Sophos
A British security veteran owned by Thoma Bravo since 2020. It is betting on managed detection and AI, while carrying about $2.5B of buyout debt it spent 2026 refinancing.
Group accounts FY2025 (Companies House)- Valuation
- $3.9B (2020) Thoma Bravo's take-private price, $7.40 a share. No newer mark has been published.
- Revenue
- $1.22B Year to March 2025, up 8%. Adjusted EBITDA $332M, but a net loss of $151.5M after interest.
- Debt
- $2.46B loans First lien term loans at Mar 31, 2025, then due March 2027. Interest on loans cost $161M that year.
- Watch
- Refinancing Moody's cut the rating to B3 in March 2026; a $200M second lien loan came in October as part of the refinancing.
- AI
- Agentic SOC Sophos says AI fully resolves 52% of cases in its managed service; AI Defense for shadow AI launched Oct 2026.
- Liquidity
- No public market Equity sits inside Thoma Bravo's holding entities. Share-based pay cost $36.9M in FY2025, up from $11.0M. No staff tender found.
- Hiring
- 80 → 70 remote listings since Oct 10.
Mostly subscriptions and services, sold through partners.
Sophos sells endpoint, firewall, email and cloud security plus managed detection and response (MDR) through about 25,000 partners, 7,000 of them managed service providers. Firewall appliances are the only hardware line. Billings were $1.31B; MDR billings grew 26.7%.
- 1A partner channel few rivals matchMore than 25,000 active partners, over 7,000 of them MSPs, the fastest-growing part of the channel, per the FY2025 accounts.Group accounts FY2025 (Companies House)
- 2One of the largest MDR providers by customer countOver 30,000 MDR customers at the end of FY2025 after adding Secureworks' Taegis, a base Sophos says doubled in two years.Group accounts FY2025 (Companies House)
- 3A huge small and mid-market base587,000 customers at FY2025 year end (MSP program included); Sophos now says 625,000+ organizations are defended.Sophos llms.txt, Oct 2026; FY2025 accounts
- Palo Alto Networks$300Blisted, Oct 30 close
- CrowdStrike$256Blisted, Oct 30 close
- Arctic Wolf$4.30Bprivate, Jul 13
- Sophos$3.90BTake-private buyout, Mar 2
Private values are the last reported round; they can be stale. Listed values are market value. Bars start at zero.
Every round, and what its terms give away.
Sophos is private, so there is no share price. What its investors paid, and on what terms, is the closest thing to one.
- $3.90B
- latest valuation, Take-private buyout Mar 2
- $1.22B
- annual revenue, as of Mar 31
- +8%
- growth, as reported
- 4,385
- employees, as reported
Net loss $151.5M (2024 restated: $93.1M loss). Adjusted EBITDA $332M; cash from operations $320.3M. ARR $1.27B including Secureworks. Reported ARR growth of 6% in the quarter to June 2026.
Group accounts FY2025 (Companies House); employees = FY2025 average- Oct 16Second lien term loan$200MLed by GTCR (co-lead, other co-lead not named)Raised in connection with refinancing the $2.45B first lien loan. New maturity and pricing not disclosed. A new security deed with Goldman Sachs Bank USA was registered Oct 15.Pulse 2.0, Oct 17, 2026; Companies House MR01
- Feb 3Incremental first lien term loan$650MLed by Existing first lien lendersFunded the Secureworks purchase. Same terms as the 2020 buyout loans, maturing March 2027.Group accounts FY2025 (Companies House)
- Mar 2Take-private buyout$3.90B at $3.90BLed by Thoma Bravo. About 100% of the company, if all new shares$7.40 a share in cash; Sophos left the London Stock Exchange, where it had listed in 2015.TechCrunch, Mar 2, 2020
- Time since the buyoutAbout six years and eight months (closed Mar 2, 2020). That is long for a private equity hold, and no sale or listing has been reported.TechCrunch, Mar 2020; news search Nov 3, 2026Flag
- Debt loadNet debt $2.19B against $332M adjusted EBITDA at Mar 2025, about 6.6x (our arithmetic). Moody's cut the rating to B3 in March 2026 and saw leverage rising from 6.3x toward 9x in FY2026.Accounts; Octus, Apr 15, 2026Flag
- Has the 2027 maturity been fixed?A $200M second lien loan was raised in Oct 2026 in connection with refinancing the first lien loan, and a new security deed was registered Oct 15. The new maturity, rate and covenants have not been published.Pulse 2.0, Oct 17, 2026; Companies HouseOpen
- Is the owner putting in more money?Thoma Bravo indicated it would not add equity to the refinancing, per Bloomberg as reported. Private credit lenders declined the deal earlier in 2026.Private Equity Wire (citing Bloomberg), Aug 19, 2026Flag
- Layoffs in the last 12 monthsConfirmed cuts: 6% in Feb 2025 and about 10% in 2023, both older than 12 months. A crowd-sourced tracker lists 350 cuts on Mar 17, 2026 with no source; no company statement or press report found.Blind layoff tracker; TechCrunch, Feb 13, 2025; news search Nov 3, 2026Open
- Likely exit pathNo IPO filing, sale process or banker hire reported. Sophos listed in London from 2015 to 2020, so a relisting has precedent, but the debt has to be settled first.TechCrunch, Mar 2020; news search Nov 3, 2026Open
Clear: checked, nothing found. Flag: found, with the source. Open: could not be checked.
No filing reported. Listed on the London Stock Exchange 2015 to 2020.
Sophos's revenue, year by year.
- Palo Alto Networks$0.52M
- CrowdStrike$0.50M
Interest on loans was $161M in FY2025, about half of adjusted EBITDA. The loans were due March 2027, which is why 2026 was spent refinancing.
What the record says, and what we think it means.
The fact is the source's. The read, in italics, is ours.
- 01Watch
A $2B+ loan wall forced a hard refinancing in 2026.
Private Equity Wire (citing Bloomberg), Sep 9, 2026Sophos sought to extend a $2.1B term loan due March 2027, offering lenders a higher coupon, more amortisation and tighter covenants, with commitments due Sep 22, per Bloomberg as reported. Goldman Sachs led.
Concessions like these usually mean higher interest costs for years, which can squeeze hiring budgets. Final terms are not public.
- 02Watch
Moody's cut the credit rating to B3.
Octus, Apr 15, 2026Downgraded from B2 in March 2026 over looming maturities and weaker than expected performance. Moody's saw leverage heading toward 9x in fiscal 2026.
B3 is deep in speculative grade. It shrinks the pool of loan buyers and raises borrowing costs.
- 03Neutral
Bought Secureworks from Dell's orbit for $859M.
Sophos release, Feb 2025; FY2025 accountsClosed Feb 3, 2025, at $8.50 a share in cash, adding the Taegis platform and the Counter Threat Unit. Funded with cash and $650M of new term loans.
It made Sophos a bigger MDR player, and also added most of the debt growth. Secureworks had shrunk headcount by about 44% from 2021 to 2024.
- 04Watch
Cut 6% of staff days after the Secureworks deal.
TechCrunch, Feb 13, 2025; BankInfoSecurityAbout 6% of the combined company in Feb 2025, after about 10% (roughly 450 people) in 2023. The number was not disclosed; one estimate put it near 380.
Two rounds in three years. Duplicate roles after a merger are a common target, but the pattern is worth asking about in interviews.
- 05Watch
Profitable before interest, loss-making after it.
Group accounts FY2025 (Companies House)FY2025 operating loss $27.7M (2024: $38.0M profit) after $70.1M of exceptional costs and $232.4M of amortisation. Finance costs $177.0M; net loss $151.5M.
The business throws off cash ($320M from operations), but debt service and deal costs eat most of it.
- 06Watch
Net renewal rate slipped below 100%.
Group accounts FY2025 (Companies House)The KPI table shows 97% for FY2025 against 105% a year earlier. The narrative in the same report says 104%.
Below 100% means existing customers, net, spent less on renewal. The two numbers in one report do not match, so treat the trend with care.
- 07Neutral
A long-time insider runs the company.
Sophos release, Feb 2024Kris Hagerman, CEO since 2012, stepped down in Feb 2024. Joe Levy, nine years at Sophos and creator of the X-Ops threat unit, took over and was later made permanent.
Continuity rather than an outside turnaround CEO, under the same owner.
- 08Good
Partnered with OpenAI to sell frontier AI through MSPs.
TechIntelPro, Aug 10, 2026Announced Aug 10, 2026: OpenAI models delivered through Sophos Fusion to managed service providers, building on OpenAI's cyber partner program.
Plays to Sophos' channel strength. Revenue impact not disclosed.
Product is paid 13% over market. Engineering, 39% under.
We save every company's roles, pay by team and level, AI share and churn every day, so each month this page can say more. Sparklines use their own scale.
Can AI agents do business with Sophos?
We checked the agent payment programs, developer docs and site rules an AI assistant would meet.
Open to AI crawlers, agentic inside. No official MCP server yet; agents reach it through its public APIs and community connectors.
Still Remote read- MixedDocs that AI tools can readsophos.com/llms.txt is a full index of products, leadership and press. docs.sophos.com/llms.txt and developer.sophos.com/llms.txt both return 404.checked Nov 3, 2026
- YesLets AI crawlers read its siterobots.txt explicitly allows GPTBot, ClaudeBot, Google-Extended, PerplexityBot, OAI-SearchBot and others. It blocks Amazonbot, PetalBot and DeepSeekBot.checked Nov 3, 2026
- Not foundAn official MCP serverNo Sophos-published MCP server found. Community servers wrap the Sophos Central APIs (for example solomonneas/sophos-mcp), none endorsed by Sophos.LobeHub listing; searched Nov 3, 2026
- YesAgents inside its own productSophos Fusion (Jul 2026) uses agentic AI with analyst-set limits; Sophos says AI fully resolves 52% of cases, averaging 89 seconds from alert to response.Sophos Fusion release, Jul 2026
- YesSells protection for customers' AI agentsAI Defense, generally available Oct 13, 2026, finds shadow AI tools and unsanctioned agents and applies real-time guardrails on prompts and uploads.Sophos release, Oct 13, 2026
Where Sophos puts AI to work.
- 1Its own SOC runs with AI agentsSophos' managed service covers over 40,000 customers, and the company says AI fully resolves about half of cases, with analysts setting the limits.Sophos Fusion release, Jul 2026
- 2An AI assistant for analysts, at no extra chargeThe Sophos AI Assistant answers plain-English queries over security data in Analyst and Threat Hunter modes, included for all XDR and MDR customers.Sophos blog
Fewer listings than on Sep 7, led by engineering.
What Sophos puts on its own channel.
Short videos from Sophos's official YouTube channel, played here. We only use a channel that links community.sophos.com and carries the company's name.
- How One Fake CAPTCHA Became a Ransomware Attack221 views
- 84 Seconds to Stop a Business Email Compromise | Sophos Threat Case103 views
- The “IT Support” Message That Turned Into an Attack | Sophos Threat Case254 views
- How to Build a Cybersecurity Program Without a CISO | Sophos CISO Advantage190 views
- Sophos Fusion x Firewall | Design | PT | 1080x1080 | 15s195 views
- Sophos Customer Story | Northern Leaders Trust233 views
- AI Has a Security Problem Nobody Planned For1.5 thousand views
- The Structure of Sophos Fusion247 views
What has to be true for $3.9 billion to hold?
The starting revenue is Sophos's own reported figure. A way to think, not a forecast, and not investment advice.
At 5x, Sophos needs $780 million of revenue to be worth $3.9 billion. Your world gets there with $1.4 billion, so the next round likely prices above the last.
$100,000 of equity valued at the $3.90B Take-private buyout price would be worth about $182,198 on paper in this world, before dilution from new rounds, taxes and vesting. Private shares only turn into cash at a sale, an IPO or a tender offer.
A way to think, not a forecast, and not investment advice.
Group accounts FY2025 (Companies House)The signals, and which way they push.
- TailwindManaged detection is the growth engine.
MDR billings grew 26.7% to $175.2M in FY2025 versus 13.5% for billings overall, and Secureworks added more scale.
- TailwindAI security is a new product line.
AI Defense went GA in Oct 2026 and an OpenAI partnership targets MSPs, both sold through the existing channel.
- HeadwindDebt costs crowd out investment.
$161M of loan interest in FY2025 against $332M adjusted EBITDA, and 2026 refinancing terms were reported to include a higher coupon.
- HeadwindGrowth has cooled.
ARR growth was 6% in the quarter to June 2026, per Bloomberg as reported, and the reported net renewal rate fell to 97%.
Where Sophos ends up, if we had to bet.
Our calls, not facts. Each one is tied to something that already happened, so you can judge the reasoning.
- 1
Sophos lists on a stock exchange again by 2031.
Long shot 16%IPOIt has listed before (London, 2015 to 2020) and is large enough at $1.2B revenue. But leverage near the levels Moody's flagged and slowing growth make a float hard to sell.
Octus; TechCrunch 2020 - 2
Thoma Bravo sells Sophos, whole or in parts, to another buyer by 2031.
Coin flip 50%M&AThe hold is past six years and the owner declined to add equity in 2026. A sale is the usual private equity exit, though the refinancing may have bought time instead.
Private Equity Wire, Aug 2026 - 3
MDR grows to a quarter of Sophos billings by 2031.
Coin flip 50%ProductsMDR was 14% of billings in FY2025, growing about twice as fast as the whole. If both rates held, it would reach roughly a quarter in five years (our arithmetic).
Group accounts FY2025 (Companies House) - 4
Most Sophos MDR cases are closed by AI with no analyst touching them.
Likely 72%AISophos already says 52% are fully resolved by AI. Its Fusion design is built around agents working inside analyst-set limits.
Sophos Fusion release, Jul 2026 - 5
Sophos stays a mid-market and MSP specialist rather than winning big enterprise accounts.
Likely 72%CompetitionIts base is 587,000 mostly smaller customers sold through 25,000 partners. CrowdStrike and Palo Alto dominate large enterprise, and Sophos' R&D spend is capped by its debt.
Group accounts FY2025 (Companies House)
Read by the Still Remote research agent on November 3, 2026 from the sources linked on this page. Facts and scenarios only, not investment advice.