Secureworks Taegis MDR
Services firm (formerly Dell subsidiary, IPO'd 2016) acquired by Sophos in February 2025 for $859M. Open XDR MDR built on the Taegis platform with Counter Threat Unit intelligence, now part of Sophos X-Ops. Taegis continues with active investment, though long-term consolidation into Sophos Central creates uncertainty for enterprise buyers.
Buyer fit
Good fit when
- ✓Enterprise organizations wanting open XDR with existing CrowdStrike, Defender, SentinelOne, or Carbon Black EDR
- ✓Organizations valuing deep threat intelligence from CTU (now Sophos X-Ops)
- ✓Companies needing OT/ICS MDR coverage alongside IT MDR
Watch out when
- ×Buyers concerned about organizational stability after Sophos acquisition and significant headcount losses
- ×Buyers wanting fast onboarding (30-45 day typical deployment is slower than competitors)
- ×SMBs needing affordable MDR (per-endpoint pricing, $60K-$320K+/year reported)
Coverage
EDR
SIEM
Cloud
Additional capabilities
Incident response
Pricing
What costs extra
- –Extended data retention beyond 12 months (up to 48 additional months)
- –Incident Management Retainer (IMR) for expanded IR services
- –Penetration testing / adversarial testing
- –MDR for OT (operational technology add-on)
- –Vulnerability management services
Cost caveats
- –Sophos acquisition completed Feb 2025, Taegis integration into Sophos Central underway with long-term platform consolidation likely
- –~6% workforce reduction (~380 roles) in Feb 2025 post-acquisition, verify analyst continuity
- –Per-endpoint pricing varies widely ($70-$170/endpoint reported), negotiate hard
Pricing compiled from public sources. Verify directly with the provider.
Team and access
Reputation
G2 4.6/5 (48 reviews). PeerSpot 7.8/10 (#2 MSSP, #15 MDR). Glassdoor 3.5/5 with 64% recommending. Taegis achieved 100% visibility and 95% detection in MITRE evaluation. Product quality respected, but organizational stability is the concern after Sophos acquisition and significant headcount losses.
What customers praise
- ✓CTU (now Sophos X-Ops) still publishing threat research, intelligence capability maintained
- ✓100% MITRE ATT&CK visibility and 95% detection in inaugural evaluation
- ✓Unlimited remote IR for active adversary incidents included in base MDR
Common complaints
- ×~6% workforce cut post-Sophos close on top of ~44% headcount loss 2021-2024
- ×Long-term platform consolidation into Sophos Central creates migration uncertainty for enterprise buyers
- ×Console usability and reporting quality criticized per multiple reviewers
Limited publicly visible Reddit discussions in r/msp, r/cybersecurity, r/sysadmin as of February 2026.
Questions to ask
- 1.
What is the long-term platform plan: will Taegis remain independent or fully merge into Sophos Central?
- 2.
After the workforce reduction post-acquisition, what is the current analyst staffing across the 5 SOCs?
- 3.
If we bring our own EDR, do we get the same detection fidelity as using the Taegis Agent plus Sophos Endpoint?
- 4.
What data can we export if we leave, and can we take detection rules, playbooks, and historical data?
Evidence
Sources reviewed
Public-data caveats
- –SLA caveat: 60-minute investigation SLA from case initiation to customer notification. Service-level credits apply if missed. This is an investigation SLA, not a containment or remediation guarantee.
- –No public breach warranty is recorded.
- –Response authority may depend on pre-approval and contract scope.
Also consider
Information compiled from public sources. Verify details directly with the provider before making decisions.