Sophos scales CS for 600K customers: threats move in 3 hours

Teresa Anania, former SVP Customer Experience at Sophos (now CCO at Verint), breaks down how the cybersecurity firm manages customer success across 600,000 accounts when cyber threats evolve in hours, not days. The reality: by the time a support ticket lands, you have already lost the customer.

Sophos scales CS for 600K customers: threats move in 3 hours

The Scale Problem

Sophos protects 600,000 organisations globally. Their MDR service alone covers 26,000 customers, up 37% in 2024. That is enterprise-scale customer success with a twist: the threat landscape moves faster than your renewal calendar.

Teresa Anania, who built the CS operation at Sophos before moving to Verint as CCO, says attackers now move in 3 to 4 hours. If your CS team waits for a ticket, the customer is already compromised. That changes everything about how you structure coverage, assign CSMs, and measure success.

What Actually Works at Scale

Dynamic segmentation over ACV hard lines. Sophos does not assign CSMs based purely on contract size. They use a two-by-two: risk level and growth potential. A $50K account with high expansion potential gets different treatment than a $200K account that is stable but low-growth.

Attribution models that connect CS to revenue. Anania built frameworks that tie CS touchpoints directly to retention and expansion. Not vanity metrics. Actual pipeline impact. The playbook: start at the end of the renewal cycle, automate the low-risk renewals, free up CSMs for expansion motions.

Proactive beats reactive. In cybersecurity, waiting for the customer to notice the problem means you have already failed. Sophos structures CS to respond before the alert even reaches the customer. That is not support. That is ops.

The GTM Shift

Anania's view: self-serve will run end-to-end, from first touch through win-back. CS in 2026 is not relationship management. It is digital journey design, powered by AI, with human intervention only where it moves the number.

For early-stage teams without perfect data: crawl, walk, run. Start with basic renewal automation. Layer in health scoring. Build attribution models as you scale. Do not wait for perfect systems to start operationalising CS.

What It Means for ANZ Sales

Sophos has ANZ presence, though specific headcount is not public. The broader point: if you are selling into enterprise, your CS motion needs to scale before your quota does. High-growth accounts need different coverage than stable renewals. Segment dynamically or watch churn eat your expansion pipeline.

The hire Anania looks for: "humble confidence." People who have carried quota, know what they do not know, and can build systems that scale past their own capacity. That profile fits CS, sales ops, and rev ops alike.