Overview
Secureworks is a managed security services and incident response provider headquartered in Atlanta, Georgia. Founded in 1999 and operated as a Dell Technologies subsidiary from 2011, Secureworks was acquired by Sophos in an all-cash transaction valued at approximately US$859 million, completed on 3 February 2025. The combined entity, ultimately owned by private-equity firm Thoma Bravo, positions itself as the largest pure-play managed detection and response (MDR) provider, supporting more than 28,000 organisations across both legacy customer bases.
The services practice centres on Taegis ManagedXDR — a 24/7 SOC service built on Secureworks' XDR platform — together with incident response, adversarial security testing, and threat intelligence drawn from the Counter Threat Unit. Post-acquisition, Sophos has consolidated the Taegis and Sophos MDR product lines and rebranded most security operations under the Sophos MDR umbrella. Secureworks continues as a services brand for enterprise IR and proactive engagements.
Buyers engage Secureworks for mid-market and mid-enterprise MDR coverage with predictable subscription pricing, IR retainers, and tool-agnostic operations across Microsoft, CrowdStrike, and SentinelOne telemetry. The firm is less well suited to very large global accounts seeking dedicated nation-state forensics teams, and post-acquisition integration with Sophos has created some product-roadmap uncertainty that buyers should diligence in any multi-year RFP.
Services Offered
- Taegis ManagedXDR and Sophos MDR managed detection & response
- Incident response retainers and emergency engagements
- Adversarial security testing — red team, penetration testing, purple team
- Vulnerability management and remediation services
- Identity threat detection and Active Directory assessment
- Counter Threat Unit threat intelligence subscriptions
- Compromise assessment and proactive threat hunting
- Cloud security posture and Microsoft Azure/AWS configuration review
- Security programme advisory and CISO-as-a-service
- Tabletop exercises and ransomware preparedness assessments
Typical Engagement
| Engagement Type | Model | Typical Range |
|---|---|---|
| Security assessment / compromise review | Fixed-fee project | $50K–$200K (4–8 weeks) |
| Penetration test / red team programme | Project or annual programme | $80K–$400K per programme |
| Sophos MDR / Taegis ManagedXDR | Annual subscription, per asset | $4–$12 per asset/month tiered |
| Incident response retainer | Monthly retainer with drawdown | $8K–$60K per month |
| IR consultant (staff augmentation) | Hourly bill rate | $275–$500/hour |
Pricing verified May 2026 from public procurement data and reference checks; ranges vary by region and engagement structure.
Strengths
- Predictable MDR subscription pricing — among the most transparent in the market for mid-enterprise buyers
- Tool-agnostic SOC operations across Microsoft Defender, CrowdStrike Falcon, and SentinelOne telemetry
- Counter Threat Unit threat research with 26 years of accumulated adversary tracking
- Combined Sophos + Secureworks footprint reaches into SMB and mid-market more deeply than tier-1 SI competitors
- Strong programme management discipline carried over from the Dell era
- 24/7 SOCs across Atlanta, Edinburgh, Bucharest, and Pune for follow-the-sun delivery
Limitations
- Post-acquisition integration with Sophos is ongoing — product roadmap clarity and Taegis platform continuity are open questions buyers should diligence
- Smaller IR forensics bench than Mandiant or CrowdStrike Services for nation-state engagements
- Limited deep advisory consulting capability — governance, transformation, and identity programme work typically routed to partners
- Headcount reduced from approximately 1,500 pre-acquisition to roughly 1,050; some senior consultant attrition reported in late 2025
- Limited public sector clearance and federal contracting capability compared with Booz Allen Hamilton or IBM