Sophos Taegis

Extended detection and response is the practice of gathering security telemetry from endpoints, network, cloud and identity systems into one place, correlating it, and acting on what the correlation reveals. Taegis is the platform Secureworks built to do that, and the Counter Threat Unit is the research function that told the platform what to look for.

Those two assets are why the company was bought. Sophos acquired Secureworks for 859 million dollars, completing in February 2025, and folded the Counter Threat Unit into Sophos X-Ops, its own research organisation. Sophos already served smaller organisations with its own managed detection service; Taegis brought the larger, more complex estates.

Most organisations own several security products that each see one slice of the estate. The endpoint agent watches processes. The firewall watches traffic. The identity provider watches logins. Each is competent within its own boundary and blind immediately outside it.

Serious intrusions are usually unremarkable within any single boundary. An administrator logging in is normal. A file archive being created is normal. Data leaving the network is normal. The three together, in that order, within ten minutes, at two in the morning, is an exfiltration, and no single product is positioned to notice.

Correlation across sources is what turns those separately ordinary events into one recognisable pattern. It requires collecting from every layer, resolving which records describe the same machine and the same person, and ordering everything onto one timeline.

That work is unglamorous and it is the entire basis of the category. A product that only aggregates alerts into a single console has not done it; it has merely moved the problem into one window.

Taegis ingests telemetry across endpoint, network, cloud and identity, applies analytics to the combined stream, and presents investigations rather than raw alerts. Delivered as a managed service, the investigation is carried out by the provider's analysts, and the customer receives findings with recommended action.

The Counter Threat Unit supplied the intelligence behind those analytics. Its remit was tracking named threat groups, publishing research including an annual threat report, and issuing daily intelligence updates that informed detection logic. That function now operates within Sophos X-Ops.

For estates with genuine complexity, multiple sites, mixed cloud platforms, a substantial identity footprint, the correlation capability is worth buying rather than building. Assembling it internally means a platform, a research function and a staffed operations centre, and the research function is the part nobody can hire quickly.

For a smaller, simpler estate, the enterprise-oriented platform may be more than the situation requires, and the lighter managed service in the same portfolio is likely the better starting point. That is a scoping conversation, not a product debate.

One point deserves weight in either case. Consolidating detection, response and endpoint protection with a single vendor simplifies operations and strengthens the commercial position, but it also concentrates dependency. That is a legitimate trade, and it should be made deliberately rather than by drift.