What you are evaluating
Confirm the specific Sophos or Taegis offering and the incident-response work included in its tier. Sophos documents additional response services and warranty terms whose scope and conditions require separate review.
A useful evaluation context
Evaluation is for channel-oriented buyers comparing Sophos-native, Taegis-open, and Fusion-path SKUs and the IR acts included in the tier.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- Around-the-clock monitoring, hunting, and containment under contracted response modes.
- Third-party telemetry options in addition to Sophos-native signals, depending on the SKU.
- Flexible response modes so the customer can choose notify, guided, or more active containment.
Where it fits in the work
- Onboard the chosen SKU path (Sophos-native, Taegis-open, or Fusion) and the telemetry it actually includes.
- Investigate provider alerts and confirm which containment acts the tier performs versus customer IT.
- Hand events that need full-scale forensics to the IR terms in the tier or a separate retainer.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
In an authorized test tenant, raise a provider-supported harmless detection, then record who monitored it, who was allowed to contain, and whether remaining identity recovery stayed with customer IT.
Evidence to look for
The investigation record names the SKU path, the response mode used, and that production systems outside the test tenant were not changed.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- Which SKU path is on the order form, and which telemetry does that path actually monitor?
- Which incident-response activities are included in the service tier, and what separate terms govern any warranty or additional engagement?
- How are investigation records exported if the service later ends?