Who does what
Provider
- 24/7 Taegis investigation
- Threat hunting
- Approved containment
Your team
- Integration health and access
- Permissions and custom rules
- Recovery outside scope
Coverage
- Endpoints
- Cloud Workloads
- Network
Details
Service scope
Best for Teams keeping supported security tools
Service
Taegis MDR base service. Enhanced and specialist options are separate.
Platform
Taegis with Sophos Endpoint or supported third-party tools.
Response
Analysts act through permitted integrations and playbooks.
Full service analysis
Sophos Taegis MDR investigates alerts and contains threats through approved host, account and network actions in Taegis. The buyer maintains integrations, response permissions and custom rules, and handles recovery outside the agreed response scope.
- Your team owns
- Deploying supported agents and maintaining integration health, credentials and access.
- Maintaining response permissions, exclusions and reachable incident contacts.
- Custom detection rules, business decisions and recovery outside contracted response.
Separate Taegis offer
Sophos completed the Secureworks acquisition in February 2025. It still documents Taegis MDR as a separately orderable service, distinct from the Sophos MDR offer. Confirm the product and terms named in the order.
Pricing & contract
- Billing
- Custom
Quote the exact Taegis MDR package, endpoint quantity, licenses and optional Enhanced, Elite Threat Hunting or TAM services. A bundled marketplace price should not be treated as a base-service rate.
Tradeoffs & buying questions
Strengths
-
Action-specific pre-authorization
Specific response playbooks let buyers define where analysts may act without another approval.
-
Supported endpoint choice
Existing supported endpoint tools can feed the service.
Considerations
-
Customer-owned integrations and custom rules
Customers retain integration health and custom detection responsibilities.
-
Taegis agent migration deadline
The Taegis Endpoint Agent has an announced support deadline and needs migration planning.
Ask before buying
- Which Taegis actions can your analysts execute in our tools, and which assets must be excluded from pre-authorization?
- What is included in our MDR price, and what requires Enhanced, Elite Threat Hunting, a TAM or a separate incident response engagement?
- Which contracting entity, analyst locations and data region apply, and what endpoint migration or renewal changes are scheduled?
Customer feedback
Customers value
-
Analyst help in 2024–2025 invited or incentivized G2 reviews
G2 MDR reviewers from 2024-2025 describe useful analyst explanations and investigation help. Several reviews were invited or incentivized.
-
Combined event visibility
Some customers value having endpoint, cloud and other events together for investigation.
Reported concerns
-
Search and integration learning curve
Several reviewers describe a learning curve for advanced search or integrations.
-
Some integration and support delays
Individual reviews report slow progress on uncommon integrations or complex support cases.
Integrations
Platform / SIEM
- Taegis
Endpoint
- Sophos Endpoint
- Microsoft Defender for Endpoint
- CrowdStrike Falcon
1 more integrations
- SentinelOne
Common questions
Does unlimited response cover every incident?
No. The current terms limit it to qualifying active threats observable in Taegis, including supported systems sending telemetry for at least seven days beforehand. Legal-privileged and insurer-involved matters require a separate incident response engagement.
Must we replace our endpoint product?
Supported third-party endpoint products remain an option. Sophos Endpoint is included. The Taegis Endpoint Agent reaches end of support on July 31, 2027, with a July 31, 2028 exception for pre-approved Japanese customers.