Sophos

Corporate brand

Cybersecurity company providing endpoint, network, cloud, email, managed detection and response, and incident-response services.

Last updated August 21, 2026

AI crawler reads

No AI crawler has read this profile since Oct 28, 2026.

Overview

Sophos is a British cybersecurity company that develops and markets security software, appliances, managed services, and incident-response capabilities for organizations and individuals. Founded in 1985 by Jan Hruska and Peter Lammer, the company initially worked on antivirus and encryption technologies before expanding into a broader security portfolio. During its early years Sophos concentrated largely on the United Kingdom, serving both private users and businesses with encryption products and other security tools. In the late 1990s it increasingly focused on antivirus and began an international expansion program. The company subsequently broadened its capabilities through organic development, partnerships, and acquisitions. Its portfolio came to include endpoint protection, network security, email security, encryption, mobile and web protection, policy compliance, network access control, malware analysis, and cloud-based security management. Acquisitions such as Utimaco, Astaro, Cyberoam, Surfright, Barricade, and Invincea added data protection, unified threat management, network security, behavioral analytics, malware scanning, and machine-learning-based threat prevention capabilities. Sophos later emphasized an integrated operating model in which endpoint, firewall, email, wireless, mobile, and cloud controls exchange threat intelligence and administrative information. Sophos Central became the principal cloud management environment for many of these products. The company's synchronized-security approach connected endpoint and network products so that a detected threat could trigger coordinated containment or policy action elsewhere in the environment. Products associated with the Sophos brand have included Intercept X endpoint protection, Sophos Firewall, Sophos UTM, email security, mobile security, and cloud-based security services. The company also developed managed detection and response, incident response, and extended detection and response offerings for customers that need continuous monitoring or specialist assistance. Sophos accepted outside investment from Apax Partners in 2010 and became a public company on the London Stock Exchange in 2015. In October 2019, Thoma Bravo agreed to acquire the company in a transaction valued at approximately US$3.9 billion in enterprise value. The transaction completed in March 2020, returning Sophos to private ownership. Following the acquisition, Sophos continued to operate as a dedicated cybersecurity business under Thoma Bravo's ownership. Leadership changed in 2024 when Kris Hagerman resigned as chief executive officer, President Joe Levy became acting CEO in February, and Levy was appointed permanent CEO in May. Sophos also expanded its managed-security position through the acquisition of Secureworks, announced in 2024 and completed in February 2025. Secureworks brought the Taegis extended-detection-and-response platform and related managed security capabilities into Sophos. The combined business serves customers through software, security appliances, managed services, threat research, and incident-response operations. Sophos has also publicly described counter-operations and investigations involving China-based threat actors targeting the company and the wider cybersecurity sector.

History

Sophos was established in 1985 by Jan Hruska and Peter Lammer. Its first activities included antivirus and encryption products, with early sales concentrated in the United Kingdom and directed at both consumer and business users. Through the late 1980s and 1990s, the company developed a range of security technologies, then increasingly concentrated on antivirus as malware became a more significant business and institutional risk. International expansion followed in the late 1990s. Sophos expanded its capabilities through acquisitions. In 2003 it acquired ActiveState, a Canadian software company associated with anti-spam technology and programming tools; ActiveState later became independent again. In 2007 Sophos acquired ENDFORCE, adding security-policy compliance and network-access-control technology. Sophos agreed to acquire Utimaco in 2008, adding encryption and data-security products. Utimaco was later divested through a management buyout in 2013. In 2011 Sophos acquired Astaro, a network-security company, and subsequently marketed the Astaro unified-threat-management product under the Sophos UTM name. Cyberoam Technologies joined Sophos in 2014, strengthening its network-security portfolio. The company merged with Surfright in 2015. Surfright's HitmanPro malware-scanning technology and HitmanPro Alert behavioral protections were subsequently integrated into Sophos offerings. Sophos acquired the behavior-based analytics company Barricade in 2016 and malware-detection company Invincea in 2017. These transactions supported the company's movement toward behavioral detection, machine learning, exploit prevention, and pre-breach threat intelligence rather than signature-based antivirus alone. Apax Partners acquired a majority interest in Sophos in 2010. Sophos announced plans for a London Stock Exchange flotation in 2015 and subsequently became publicly traded. During this period the company promoted a unified platform strategy built around Sophos Central and the exchange of telemetry between endpoint, firewall, email, wireless, and other controls. The synchronized-security model was intended to reduce administrative fragmentation and enable one product to inform or quarantine another when a threat was detected. Thoma Bravo announced an agreement to acquire Sophos in October 2019. The proposed transaction valued the company at approximately US$3.9 billion on an enterprise-value basis and completed in March 2020. Sophos was thereby taken private. Under the new ownership structure it continued developing endpoint security, firewalls, cloud management, managed detection and response, incident response, and related services. In 2024, Kris Hagerman left the CEO role; Joe Levy became acting CEO in February and permanent CEO in May. Sophos also disclosed research and operational activity concerning threat actors based in or associated with China, including groups identified in reporting as APT31, APT41, and Volt Typhoon. Separately, the company agreed to acquire Secureworks in October 2024. The transaction completed in February 2025 and added the Taegis XDR platform and Secureworks's managed-security expertise. Sophos subsequently operated as a broader software-and-services cybersecurity group serving customers through direct sales, partners, managed service providers, threat research, and incident-response teams.

2025
Secureworks acquisition completed
[5]Secureworks acquisition completedsophos.com
Sophos completes its acquisition of Secureworks and adds the Taegis XDR platform.
2024
Joe Levy becomes CEO
[4]Sophos appoints Joe Levy as chief executive officersophos.com
Joe Levy moves from acting CEO to permanent chief executive following Kris Hagerman's departure.
2020
Return to private ownership
[1]Sophosen.wikipedia.org
Thoma Bravo completes its acquisition of Sophos in March.
2019
Thoma Bravo takeover agreed
[1]Sophosen.wikipedia.org
Sophos accepts a recommended acquisition offer from Thoma Bravo.
2017
Invincea acquisition
[1]Sophosen.wikipedia.org
Sophos acquires Invincea to expand malware detection, prevention, and pre-breach forensic intelligence.
2015
Public listing
[1]Sophosen.wikipedia.org
Sophos completes its flotation on the London Stock Exchange.
2015
Surfright merger
[1]Sophosen.wikipedia.org
Sophos merges with Surfright, bringing HitmanPro malware-scanning and behavioral-protection technology into its portfolio.
2014
Cyberoam acquisition
[1]Sophosen.wikipedia.org
Sophos acquires Cyberoam Technologies, strengthening its network-security business.
2011
Astaro acquisition
[1]Sophosen.wikipedia.org
Sophos acquires Astaro and later markets its unified-threat-management products as Sophos UTM.
2010
Apax Partners investment
[1]Sophosen.wikipedia.org
Apax Partners acquires a majority interest in Sophos.
2008
Utimaco acquisition
[1]Sophosen.wikipedia.org
Sophos agrees to acquire Utimaco, expanding into encryption and data security.
2007
ENDFORCE acquisition
[1]Sophosen.wikipedia.org
Sophos acquires ENDFORCE, a provider of policy-compliance and network-access-control software.
2003
ActiveState acquisition
[1]Sophosen.wikipedia.org
Sophos acquires ActiveState, adding anti-spam-related technology before the business later becomes independent.
1985
Sophos is founded
[1]Sophosen.wikipedia.org
Jan Hruska and Peter Lammer establish Sophos and begin developing antivirus and encryption products.

Products and positioning

An integrated, enterprise-oriented cybersecurity provider combining endpoint, network, cloud, identity-adjacent, managed detection and response, and incident-response capabilities. Its portfolio is marketed to organizations ranging from small and medium-sized businesses to large enterprises and channel partners.

Cloud security management
Sophos Central
Sophos Central is the company's cloud-based management and administration environment. It brings together policy configuration, alerts, reporting, licensing, and operational controls for multiple Sophos products. Its role is to provide a common management layer across endpoint, firewall, email, wireless, mobile, and related security services, supporting the company's integrated and synchronized-security model.
Endpoint security
Sophos Intercept X
Intercept X is Sophos's endpoint-protection family. It combines malware prevention with exploit mitigation, ransomware protection, behavioral detection, and response-oriented controls. Technology obtained through the Surfright and Invincea acquisitions contributed to Sophos's broader emphasis on detecting malicious behavior and preventing attacks before or after an endpoint compromise.
Network security
Sophos Firewall
Sophos Firewall is the company's network-security and firewall product line. It provides perimeter and internal network controls, traffic inspection, policy enforcement, application visibility, and connectivity features. The product is designed to exchange information with other Sophos controls through the company's coordinated-security architecture.
Unified threat management · 2011
Sophos UTM
Sophos UTM is the rebranded unified-threat-management platform derived from Astaro technology. It combines several network-security functions in one appliance or software-controlled platform, including firewalling and related gateway protections. The product represented Sophos's expansion from endpoint software into network security.
Managed security service
Sophos MDR
Sophos Managed Detection and Response provides continuous security monitoring, threat investigation, and response support for customers that do not want to operate all detection and response functions internally. It combines Sophos telemetry, security operations expertise, threat research, and incident-response processes.
Extended detection and response
Sophos Taegis XDR
Taegis XDR is the extended-detection-and-response platform obtained through Sophos's acquisition of Secureworks. It correlates security data across multiple environments and supports investigation, detection, and response workflows. Its addition strengthened Sophos's managed-security and security-operations portfolio.

Controversies

2011
Utimaco partner monitoring-software allegations
Utimaco, which Sophos had acquired, was accused of supplying monitoring and tracking software to partners whose products were sold to governments including Syria. Sophos apologized, said it had suspended the relevant relationships, and announced an investigation.
Source

Synchronized Security
Global
Sophos promoted an integrated-security approach in which endpoint, firewall, email, wireless, and other controls share threat intelligence and can coordinate policy or containment actions. The campaign positioned Sophos as a unified alternative to collections of disconnected security products.
Outcome. Supported the company's cross-product platform strategy and Sophos Central positioning.
Source

Brand decisions

2024
Agree to acquire SecureworksM&A
Background
Sophos sought to expand its managed detection, response, and extended-detection-and-response capabilities.
Action taken
Sophos agreed to acquire Secureworks and its Taegis platform.
Aftermath
The transaction completed in February 2025 and broadened Sophos's security-operations portfolio.
Announced transaction value. US$859 million (2024 announcement)
Source
2019
Accept Thoma Bravo acquisitionM&A
Background
Thoma Bravo offered to acquire Sophos after the company had operated as a London-listed cybersecurity provider.
Action taken
Sophos's board unanimously recommended the US$7.40-per-share offer, which completed in March 2020.
Aftermath
Sophos became privately held under Thoma Bravo.
Enterprise value. Approximately US$3.9 billion (2019 offer; completed 2020)
Source
2015
London Stock Exchange flotationStrategy
Background
Sophos sought public-market capital to support international growth and product expansion.
Action taken
The company raised capital and completed a London Stock Exchange listing.
Aftermath
Sophos operated as a public company until its acquisition by Thoma Bravo in 2020.
Source
2011
Acquire AstaroM&A
Background
Sophos wanted a stronger presence in network security and unified threat management.
Action taken
It acquired Astaro and incorporated the company's network-security technology into the Sophos portfolio.
Aftermath
Astaro UTM was subsequently renamed Sophos UTM.
Source
2008
Acquire UtimacoM&A
Background
Sophos sought to expand beyond antivirus into encryption and broader data-security technologies.
Action taken
It agreed to acquire Utimaco, a publicly held security company.
Aftermath
The acquisition added encryption and data-protection capabilities; Utimaco was later divested in 2013.
Acquisition consideration. US$314 million reported closing value (2008)
Source

Recent events

Unconfirmed
Sophos launches AI Defense to surface and secure shadow AI usage[8]Sophos 推出 AI Defense，即时揭露影子 AI 并确保 AI 使用安全ithome.com.tw
Sophos announced the launch of Sophos AI Defense, a security solution delivered through the Sophos Fusion platform that identifies AI tools used by employees and applications, including tools not approved by security teams, and enforces security policies in any environment where those tools operate. The product is now generally available, and managed service providers (MSPs) can also offer the new capability to their customers.
2026-08-11
OpenAI launches GPT 5.6 Cyber model for security partners[9]OpenAI发布面向安全合作伙伴的GPT 5.6 Cyber模型tech.ifeng.com
Reported: 2026-08-10
OpenAI developed a new model called GPT 5.6 Cyber for vulnerability research, penetration testing and incident response, available only to selected companies and security vendors through the Daybreak Cyber Partner program.
Unconfirmed
Sophos acquires Refactr[10]Sophos 收购 Refactrsiliconangle.com
Reported: 2021-08-03
Sophos acquired Refactr, a Seattle-based startup whose platform helps enterprise software teams find and fix code vulnerabilities. The financial terms were not disclosed.
2021-07-22
Sophos announces acquisition of Braintrace[11]Sophos宣布收购Braintracetechcrunch.com
Reported: 2021-07-22
Sophos announced that it is acquiring cybersecurity startup Braintrace. The deal is intended to integrate Braintrace’s network detection and response technology into Sophos’s cybersecurity ecosystem; financial terms were not disclosed.
Unconfirmed
Sophos acquires Capsule8[12]Sophos 收购 Capsule8globalsecuritymag.com
Reported: 2021-07-08
Sophos announced that it had acquired Capsule8, a provider of runtime visibility, detection and response for Linux production servers and containers.
Unconfirmed
Sophos updates EDR product[13]Sophos 更新 EDR 产品ithome.com.tw
Sophos released a new version of Sophos EDR with scheduled queries and customizable content correlation. The article says EDR offerings with updated features would be available from Sophos partners starting May 19.
Unconfirmed
Sophos announces XDR solution[13]Sophos 更新 EDR 产品ithome.com.tw
Sophos announced Sophos XDR, an extended detection and response solution that integrates endpoint, server, firewall and email security. The article says it would be available from Sophos partners starting May 19.
Unconfirmed
Sophos appoints Kevin Isaac to lead EMEA sales[14]Sophos任命Kevin Isaac负责欧洲、中东和非洲销售it-online.co.za
Reported: 2020-10-16
Kevin Isaac joined Sophos as senior vice president of sales for Europe, the Middle East and Africa.
2020-03-02
Thoma Bravo completes acquisition of Sophos[15]Thoma Bravo完成对Sophos的收购infosecurity-magazine.com
Reported: 2020-03-02
Sophos announced that its acquisition by Thoma Bravo was complete. The cash transaction valued Sophos at $3.9 billion.
Unconfirmed
Sophos introduced Xstream architecture for XG Firewall[16]Sophos为XG Firewall引入Xstream架构cbinews.com
Sophos introduced its Xstream architecture for XG Firewall, adding TLS traffic decryption and other capabilities. The source says XG Firewall was available through Sophos Central.

Showing the 10 most recent.

Sources24 sources

Cite this profile: Cite the canonical profile. /brand-wiki/sophos · Editorial policy · How profiles are compiled