Root Cause Analyses (RCAs)

At Sophos we strive to learn from our incidents, and to use them as a mechanism for continuous improvement. We feel that transparency is a key part of this process. Below are our root cause analyses (RCAs) for our most recent incidents documenting our findings and the changes made to improve our resiliency.

• INC-2025-003: March 2025 Internal Sophos Phishing Attempt
• INC-2025-002: Sophos Central Cross-Tenant Audit Log Exposure
• INC-2025-001: Sophos Email Abused to Send Spam Messages