-p-1600.avif)
.avif)
Rethinking Channel Partnerships in the Age of XDR and AI
Interview with Edward DeWolfe | Sophos | 15+ years in cybersecurity channel and go-to-market at Invincea, Fidelis Cybersecurity, Secureworks and Sophos
Published: September 29, 2025 · Updated to correct company and product names, add the Sophos and Secureworks timeline and disclose the expert's affiliations.
Disclosure: At the time of the interview, Edward DeWolfe worked at Sophos, which owns the Taegis XDR platform discussed in this article. He previously worked at Secureworks, Fidelis Cybersecurity and Invincea. Views are his own.
Large enterprises and government agencies often run 60 or 70 security tools and know none of them well. Edward DeWolfe has spent more than 15 years building partner ecosystems in cybersecurity, from Invincea, the endpoint security company Sophos acquired in 2017, to Fidelis, Secureworks and Sophos. He argues that extended detection and response (XDR) is forcing the channel to sell outcomes instead of integration work.
Sixty Tools, No Visibility
For years, security teams plugged every gap with a new product. The result was a cluttered stack. "I've talked to multiple large enterprises and government agencies that said, 'We have 60 or 70 security tools. Because of that, we don't know any of them really well.' They're not all integrated. Some are not even used at all."
That fragmentation creates blind spots and makes detection slow and reactive. XDR addresses it by acting as an orchestration layer that consolidates data and automates workflows. "That's the reason XDR has become prominent," DeWolfe says. "At Sophos, our Taegis XDR platform allows MSSPs and enterprises to manage fewer tools while responding more effectively to threats." Taegis was developed by Secureworks, which Sophos acquired in a deal announced in October 2024 and completed on February 3, 2025, for about $859 million.
The gain is not only fewer tools. It is better signal, faster correlation and teams that can act with confidence.
Services Are Replacing Integration Revenue
Resellers used to make money integrating complex toolsets. XDR does much of that natively. "With XDR, there's not as much integration work that resellers or system integrators need to do. So, there's probably a bit of diminished returns."
Partners are responding by building managed services on top of the platform. "They've seen the writing on the wall. Many are now prepared to offer security services on top of XDR to maintain their revenue streams." Threat hunting, identity protection and remediation create more predictable, long-term revenue and keep partners close to the customer after the sale.
From Reseller to Security Partner
"You see a lot of national resellers moving into the system integrator space. They're offering a wider array of services to support customers." The shift is from procurement support to operations: monitoring threats, tuning systems and advising on architecture. "Supporting the products they sell versus just moving on to the next product, that's the big evolution."
Training Has Become Self-Serve
The skill set is changing, but training still decides whether a partnership works. "The critical part of a partnership is understanding the product and how to deliver a specific service on it. That has always been the case." What has changed is the format. "There's more self-help, self-paced online training and certifications. That makes it quicker and easier for partners to get multiple people trained at their own pace." That matters most in fast-growing markets, where travel and cost used to slow enablement.
Global Reach Still Runs Through Local Teams
"In many global markets, like LATAM and the DACH region, companies are more likely to engage with a local team versus someone on Zoom from the U.S." Local teams understand regulation, procurement cycles and risk appetite. "Expanding your channel means finding distributors and resellers that are willing to invest time in understanding your product and helping you scale."
Partner Today, Competitor Tomorrow
Working with MSSPs means vendors and partners can sit on both sides of a deal. "When you build a go-to-market plan with an MSSP who may also be competing with you, it can be challenging." DeWolfe's answer is explicit rules on roles, opportunity segmentation and accountability. "You need a very specific go-to-market plan and understanding of how companies will work together, especially when competing in the same market."
AI Is Table Stakes, Depth Is the Difference
"Everyone has access to the same tools. The question is: who has integrated AI with the most automation and highest efficacy?" DeWolfe argues that platforms built around AI from the start behave differently from those that added it later. "Some vendors tacked on AI later. Others, like Taegis, built their XDR platform around AI from day one. That makes a difference." Taegis was built at Secureworks before the Sophos acquisition, and this is the expert's assessment of a platform sold by his employer, not an independent evaluation.
In his view, AI's value lies in filtering noise and surfacing the right alert at the right time. "You couldn't survive as an XDR platform without very good AI functionality."
DeWolfe's Lessons for Channel Leaders
- Put outcomes first: in his view, the conversation should be about the problem solved and the risk reduced, not the product.
- Design for integration: platforms that work well with others stay relevant.
- Build around AI, not on top of it: he sees deep integration as the real differentiator.
Edward DeWolfe is a cybersecurity channel and go-to-market leader with more than 15 years of experience building global partner ecosystems for startups and large enterprises. He has held roles at Invincea, Fidelis Cybersecurity, Secureworks and Sophos.
Sources
- Sophos completes Secureworks acquisition, press release filed with the SEC (February 3, 2025)
- Sophos partner news on the acquisition
- Sophos acquisition of Invincea (2017)
Related on the Community Hub
