Hey everyone, We’re currently evaluating Sophos MDR Complete and SentinelOne Singularity MDR (with Singularity Complete) and would love to hear your real-world experiences — especially regarding support quality, response times, and how “hands-off” the MDR service really is.

Our situation: • We’re currently using SentinelOne without MDR – and generally happy with it. • We don’t have the manpower or expertise to handle serious security incidents ourselves. • We manage our own Sophos Firewall – firewall rules, NAT etc. are no issue. • Ideally, we want to just deploy the agent and have the SOC handle everything else.

What’s important to us: • Strong protection for Windows clients, servers, and Microsoft 365 • Low false positives • Responsive, high-quality support (bonus points for local or German-speaking) • A team that actively monitors and responds to threats • Minimal operational burden on our side

Our impressions so far: • SentinelOne seems very strong in automation, detection rules, and AI-driven telemetry analysis • Sophos offers native integration with Sophos Firewall, is listed as a BSI APT Response provider, and has local support in Germany • We had performance issues with Sophos Intercept X a few years ago, not sure if that’s still a thing.

We’re looking for insights like: • How well do these MDRs perform in practice? • Are alerts actionable? • Do they handle threat hunting and incident response effectively? • How’s the integration with Microsoft 365, firewalls, third-party logs, etc.?

Would love to hear any feedback, comparisons, or “lessons learned” from your deployments — thanks a lot!

Best regards stetze

Edit: We‘ve using Sophos MDR now.