Sophos is one of Britain’s oldest and most successful cybersecurity firms — founded in Oxfordshire in 1985, long before ‘cyber’ was a household word. It grew from a two-person antivirus outfit into a global endpoint-security leader, was taken private by Thoma Bravo for about $3.9bn in 2020, and in 2025 acquired Secureworks for $859m to become a leading provider of managed detection and response, protecting more than 28,000 organisations.
Sophos is a study in longevity: a cybersecurity company that has stayed relevant for four decades by repeatedly reinventing what it protects and how it sells. This case study traces Sophos from an Abingdon startup to a global security vendor, explains its shift from selling products to enterprises toward managed services for smaller organisations, examines the Thoma Bravo take-private and the Secureworks acquisition, and draws out what founders can learn about endurance in a fast-moving industry. It sits naturally beside Darktrace in the British cybersecurity story.
What does Sophos do?
It provides cybersecurity products and services — endpoint protection, firewalls, and especially managed detection and response (MDR) — largely for small and mid-sized organisations and the IT partners who serve them.
Who owns Sophos?
Private-equity firm Thoma Bravo, which took Sophos private in 2020 in a deal worth about $3.9bn.
Why does Sophos matter?
It is one of the UK’s longest-surviving technology companies, showing how repeated reinvention — from antivirus to MDR — sustains a business across decades.
How did Sophos begin?
Sophos was founded in 1985 by Jan Hruska and Peter Lammer, near Oxford, initially working on encryption and then antivirus software as computer viruses emerged as a real business threat. It was among the first companies anywhere to treat malware defence as a commercial product.
For years Sophos focused on selling antivirus and endpoint protection to businesses rather than consumers, building a reputation for solid, no-nonsense enterprise security. That early, unfashionable bet on protecting organisations — not chasing the crowded consumer antivirus market — set the strategic direction it still follows, and makes it a foundational entry in the UK Company Stories hub.
How did Sophos evolve its business?
Sophos expanded well beyond antivirus into a broad platform: endpoint protection, network firewalls (helped by its acquisition of Cyberoam and Astaro), email and cloud security, all increasingly tied together and managed from a single cloud console called Sophos Central.
The decisive strategic shift was toward selling security as a managed service rather than a box of software. Recognising that most small and mid-sized organisations lack the staff to run security tools themselves, Sophos built its Managed Detection and Response (MDR) service, where its own experts monitor and respond to threats on the customer’s behalf — the same market gap other firms in the UK Company Stories hub have chased.
What is managed detection and response?
Managed detection and response (MDR) is a service where a specialist team continuously monitors a customer’s systems, hunts for threats and responds to incidents around the clock. It answers the core problem of modern security: tools alone are useless if no one is watching them at 3am.
MDR is especially valuable to smaller organisations that cannot afford a 24/7 in-house security operations centre. By turning security from a product a customer must operate into a service Sophos runs for them, MDR created stickier, recurring relationships and became the company’s strategic centre of gravity.
Why did Thoma Bravo take Sophos private?
Sophos had listed on the London Stock Exchange in 2015, but in 2020 US private-equity firm Thoma Bravo acquired it for about $3.9bn and took it private. As with Darktrace later, the rationale was to invest and reshape the business away from the short-term demands of public markets.
Private ownership let Sophos double down on its MDR and cloud strategy, make acquisitions, and integrate deeply without quarterly scrutiny. It was another example of American buyout capital acquiring a British security champion — a pattern that recurs so often it has become a defining feature of the UK technology landscape charted in the UK Company Stories hub.
Why did Sophos buy Secureworks?
In February 2025 Sophos completed the $859m all-cash acquisition of Secureworks, a US-listed cybersecurity firm spun out of Dell. The deal added Secureworks’ Taegis threat-detection platform and its enterprise-grade capabilities to Sophos’s mid-market strength.
The combination made Sophos one of the largest pure-play providers of MDR, supporting more than 28,000 organisations worldwide. Strategically it broadened Sophos both technologically — richer detection, identity threat response, next-generation SIEM — and by customer size, letting it serve larger enterprises without abandoning its small-business core.
How does Sophos make money?
Sophos earns recurring subscription revenue from its security products and, increasingly, from its MDR service, sold largely through a global network of channel partners. The move to services has shifted its mix toward higher-value, stickier recurring contracts.
Because MDR bundles software with an ongoing human-led service, it commands better economics and deeper customer relationships than selling software licences alone. That model — recurring, channel-delivered, service-led — is what makes a forty-year-old security firm still relevant against younger rivals like Darktrace.
What can founders learn from Sophos?
Sophos proves that reinvention, not novelty, is the key to longevity. It has renewed its core product roughly once a decade — antivirus, endpoint, firewall, cloud, MDR — while keeping the same fundamental mission of protecting organisations. Few technology companies survive forty years; those that do keep changing what they sell without changing why they exist.
Its second lesson is the power of services over products in a market where customers lack expertise, and of the channel as a distribution engine. Read alongside Darktrace and the wider UK Company Stories hub, Sophos is the endurance counterpart to the fast-scaling deep-tech story — proof that staying power is its own kind of success.
How does Sophos use AI in security?
Sophos applies machine learning to detect malware, phishing and anomalous behaviour, and increasingly uses AI to help its human analysts triage the flood of alerts that modern networks generate. In its model, AI augments the expert rather than replacing the round-the-clock human oversight that MDR customers pay for.
That blend of automation and human judgement is Sophos’s answer to a hard truth of security: tooling alone misses context, and pure automation still struggles with the ambiguity that skilled defenders resolve every day.
What is Sophos Central?
Sophos Central is the cloud console that unifies Sophos’s products — endpoint, firewall, email, cloud and MDR — into a single management pane. It lets a small IT team, or a managed service provider, oversee an organisation’s entire security posture from one place.
Consolidation is strategically important: by making its products work better together than apart, Sophos encourages customers to buy more of the platform, raising both revenue per customer and switching costs.
How does Sophos work with its channel partners?
Sophos sells predominantly through tens of thousands of resellers and managed service providers who deliver its products to end customers. For a small business without security staff, the local IT partner is the trusted face, and Sophos equips that partner to deliver enterprise-grade protection.
This channel-led model lets Sophos reach a hugely fragmented small-business market efficiently — a distribution lesson relevant to many founders profiled in the UK Company Stories hub.
How did Sophos survive the decline of traditional antivirus?
The signature-based antivirus that built Sophos became a commodity, bundled free into operating systems and outpaced by threats it could not recognise. Many antivirus-era companies faded as a result. Sophos survived by treating that decline as a signal to reinvent rather than defend a shrinking business.
It moved into next-generation endpoint protection that uses behaviour and machine learning, added firewalls and cloud security, and then reframed itself around managed services. The willingness to cannibalise its own legacy product before the market did it for them is exactly the discipline that separates the survivors from the casualties in the UK Company Stories hub.
What does the Secureworks integration involve?
Bringing Secureworks into Sophos means merging two threat-detection platforms, two data pipelines and two engineering cultures, then presenting customers with a unified offering rather than an awkward bolt-on. Secureworks’ Taegis technology and enterprise credibility complement Sophos’s mid-market strength and channel reach.
Done well, the combination makes Sophos a broader, more capable MDR leader able to serve both small businesses and large enterprises. Done badly, integration can distract engineering, unsettle customers and erode the trust that security buyers place above almost everything else. Execution over the next few years will decide which outcome prevails.
Who are Sophos’s biggest competitors?
Sophos competes with platform giant Microsoft, whose security tools are increasingly bundled into its enterprise agreements, with fast-growing cloud-native specialists such as CrowdStrike and SentinelOne, and with a crowded field of MDR and managed-security providers. Each pressures a different part of Sophos’s business.
Sophos’s defence is its focus on underserved small and mid-sized organisations, its deep channel relationships and its combined product-plus-service model. In a market that rewards both scale and specialisation, its bet is that being the trusted security partner for the mid-market — rather than the biggest name overall — is a durable place to stand.
What threats does Sophos defend against today?
Sophos’s customers face ransomware, business-email compromise, credential theft, supply-chain attacks and the growing use of AI by criminals to automate and personalise their campaigns. The threat landscape has shifted from isolated viruses to organised, financially motivated groups that treat cyber-attacks as a business.
Sophos responds with layered defence — endpoint, network, email and cloud protection — unified through Sophos Central and backed by round-the-clock MDR analysts who hunt for intruders and respond to incidents. Its central argument is that small and mid-sized organisations, which lack the resources of large enterprises, need exactly this blend of automation and human expertise, a gap that keeps a forty-year-old firm relevant among the newer names in the UK Company Stories hub.
What is Sophos’s place in British technology history?
Few technology companies anywhere survive four decades, and fewer still stay relevant through every era from the first computer viruses to AI-driven ransomware. Sophos’s endurance makes it a quiet landmark of British technology: proof that a company can outlast the very product category that launched it by continually redefining what it protects and how. For founders in the UK Company Stories hub, it is the clearest example that longevity is a strategy in its own right, earned through repeated, unsentimental reinvention rather than a single breakthrough.
Frequently Asked Questions
Is Sophos a British company?
Yes. Sophos was founded and is headquartered in Oxfordshire, England, and remains one of the UK’s oldest and largest cybersecurity firms, though it is now owned by US firm Thoma Bravo.
What is Sophos MDR?
Sophos Managed Detection and Response is a 24/7 service where Sophos’s own experts monitor a customer’s systems, hunt for threats and respond to incidents on the customer’s behalf.
How much did Sophos pay for Secureworks?
About $859m in an all-cash deal completed in February 2025, adding Secureworks’ Taegis platform and enterprise capabilities to Sophos.
How is Sophos different from Darktrace?
Sophos is a broad, channel-led security vendor centred on MDR for smaller organisations, while Darktrace is known specifically for self-learning AI that models normal network behaviour.
Discover more from Kurums | Business Intelligence
Subscribe to get the latest posts sent to your email.
