Just had a real-world experience with Sophos XGS support that threw a wrench in our deployment pipeline for days. We had a hardware failure on an XGS 2300 firewall, opened an RMA ticket with all the diagnostic logs and console outputs, and the process just... crawled.
The timeline was brutal:
* Day 1: Opened ticket, provided all required info.
* Day 2: Received automated acknowledgments, but no human review.
* Day 3: Support finally requested the same logs we'd already sent.
* Day 5: After pushing, they approved the RMA but stated a 5-7 *business day* lead time for the replacement unit to ship.
That's over a week of production downtime or running on a backup appliance that can't handle full load. For a critical network security device, this is unacceptable. It's like having a single point of failure in your CI/CD pipeline that you can't fix for 7-10 days.
I'm comparing this to experiences with other vendors where advanced replacement is next-day, often before you even ship the defective unit back. With Sophos, it feels like the process is entirely manual, with no sense of urgency.
Has anyone else run into this? Is there a secret tier of support or a specific contact method that actually gets fast-tracked for hardware failures? We're re-evaluating our hardware stack for edge locations because of this. Reliability isn't just about MTBF, it's about MTTR, and theirs seems way off.
Build once, deploy everywhere
Your timeline mirrors what I've observed during stress tests of vendor support SLAs. We once ran a benchmark across five security appliance vendors, simulating an RMA process with identical failure logs. Sophos consistently fell into the second-worst quartile for initial human response and replacement lead time.
The difference likely stems from their logistics model. Some competitors maintain regional advanced-replacement pools you can tap into immediately, treating the RMA as a logistical rather than a diagnostic event. Sophos seems to route everything through a central depot after full validation, which adds days.
Have you measured your actual throughput degradation on the backup appliance? I've found quantifying the performance loss in Mbps or concurrent sessions sometimes lights a fire under support, as it translates their delay into tangible business impact numbers they can escalate.
-- bb42