The solution is expensive and can be improved by lowering the cost.

I would like to have the capability to support legacy operating systems because the majority now don't support Windows XP, and Windows 2000. We still have business applications that have vendors using Windows XP.

The product is not secured and doesn't offer a fast connection. From an improvement perspective, the product should be made more secure and should be able to provide a faster connection to users.

We are getting too much logging sometimes. The logging issues must be fixed. We need more control over loggings. The solution must provide integration with SIEM solutions.

The solution could be improved in terms of the performance of the appliances. Sometimes the appliances in the market can be quite large. Additionally, in comparison to other appliances, such as FortiGate, Cisco Firepower, or ASA, it could be improved in terms of package processing or traffic handling.

There has been an increase of about 7-10% in recent months. That's why we face issues with customers who have been using it since 2017. 

The update part is a bit tricky in the solution. Sometimes what happens is the client thinks that the agent is holding, causing the CPU or memory to spike up. So that is where the issue occurred, which was reported earlier. In short, the solution's update part's shortcoming is an area to be improved.

There should be granularity in terms of filtering. So, if you say application-based filtering, then there should be some layer-7 filtering added.

We do not quite like the product. There are a lot of limitations to it. It is a hassle every time we want to unlock it. We need to uninstall the license to move to another endpoint. It is troublesome to uninstall too.

Sometimes, we need to call support because the product doesn’t work properly. There are limitations to the product’s analytics and traceability too.

I'd like to see some kind of delegated administration privileges for large organizations and differential permissions for admins. We've had some issues with Macs accessing parts of the website and it was difficult to tackle the situation because the support was not able to adequately solve the problem. They gave us workarounds rather than providing a properly tested solution. The customer support is a little slow and could be improved.

Sophos EPP Suite could improve the way it can be installed. They used to have one installer and now they have two, one for the server and one for the client. I don't know the difference, it brings confusion.

The area improvement is something very specific. Windows firewall security allows an exception where the user of a specific device can turn the firewall on or off. We need to configure our Windows firewall security in an active directory via group policy. We do not want to allow the exception or for individual users to be able to make this change. When using Sophos, instead of doing this in an active directory, we have to create a policy on the Sophos portal itself. In the Sophos policy, we can indicate which port is allowed and which port is not allowed for the Windows firewall and how it is handled.  

Previously, we were using ESET smart security which also has a Windows firewall base. We could control each and every link and port for everything. Like for people taking their desktop remotely, we could allow VNC (Virtual Network Computing) remote connections on a specific port only. All other ports are blocked from this type of access. This feature is something only ESET had. I am pretty much sure Sophos does not have this kind of policy available. They should make this adaptation. The rest of the Sophos product and the technology and utility of the suite is beautiful. I believe all network system administrators would be glad to have this feature. 

What I would also like to see added is information about update compatibilities. This should be included in a notification for upgrades from Sophos as to whether there is any reason to update Windows for Endpoint or not. The problem stems from the fact that Microsoft is releasing these updates and the patches for security every month. A lot of those patches have issues and incompatibilities. After Microsoft releases the updates, they sometimes have to release a fix to the update with patches. They usually do this in the next two to three days. It would be helpful if Sophos did the testing of the updates to inform all their clients so we can be sure these updates are OK. Then, in turn, we can inform our clients if updates are compatible with their servers or not.  

The product's resource utilization is a concern, especially regarding memory usage on systems with older specifications such as lower memory and less powerful processors. Installing the product on these systems can lead to slowdowns due to resource consumption. If the product's resource demands can be reduced, it would greatly improve the user experience, especially for end users with less powerful hardware. 

The solution needs to perform better or update its anti-ransomware and anti-malware engines to keep up with the latest hacking techniques.

So, I would like to see a better update on the anti-malware engine.

In terms of improvement, the main challenge is setting up VPN connections. I have tried online resources and even turned to Kubernetes for help, but the primary issue I face is the complexity of creating VPN connections, and I'm seeking ways to make this process easier. Additionally, I have also faced difficulties with web filtering. In future Sophos releases, I would like to see simplified processes. For example, make port forwarding setup take just two or three clicks, streamline web filtering to two or three steps, and ease the separation of PCs from mobile devices within five clicks. The aim is to make these tasks more user-friendly and less time-consuming.

There could be more integration included in Sophos EPP Suite.

This signature-based malware prevention method is a little out of date. We are currently attempting to migrate to a newer, cloud-based solution in which we not only use signature-based antivirus scanning but also EDR with processes and similar tools to better recognize potential attacks, which is what the actual version cannot do.

It has not been developed in the last few years.

There are also issues with the compatibility of the OS. When using Sophos with Windows and devices, most of them work well, but as soon as we work with macOS and Linux, many issues arise that we do not want to have.

macOS is incompatible.

I'm not sure if the solution is missing anything. For us, it seems to be covering our needs quite well.

The solution has a strange technical support process where you need to move through all of these tiers before you can get to someone who can help you. They should streamline the process and make it easier to speak to the correct level of support from the outset.

SentinelOne has what they call a rollback feature. It would be great if something similar was added to Sophos.

The encryption features are not as good as McAfee's. Sophos can only do the entire encryption of a hard disk, whereas McAfee can do file encryption, too. The product should introduce file encryption features. McAfee provides a key for encryption. We can still decrypt the file using the key if the encryption is not connected to the server. Sophos could provide such features.

Sophos EPP Suite's support services need improvement. They take a long time to reply to queries every time.

The solution could be more stable.

One area for improvement in Sophos EPP Suite is the support response time, particularly of the management team. It could be faster because I only got a response from the manager after a few days. If you open a case directly from the website, the response from the technical support agent may have been faster. I didn't open the request from the website, so that could be the reason why the response time took longer.

Sophos EPP Suite could improve by decreasing the number of resources it uses. There are other solutions that use one-fifth of the resources.

There could be enhancements made to the DLP. It should have similar features that CrowdStrike or SentinelOne. They can protect the endpoint more effectively. Both of these solutions are better than Sophos; however, in our region, the pricing of Sophos is better. 

The product must consolidate all the consoles. The product should improve support and provide more scalable clustering.

My use case is very, very simple. The solution gives me protection from the latest attacks, and visibility into the cloud. I don't have any integration use cases, so from our enrollment perspective, I would say maybe it could be a little lighter in terms of agent usage so that there is less computer utilization.

There are no missing features. We're fine with its capabilities.

It would be ideal if the price could be lowered a little bit.

If we could bypass the first couple of levels of support when we have a problem then it would be easier and quicker when we need an issue resolved.

The user interface is not responsive.

The product's filtering and stability can be better. 

Sophos EPP Suite demands significant resources just to operate. For example, it takes up more than 50% of the resources on our laptop to run it. So, even if we buy a laptop i7 and use 50% resources for Sophos, it will cost us more because every computer needs energy. I don't know why or what the exact problem is.

Part of the product that can be improved is the detection of other antivirus software. We had some trouble one time installing the product because there was a third-party antivirus product that we needed to remove before we could install Sophos. That detection in the installer could be better. It can easily be solved but does not have to be a problem in the first place. 

Pricing could be improved because it is a bit expensive. 

It would be nice if there were more capability to configure the notifications. We do get some notifications when a virus is detected or something is wrong, but we get notifications that the machine has to be restarted or other issues that should be handled by different people or different departments. There should be some distinction as to which notification type we want to send to a particular destination. That's something that should definitely be better in an enterprise solution.

The solution could improve in configuration and the central logging and dashboard.

The solution isn't quite accurate enough. It provides a lot of false positives.

For example, if you log onto the portal, you'll be able to see the endpoints. You'll see the health status, but when you click on one, you'll find everything right there, even though it might not be clear from the health status overview. The accuracy of the status needs to be better represented.

In the future, we're looking forward to having a new synchronization firewall on the endpoint.

The management console need improvement. 

I'd address the deployment side. If we could upgrade the deployment side to hand it off to the end-user, it would make it easier, as our campuses are far apart.

We'd appreciate if the solution could offer us assistance with a later deployment.

We have to use additional third-party solutions to fill the gaps in the capabilities of Sophos EPP Suite, such as using a mobility scanner. It would be helpful to add this feature.

The synchronization security should be improved or optimizing the use of the Sophos XGS firewall and endpoints. It's unnecessary to activate both web filters in this scenario. More integrated intelligence added to all of the solutions would beneficial.

The solution’s performance could be improved for the end-users.

More integration options could be included in Sophos EPP Suite.

The solution could improve on the resource management, it is a bit heavy on the resources.

The solution is a challenge in terms of setting up the rules and managing them.

Since the solution runs silently, you do not know whether the antivirus database has been updated or not. I'm not so sure whether I'm even using an updated antivirus database or if it even scanning every time that I insert a flash disk. I just need that scan and I need to know it's happening. I'm not getting that. 

Even if it does a scan, I don't know if hazards have been dealt with. For example, did it clean the disk after it scanned it? In other products, it's much more clear. There needs to be some sort of report that lets you know if it's running if it found something, and what it did with it, etc. 

We're concerned the Sophos partners may not necessarily have the right skill sets to deploy the solution in a way that meets our expectations.

The solution is not easy to use in comparison to other endpoint security solutions.

We use cloud services quite a bit. Therefore, I would like to see integration with other security tools besides endpoint so that I'm not managing different tools separately. I would prefer to have a single security solution for my laptop and for managing other security things like passwords.

I would like to have more logging features to help more deeply analyze traffic. This would provide us with more control over the products, incidents, issues, and so on.

It would be helpful to have more control of the devices attached to the desktop, giving us better visibility and manageability. This would help us to prevent Traversal attacks, where the user can plug in external USB devices, for example.

It could have a less traumatic migration from server A to server B, when needed. However, as long as you don't need to migrate, the product runs smoothly.

There could be an equipment inventory feature for the solution. It will help us make lists of CPUs, memory, and other essential components similar to Kaspersky and a few other vendors.

Additional security is always good; it would be helpful if the technical support could be improved.

If you are not an IT expert, the solution is difficult to use. So it needs to be simpler for a non-IT person so that when you have an issue, you can you know that the solution is just a click away. Except for the more advanced things. So in terms of usage, the management tools, monitoring, and dashboard should be easier to use.

They should consider giving the devices for free when they are charging for licensing.

In the next release, I would like to see the phishing attached included in the firewall.

Normally getting junk mail and phishing in emails is a problem for us. We are protected with other solutions but we would like to see it in the is one.

In my country, having an on-premises deployment model is preferred. In this part of the world, on-premises is still the way many companies want to go. Therefore, they should supply some sort of option that allows for that reality.

Technical support needs to be improved.

In the future, I would like to see better third-party integration so that it can work in conjunction with our ticket system.

Deployment and central management need to be improved.

In the next release, the solution should add anti-spam. They should add a plugin and or a browser plugin for security.

The support could be improved. The response times are slow.

Most of my clients are comfortable with the product and how it operates, but I'm sure there could be improvements that could be made.

The solution needs to move from small businesses to large enterprises so they can compete with the 40 gig Check Point. They need to build a product for that environment.

The one challenge of this product is the lack of support. I know they are busy but the response time should be quicker. Even if they had someone to just pick the call up and then generate the cases, that would be an improvement. It could be like Cyberoam where they have one dedicated person who receives the calls and generates the case for the customer and then the engineer responds. With Sophos you can wait on the phone for two to three hours before you get anybody from the technical support team. It's a real challenge. 

For endpoint, if they could add the start and stop scanning or abort scanning button to the endpoints, that would be an improvement. Sometimes what happens is that the scan is being used but my system is slow and I have to do some urgent work, but I'm not able to pause the scan. I have to forcefully restart it or try something else. The inclusion of a feature like that would be helpful for end users. 

Sometimes there are issues with the antivirus backlogs. 

Sophos is lacking in the granularity of optimization, so having more control would be better.