Innovation unlocked: Sophos Endpoint is now integrated with Taegis MDR and XDR

Sophos Endpoint + Taegis. The best of both worlds.

I’m delighted to announce that Sophos Endpoint is now natively integrated and automatically included in all Taegis™ Extended Detection and Response (XDR) and Taegis Managed Detection and Response (MDR) subscriptions.

Customers gain immediate access to combined prevention, detection, and response capabilities in a single platform – while lowering costs and simplifying operations. The integration follows Sophos’ acquisition of Secureworks in February 2025 and represents a major milestone in combining the companies’ strengths to help customers defeat cyberattacks with a higher ROI.

Endpoint protection remains one of the most critical layers of defense against today’s cyberthreats, delivering both frontline prevention and vital telemetry for detection and response. With Sophos Endpoint included in all new and existing Taegis XDR and MDR subscriptions, customers can benefit from unmatched ransomware defenses and adversary mitigation capabilities that automatically deploy in the event of an attack. The integration enables organizations to strengthen protection while lowering licensing costs, reduce management overhead through native integration, and accelerate threat mitigation with expanded response actions.

Taegis remains a fully open platform, ensuring customers continue to receive full value from their existing cybersecurity investments and maintain the freedom to use the endpoint protection solution of their choice. This ensures that customers maximize ROI while allowing room in their budget for other cybersecurity priorities.

Watch this 2-minute video to learn more about the integration.

Organizations need superior protection

Too many organizations still treat endpoint protection like a commodity, and that’s exactly the mistake attackers are counting on. The reality is that not all endpoint products are built to stop today’s hands-on-keyboard attacks.

Sophos Endpoint’s prevention-first capabilities, like CryptoGuard anti-ransomware protection and Adaptive Attack Protection, shut down attacks before they can escalate, which is a true game changer for enterprises managing thousands of devices. And by simplifying deployment and policy management, we’re helping organizations stay ahead of threats, lower their total cost of ownership, and maximize the return on their security investments.

Key benefits for Taegis customers

• Lower costs and improved ROI: Sophos Endpoint is now automatically included with all Taegis XDR and Taegis MDR subscriptions, eliminating the need to purchase a separate endpoint security solution.
• Vendor choice preserved: Taegis remains an open platform, allowing organizations to continue using their preferred endpoint solution.
• Industry-leading protection: A 16-time leader in the Gartner® Magic Quadrant™ for Endpoint Protection Platforms, Sophos Endpoint provides unmatched defense against ransomware and other advanced threats, with features such as CryptoGuard and Adaptive Attack Protection, accessible directly from the Taegis console.
• Workflow continuity: Telemetry and detections from Sophos Endpoint are ingested into the Taegis platform, allowing customers to retain existing detection and response workflows.
• Simplified management: Customers can download, install, and manage Sophos Endpoint directly from Taegis.

Meeting customers where they are

To support a range of environments, customers can now choose between three deployment options for endpoint protection:

• Sophos Endpoint: Natively integrated for comprehensive prevention, detection, and response in a single agent.
• Non-Sophos native integrations: Telemetry ingestion ensures full visibility from products such as CrowdStrike, Microsoft Defender, SentinelOne and Carbon Black by Broadcom.
• Other non-Sophos endpoint security solutions: Supported through a detection-only sensor deployment option.

Streamlined Sophos deployment experience for Taegis users

Upgrading to Sophos Endpoint is an easy and frictionless process for Taegis users.

• Customers can download the Sophos Endpoint installers directly from within the Taegis platform – no additional licenses required.
• Documentation and upgrade instructions can be found on the Sophos Endpoint Agent page in the Secureworks documentation.
• Customers can retain their existing detection and response workflows as endpoint telemetry and detections from Sophos Endpoint are now ingested directly into the Taegis platform.
• Additional response capabilities are now available with Live Response functionality for Sophos Endpoint, directly from the Taegis console. This enables security teams to execute commands to terminate suspicious processes, reboot endpoints and servers, delete files, and more, with full, secure shell access. (Note: an endpoint must be running Sophos Endpoint to use Live Response – either the full agent or sensor).