Sophos
UK cybersecurity vendor selling endpoint, network, and MDR services to businesses, owned by Thoma Bravo.
On the record
Checkpoint: First results from Sophos AI Security Report and independent verification of Fusion's performance claims
The call
Sophos runs a human-backed MDR business Microsoft cannot easily copy, while Microsoft's free Defender bundling squeezes the endpoint pricing underneath it.
Sophos helps companies find and stop cyberattacks, mostly by selling through IT service providers and offering a managed threat response service where Sophos employees hunt for attackers. It is hard to copy because Sophos has data from 600,000 customers that teaches its software to spot new attacks, and insurance companies trust it enough to charge customers less (97.5% fewer claims). But Microsoft is giving very similar detection tools to millions of companies almost free as part of its Office 365 bundle, which is already forcing Sophos and rivals to cut prices on their basic endpoint tools. The one thing that could change the picture is whether Sophos can sell more of its premium service (where humans actually investigate attacks for you) fast enough to make up for losing margin on the basic product. Also watch when the private equity owner plans to sell the company, which could force choices about whether to race for growth or squeeze out profit.
Why
01
AI pressure: OpenAI and Anthropic-style automation of tier-1 SOC triage. AI can automate alert triage and log search, but Sophos is licensing OpenAI and Anthropic models into its own Fusion product rather than being replaced by them. Could AI do the core job? Unlikely.
02
Bigger players: Microsoft Defender. Microsoft bundles Defender into M365 E5/E7 at near-zero marginal cost, squeezing standalone endpoint pricing across the industry. Could a giant copy it? Probably.
03
What protects it. 600,000-plus customer telemetry base, human-run MDR with insurance-backed outcomes, and deep MSP/MSSP channel relationships that are slow to switch.
What would change this call
Sophos announces further layoffs or restructuring tied to Secureworks integration within 12-18 months. Would show integration underperforming and PE cost pressure overriding growth.
Thoma Bravo initiates an IPO, sale, or merger of Sophos within 3-5 years. Would confirm PE exit timing is driving strategy rather than organic scaling.
Independent third-party benchmarks test Sophos Fusion's claimed 89-second response after its July 2026 launch. Would verify or debunk Sophos's self-reported AI performance claims.
Thoma Bravo initiates an IPO, sale, or merger of Sophos within 3-5 years. Would confirm PE exit timing is driving strategy rather than organic scaling.
Independent third-party benchmarks test Sophos Fusion's claimed 89-second response after its July 2026 launch. Would verify or debunk Sophos's self-reported AI performance claims.
Key numbers
- 600,000+ organizations protected
- 40,000 MDR customers post-Secureworks deal
- 6% workforce cut (~380-400 people)
Named risks
- Microsoft Defender bundling into M365 E5/E7 compressing endpoint EDR margins industry-wide.
- Secureworks integration incomplete after two layoff rounds in three years (2023, 2025).
- Thoma Bravo exit or recapitalization could disrupt strategy given pattern across its cyber portfolio.
- Vendor-claimed AI performance metrics like 89-second response lack independent third-party verification.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| Microsoft | gaining on | Defender bundled into M365 E5/E7 at near-zero marginal cost pressuring EDR margins, 2026-07-14 |
| CrowdStrike | contesting | Overlapping endpoint, EDR and MDR offerings compete directly across enterprise and MSP channels |
| Arctic Wolf | contesting | Pure-play MDR rival contesting Sophos's post-Secureworks 40,000 MDR customer base |
| Expel | contesting | Pure-play MDR specialist competing for MSP-channel MDR deals since 2025 integration |
| SentinelOne | contesting | Direct endpoint/XDR competitor in same market segment as Sophos Endpoint refresh, Oct 2025 |
| Darktrace | contesting | Sister Thoma Bravo portfolio company and AI-security peer, raising cross-portfolio consolidation questions, 2026-07-11 |
Questions people ask
- Is Sophos profitable in 2026?
- Sophos does not publicly disclose financials as a private, Thoma Bravo owned company. It completed an $859M all-cash acquisition of Secureworks on 2025-02-03, and has continued product investment including a July 2026 AI-native platform launch, but no verified profit figures exist in company disclosures.
- Who owns Sophos?
- Thoma Bravo has owned Sophos since completing a ~$3.9B take-private acquisition on 2020-03-02, ending its run on the London Stock Exchange. Thoma Bravo remains the sole owner and also holds stakes in Proofpoint, SailPoint, Darktrace and other cybersecurity firms.
- Has Sophos had layoffs recently?
- Yes. Sophos cut about 6% of its combined workforce (an estimated 380 to 400 people) on 2025-02-13 following the Secureworks acquisition, after already cutting roughly 10% (about 450 employees) in January 2023 amid a shift toward MDR services.
- Could AI replace Sophos's security services?
- AI can automate tier-1 alert triage and log search, tasks Sophos's own AI Assistant already targets, but Sophos's 40,000 MDR customers rely on human-staffed 24/7 response tied to liability and insurance outcomes. Sophos reports MDR customers file 97.5% fewer claims than endpoint-only customers, as of 2025-06-16.
- Is Microsoft a bigger threat to Sophos than CrowdStrike?
- Microsoft's bundling of Defender into M365 E5/E7 at near-zero marginal cost is actively compressing endpoint EDR pricing industry-wide as of 2026-07-14, a more structural threat than direct rival CrowdStrike, which competes on similar but separately priced EDR and MDR offerings.
- What is Sophos Fusion?
- Sophos Fusion, launched 2026-07-14, is described by Sophos as the industry's first AI-native cybersecurity defense system, unifying endpoint, network, email, cloud and identity security with an agentic AI layer that Sophos says delivers an 89-second threat response time.
Timeline
- 2026-07-19Sophos joins Anthropic's Project Glasswing, uses Mythos 5 model on own codebase
- 2026-07-14Launches Sophos Fusion, an AI-native cybersecurity defense system
- 2026-06-22Joins OpenAI's Daybreak Cyber Partner Program for MDR workflows
- 2025-10-20Announces security operations portfolio update, cites 40,000 MDR customers
- 2025-10-01Refreshes endpoint security portfolio, launches standalone Sophos EDR tier
- 2025-02-13Cuts about 6% of combined workforce after Secureworks integration
- 2025-02-11Launches Sophos AI Assistant, a GenAI tool inside Sophos XDR
- 2025-02-03Completes $859M all-cash acquisition of Secureworks
- 2023-01Cuts about 10% of workforce (~450 employees) amid MDR pivot
- 2020-03-02Thoma Bravo completes $3.9B take-private acquisition of Sophos
Revision history
21 July 2026
First assessed. Protection under test. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- Sophos Joins the OpenAI Daybreak Cyber Partner Program (2026-06-22)
- Sophos Announces Latest Evolution of Its Security Operations Portfolio (2025-10-20)
- Powerful refresh of the Sophos endpoint security portfolio (2025-10-01)
- Sophos Completes Secureworks Acquisition (2025-02-03)
- Sophos Announces Completion of Take-Private Acquisition by Thoma Bravo (2020-03-02)
- Sophos lays off 6% of workforce following Secureworks acquisition (2025-02-13)
- Sophos Lays Off 6% of Workers Following Secureworks Purchase (2026-07-09)
- Sophos Product and Services News, June 2025 (2025-06-16)
- Sophos AI Assistant: Accelerating security operations with GenAI (2025-02-11)
- Sophos Launches Sophos Fusion (2026-07-14)
- Sophos joins Anthropic's Project Glasswing (2026-07-19)
- Sophos Company Profile