Sophos Cuts Security Analysis from Weeks to Days with Snowflake CoCo

Reports. Dashboards. Hey, is that unlocking data for our customers? It’s not. Those all have to go through a vision that someone else has. It’s really the deep integration with Cortex and Snowflake CoWork that provides us the ability to make data available to the business where they’re at.

Sophos is a global security company that covers over 600,000 customers. We provide products like endpoint protection, 24-by-seven threat monitoring, and a global managed detection and response organization.

Within that organization, I actually support the IT piece — focused on a lot of the back office data processes. Data plays a huge role in our company. On the front side, we have to do a lot with bringing together customer data around threat signatures and incidents. And on the back end, data to support 600,000 customers is quite important.

One of the reasons the Sophos job interested me was actually working with Snowflake. We’ve really been able to leverage a lot of its more advanced capabilities — not just ‘can we load data and report on data,’ but also some of the AI capabilities within Cortex.

Snowflake is our data platform. We run both our data lake and our analytics and reporting on that platform. As we focus more on data products, that’s not going to change — it’s just going to expand the data and the relationships and the context that we make available to our business.

We’ve been moving from data models to support Power BI reporting to data products that actually support multiple consumers and formats — AI, Power BI reporting, agents as they start to proliferate through our organization. We’ve been focused on taking the models to that next level, working with our business users to define the data.

We were able to leverage Snowflake CoCo for the security analysis. Something that would have taken a week or two to figure out — we cut down to a couple of days. We had one of my principal engineers query that data through CoCo. We set up an agent to do reconciliation across a couple of systems. Instead of a whole bunch of queries and a whole bunch of checks, we were able to just debug by prompt. We worked with Cortex Agents and just asked the questions of the data.

We’ve been able to leverage Snowflake CoWork and roll it out to our senior management team. Today a lot of that work is done on dashboards — people pulling together data to help present. But with Snowflake CoWork, we’ve been able to put the data and the ability to question the data directly in the hands of our senior management team.

We’ve been able to roll out CoCo to most of our reporting teams. It’s allowing them to become more efficient in the queries they’re writing. Each part of our business — finance, marketing, sales — they each have their own reporting teams.

Outside of that, we’ve been engaging all the way at the top. I’ve been working with databases and data warehouses for years. We’ve always talked about how we can actually democratize data use. It’s not until recently where that’s actually become a thing. It’s really the deep integration with Cortex and Snowflake CoWork that allows the business to ask questions that we as IT people, we as report writers, aren’t able to envision at the time.