Sophos completed its all-cash acquisition of Secureworks on February 3, 2025. The approximately $859 million transaction was intended to combine Sophos’s endpoint, network, email and cloud controls with Secureworks’ Taegis XDR and MDR platform, threat intelligence and security-operations services. By 2026, the key question is no longer whether the deal will happen, but whether staged product, licensing and analyst integration delivers a simpler and more effective service for customers.
The deal in brief
| Item | What happened |
|---|---|
| Announcement | Sophos announced the acquisition in October 2024. |
| Consideration | All cash, approximately $859 million, or $8.50 per Secureworks share. |
| Premium | 28% over Secureworks’ unaffected 90-day volume-weighted average price, according to Sophos. |
| Closing | February 3, 2025. |
| Listing | Secureworks common stock stopped trading on Nasdaq after closing. |
| Ownership context | Sophos is backed by Thoma Bravo. |
The transaction changed Secureworks from a separately traded company into part of Sophos. The announcement is documented in Sophos’s acquisition release; the closing terms appear in the completion announcement and the SEC filing.
What each company contributed
Sophos’s platform
- Endpoint protection and response.
- Network security and firewall products.
- Email and cloud security.
- Sophos Central management.
- Existing Sophos MDR and XDR services.
- Sophos X-Ops research and response operations.
Secureworks’ assets
- Taegis XDR and Taegis MDR.
- Identity threat detection and response.
- Next-generation SIEM capabilities.
- Managed-risk services.
- Advisory and incident-response services.
- Counter Threat Unit threat intelligence.
Sophos said the combined business would serve more than 28,000 MDR organizations and more than 600,000 total customers. Those are company-reported figures, not independently audited market rankings. The strategic description is set out in the completion release.
Why MDR and XDR were central to the strategy
EDR
Endpoint detection and response concentrates on activity from laptops, desktops and servers, with tools to investigate and contain endpoint threats.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →#1 Best Overall
XDR
Extended detection and response correlates endpoint signals with identity, network, email, cloud and other telemetry. Its value depends on the quality of integrations, retained data and available response actions—not merely on the XDR label.
MDR
Managed detection and response adds a staffed service: analysts monitor, investigate, hunt and, within agreed authority, respond to incidents. An MDR service powered by XDR includes people, escalation procedures, service levels and response permissions as well as software.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
Sophos says its MDR service can use Sophos products or telemetry from third parties including AWS, Check Point, CrowdStrike, Darktrace, Fortinet, Google, Microsoft, Okta, Palo Alto Networks and Rapid7. Buyers should confirm which connectors provide only alerts and which permit containment or other response actions. See the Sophos MDR overview.
What has actually been integrated
| Date | Milestone | Status and qualification |
|---|---|---|
| October 2024 | Acquisition announced | Transaction proposal, not an operating integration. |
| February 3, 2025 | Acquisition completed | Secureworks became part of Sophos. |
| September 2025 | Sophos Endpoint natively integrated with Taegis XDR and Taegis MDR | Sophos said the endpoint capability was included in Taegis XDR and Taegis MDR subscriptions. |
| December 10, 2025 | Taegis added to the Sophos price list | Partner deal registration was unified; Sophos said Taegis was not then available through MSP Flex. |
| 2026 | Further platform and MDR convergence | Presented as staged roadmap work rather than proof that every console, contract and workflow has merged. |
| August 2026 | Planned AI-native defense rollout | Announced rollout timing should not be treated as universal general availability without checking edition and region. |
The endpoint milestone and roadmap are described on Sophos’s integration page and in its roadmap presentation. Sophos’s May 5, 2026 licensing guidance still lists separate Sophos MDR, Taegis MDR, Taegis XDR and Sophos XDR product families. That indicates staged coexistence, not an overnight replacement.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat existing customers should check
Existing Sophos customers
- Whether the current MDR or XDR subscription includes the specific Taegis-powered capability.
- Whether the contract covers analyst-led response or notification only.
- Whether new identity, cloud, server or third-party data sources require additional licenses.
- Which console and API are authoritative during the transition.
- Whether a new agent, sensor or permissions model is required.
- Data-retention, daily-storage and search limits.
Sophos’s licensing guidance says one Sophos MDR subscription includes one Sophos XDR license, while Sophos XDR and Taegis XDR have different stated usage limitations. Confirm the entitlement attached to the exact SKU rather than relying on a product-family name.
Existing Secureworks and Taegis customers
- How renewals, discounts and legacy contract terms are handled.
- Whether support contacts, escalation paths or service-level remedies change.
- Whether non-Sophos endpoint and third-party telemetry remain supported with the same response depth.
- Whether roadmap priorities move toward Sophos Central.
- Whether response authority and analyst access remain unchanged.
Sophos initially said both businesses would operate as usual after closing. That was an initial operating statement, not a perpetual guarantee that product names, prices, consoles or contracts would never change.
Rank #4
How new buyers should evaluate the combined offering
- Choose the operating model. Select MDR when 24/7 monitoring and external investigation are needed. Select XDR when an internal team can operate the platform, hunt and coordinate response.
- Map the environment. Count users, endpoints, servers, identities, Microsoft 365 or Google Workspace, cloud workloads, firewalls, SaaS applications and any OT or specialist systems.
- Specify response authority. Put notification-only, customer-approved containment, provider-executed containment and full incident-response engagement into the contract.
- Test integrations. Ask which sources are native, how much telemetry is retained, whether historical search is available and which response actions work for each source.
- Set governance. Define the RACI, escalation contacts, customer obligations, maintenance windows and evidence-preservation process.
- Price the whole service. Request a quote using user and server counts, existing Sophos or Taegis licenses, cloud footprint, required retention, regulatory geography and any managed-risk or incident-response add-ons.
Sophos publishes quote-based buying pages for MDR, XDR, MDR for Microsoft Defender and Managed Risk. No public dollar figure establishes a like-for-like comparison.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Where the deal can disappoint
- Product overlap: Sophos and Taegis names, tiers and consoles may remain confusing during convergence.
- Migration risk: Duplicate agents, different data models, split reporting or changed escalation paths can reduce the practical benefit of an acquisition.
- Coverage gaps: “XDR” does not guarantee deep coverage for unmanaged devices, OT, legacy systems, SaaS identities or cloud-native workloads.
- Vendor concentration: Consolidating endpoint, firewall, email, cloud, XDR and MDR with one provider can simplify operations while increasing dependency.
- Contract constraints: Storage, retention, API and query limits can affect investigations and should be treated as contractual design parameters.
- Marketing versus proof: Sophos advertises a 38-minute average incident-closure time; its definition, population and measurement period should be disclosed before using it as a benchmark.
The Taegis MDR service description outlines monitoring, investigation, hunting and response services, but the buyer’s order form and service description determine the actual entitlement.
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
Alternatives worth comparing
| Option | When it may fit | What to verify |
|---|---|---|
| Microsoft Defender Experts for XDR | Microsoft-centered identity and security environments. | Coverage outside Microsoft and response permissions. |
| CrowdStrike Falcon Complete | Organizations prioritizing an integrated endpoint and managed-response stack. | Non-CrowdStrike telemetry, retention and exit terms. |
| SentinelOne Vigilance MDR | Buyers centered on SentinelOne endpoint technology. | Cloud, identity and third-party response depth. |
| Huntress MDR | Small businesses and MSPs seeking a simpler managed model. | Enterprise-scale integrations and specialized coverage. |
| Internal SOC with SIEM/XDR | Organizations with staffing, response maturity and a need for maximum control. | 24/7 coverage cost, hiring risk and operational resilience. |
These are comparison candidates, not automatic winners. Current prices and service levels require a separate, dated, like-for-like procurement exercise.
Bottom line: stronger foundation, unfinished convergence
The Secureworks acquisition materially strengthened Sophos’s MDR and XDR ambitions by adding Taegis technology, security-operations expertise, identity and SIEM capabilities, managed risk, advisory services and threat intelligence. The business case is credible, but the customer outcome depends on execution: telemetry quality, analyst workflows, response authority, licensing clarity, data limits and migration support. In 2026, evaluate the exact subscription and service commitments you can buy—not the acquisition announcement alone.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
