In short: Secureworks Taegis is the security operations platform Sophos gained when it completed its acquisition of Secureworks on 3 February 2025. Taegis XDR and Taegis MDR remain in the Sophos portfolio for enterprise buyers, Sophos Endpoint is included in Taegis XDR and MDR subscriptions, and Taegis detection technology now powers the enhanced Sophos XDR and Sophos MDR.
What happened to Secureworks?
Secureworks, the company behind the Taegis platform and the Counter Threat Unit research team, was acquired by Sophos. The deal completed on 3 February 2025, and Secureworks shares stopped trading on Nasdaq. The secureworks.com website now redirects to sophos.com.
On completion Sophos said that Secureworks's Counter Threat Unit and its security operations and advisory teams would join Sophos X-Ops, Sophos's combined threat research and operations group, and that both businesses would carry on serving existing customers as usual in the near term.
For Taegis users, the important point is that the platform did not disappear. Sophos has kept Taegis products on sale and has used Taegis technology to rebuild its own security operations line-up.
Taegis XDR and Taegis MDR today
Sophos still offers Taegis XDR and Taegis MDR as part of its portfolio. The Sophos MDR page points organisations that need enterprise-scale MDR towards Taegis MDR, powered by Secureworks.
Two practical facts for current Taegis customers:
- Sophos Endpoint is included in Taegis XDR and Taegis MDR subscriptions, so you can run Sophos's endpoint protection (the technology formerly sold as Sophos Intercept X) as the Taegis endpoint agent without a separate endpoint licence
- Some new Sophos add-ons are open to Taegis customers: Sophos said eligible Taegis customers can buy Sophos AI Defense at general availability without waiting for a move to Sophos Fusion
Sophos said on completing the deal that both businesses would carry on as usual in the near term, with their sales and customer teams supporting existing customers and renewals. Check your current contract for its terms, data retention and integrations, and at renewal compare staying on Taegis with moving to the Sophos-branded tiers below.
How Taegis technology powers the Sophos line-up
| Sophos product | Taegis contribution |
|---|---|
| Sophos XDR (shown as Sophos XDR Powered by Secureworks) | Taegis detection technology and Counter Threat Unit intelligence, an enhanced analyst experience and automation playbooks |
| Sophos MDR and Sophos MDR Plus | Broader integrations, embedded threat intelligence and a redesigned analyst workspace used by Sophos's MDR team |
| Sophos Next-Gen SIEM | Not Taegis-branded, but available only on the enhanced XDR and MDR: it adds long-term retention, compliance reporting and custom integrations |
These enhanced versions became generally available to new term (non-MSP) customers at the end of August 2026 within Sophos Fusion, the evolution of Sophos Central, with MSP availability planned to follow and existing Sophos customers upgraded in phases.
Options for existing Taegis customers
| Option | Suits | Things to check |
|---|---|---|
| Stay on Taegis XDR or Taegis MDR | Large or complex estates already built around Taegis | Renewal terms, roadmap for your integrations, Sophos Endpoint deployment |
| Move to Sophos XDR | Teams that run their own investigations and want the Sophos Fusion console | Data source parity, playbook rebuild, retention needs |
| Move to Sophos MDR or MDR Plus | Organisations that want Sophos to run 24/7 detection and response | Response mode, incident response scope, the Breach Protection Warranty with MDR Plus |
| Add Next-Gen SIEM | Teams that used Taegis for log retention or compliance | Retention period required, custom log sources |
There is no single right answer. Bigger SOC teams with heavy Taegis customisation may prefer to stay where they are, while smaller teams often find the Sophos tiers simpler to buy and run. Either way, plan any change early in your renewal window.
Questions to ask before your renewal
- Which of your current Taegis integrations and custom detections do you rely on, and are they available in the option you are considering?
- How long do you need to keep security data, and for which regulations or audits?
- Who responds out of hours today, and do you want that to change?
- Is your endpoint agent already Sophos Endpoint, or do you still run another vendor's agent?
- Does your cyber insurer ask for specific services, such as incident response or a warranty?
How we help
Forever Systems helps UK organisations make sense of the post-acquisition line-up. We will map what you have on Taegis today against Sophos XDR, Sophos MDR and Sophos Next-Gen SIEM, and give you a written comparison with a quote for each route.
Contact us before your renewal date so there is time to plan.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Did Sophos buy Secureworks?
Yes. Sophos completed its acquisition of Secureworks on 3 February 2025. Secureworks's Counter Threat Unit and operations teams joined Sophos X-Ops.
Is Secureworks Taegis being discontinued?
No. Taegis XDR and Taegis MDR are still offered as part of the Sophos portfolio, and Sophos points organisations that need enterprise-grade MDR to Taegis MDR. Taegis detection technology also now powers the enhanced Sophos XDR and Sophos MDR.
Is Sophos Endpoint included with Taegis?
Yes. Sophos Endpoint is included in Taegis XDR and Taegis MDR subscriptions.
What is the difference between Taegis XDR and Sophos XDR?
Both use Taegis technology. Taegis XDR is the original Secureworks platform aimed at larger security teams, while Sophos XDR Powered by Secureworks is the Sophos-branded tier managed in Sophos Fusion alongside other Sophos products.
Do Taegis customers have to move to Sophos Fusion?
Taegis XDR and Taegis MDR are still sold, and Sophos has let eligible Taegis customers buy add-ons such as Sophos AI Defense without waiting for a Fusion migration. Review your options at renewal, and check eligibility for any new Sophos add-ons you want.