophos has announced the integration of Sophos Endpoint with all Taegis Managed Detection and Response (MDR) and Extended Detection and Response (XDR) subscriptions.

The integration follows Sophos' USD $859 million acquisition of Secureworks earlier in the year and will see Sophos Endpoint natively included and automatically enabled for every Taegis MDR and XDR customer, providing combined prevention, detection, and response capabilities in a single platform.

Cost savings and licensing

With Endpoint protection cited as a critical layer in cybersecurity, the inclusion of Sophos Endpoint within all applicable Taegis subscriptions means customers do not need to purchase and maintain separate endpoint security licences. According to details released by Sophos, the company expects this change to deliver lower licensing costs and improved return on investment for enterprises, while also reducing management overhead through unified deployment and accelerated threat neutralisation via expanded response capabilities.

Raja Patel, Chief Product Officer at Sophos, commented on the significance of the change:

Integrating Sophos Endpoint with Taegis delivers a best-in-class unified protection, detection, investigation, and response platform - while also reducing customer costs. Too many organizations still treat endpoint protection like a commodity, and that's exactly the mistake attackers are counting on. The reality is, not all endpoint products are built to stop today's hands-on-keyboard attacks. Sophos Endpoint's prevention-first capabilities, like CryptoGuard anti-ransomware protection and Adaptive Attack Protection, shut down attacks before they can escalate, which is a true game changer for enterprises managing thousands of devices. And by simplifying deployment and policy management, we're helping organizations stay ahead of threats, lower their total cost of ownership, and maximize the return on their security investments.

Sophos Endpoint's protection features such as proprietary CryptoGuard anti-ransomware and Adaptive Attack Protection will now be accessible directly from within the Taegis management console. New Live Response features are also included, intended to accelerate the detection and mitigation of active threats.

Workflow and platform choice

Taegis remains an open platform, according to Sophos, allowing organisations retaining their preferred endpoint solutions to continue to use them. Telemetry and detections originating from Sophos Endpoint will flow into the Taegis ecosystem, allowing organisations to maintain established detection and response workflows without disruption.

Three deployment options for endpoint integration are now supported: native Sophos Endpoint for comprehensive capabilities, non-Sophos native integrations providing telemetry visibility from other common products, and a detection-only sensor deployment for other endpoint security solutions.

Chris Bell, Senior Vice President of Global Channel, Alliances and Corporate Development at Sophos, said:

This integration expands the value and flexibility we deliver to customers and partners. By including Sophos Endpoint in Taegis, organizations gain stronger protection, reduced costs and simplified operations. For partners, it creates new opportunities to help customers consolidate tools, drive renewals and expand enterprise relationships.

Industry recognition and customer base

The company highlights that Sophos Endpoint is used by more than 300,000 organisations globally. The solution has been named a Leader in the Gartner Magic Quadrant for Endpoint Protection Platforms 16 times and was recognised as a 2025 Gartner Peer Insights "Customers' Choice" for Endpoint Protection Platforms. Sophos is also listed as the only vendor named a Leader across multiple G2 Overall Grid Reports for Endpoint Protection Suites, Endpoint Detection and Response, Extended Detection and Response, Firewall Software, and Managed Detection and Response.

For Taegis customers, the key benefits highlighted by Sophos include reduced licensing costs, preservation of vendor choice, integration of leading protection features, support for continuity in existing security operations workflows, and streamlined installation and management through the Taegis platform.

Customers on existing and new Taegis XDR or MDR subscriptions now have immediate access to Sophos Endpoint as part of their service without additional cost.