How Sophos Modernizes Security Data at Scale with Cribl and AWS

Learn how a major cybersecurity company transformed its security data operations to handle terabytes of daily telemetry while reducing costs and accelerating migrations. This conference presentation from AWS re:Invent 2025 features Chris O'Brien, VP of Security Operations at Sophos, detailing the company's journey to modernize their security data infrastructure using Cribl and AWS services. Discover practical strategies for filtering data at the source to cut operational costs, normalizing and routing heterogeneous log data from diverse security tools, and dramatically reducing SIEM migration timelines from months to just weeks. Explore how the team centralized their logging architecture, migrated away from legacy infrastructure to gain operational flexibility, and simplified compliance processes while future-proofing their security operations. Gain insights into tackling exponential telemetry data growth challenges, meeting stringent compliance requirements, and building scalable security data operations that can adapt to evolving cybersecurity needs.