Skip to content
Avanet

Sophos Managed Risk

Sophos Managed Risk is a distinct vulnerability management service for the external and internal attack surface. These guides cover prerequisites and onboarding, scans, Critical Assets, reports, cases, troubleshooting, and controlled offboarding.

Table of contents

Plan and onboard 1 Scan and prioritize 3 Review and remediate 2 Troubleshoot and offboard safely 2

Sophos Managed Risk across the operational lifecycle

First clarify licensing prerequisites, responsibilities, and Authorized Contacts, then configure the external scan scope. Next deploy the internal Scanning Appliance and credentials where required, prioritize Critical Assets, and work with reports and Managed Risk Cases. Troubleshooting and offboarding follow deliberately bounded, documented paths.

Plan and onboard 1

Check the MDR or MDR Plus prerequisite, administrator access, and Authorized Contacts. Then configure owned external domains, IP addresses or CIDR ranges, scanner allowlisting, and the weekly schedule in a controlled manner.

Scan and prioritize 3

Deploy the virtual Managed Risk Scanning Appliance for internal discovery and vulnerability scans, assign authenticated scan credentials securely, and prioritize up to 25 previously discovered Critical Assets with business context.

Review and remediate 2

Evaluate reports under My Products > Managed Risk > Report History, route safe remediation to the responsible system owners, and use Managed Risk Cases or service requests under Threat Analysis Center > Cases for the appropriate purpose.

Troubleshoot and offboard safely 2

Isolate faults by external scan, scope, appliance, network path, or credential and escalate them to the correct team. During offboarding, preserve evidence and do not infer undocumented deletion or cancellation steps.

Prerequisite and clear product boundaries

Sophos Managed Risk can only be subscribed to with an existing Sophos MDR or Sophos MDR Plus license. That prerequisite does not make the services the same: Managed Risk assesses the agreed attack surface for vulnerabilities, prioritizes risks, and recommends remediation. Changes to affected systems remain controlled tasks for the organization’s system owners.

Adjacent products have different responsibilities:

  • MDR provides active-threat detection, investigation, and response within the agreed service scope. The MDR prerequisite does not mean every Managed Risk finding is an MDR incident or is remediated automatically.
  • XDR supports self-managed Detections, investigations, and XDR Cases. Managed Risk scan results do not become XDR Detections; only the shared Threat Analysis Center > Cases area requires careful distinction by Case type.
  • Sophos ITDR assesses identity risks, directory information, and ITDR Findings. It replaces neither vulnerability scans nor Managed Risk reports.
  • Sophos NDR analyzes mirrored network traffic with NDR sensors. The Managed Risk Scanning Appliance requires neither SPAN/ERSPAN nor the NDR Investigation Console.
  • General Sophos Fusion (formerly Sophos Central) functions, such as scheduled Central reports, roles, license management, and device retirement, remain separate administrative workflows. Managed Risk does not replace them.
  • Web application and API security testing is outside the scope of Managed Risk scans. A network vulnerability scan is not a substitute for it.

This hub therefore provides orientation only for the Managed Risk lifecycle. Exact UI procedures, safe checks, and stop boundaries remain in the relevant guide so that procedures are not duplicated inconsistently.