Sophos is introducing Self-Healing Alerts in Sophos Central, a new capability designed to cut down alert fatigue and help managed service providers (MSPs) operate more efficiently. The feature automatically correlates related events into a single alert and closes it once the issue resolves — eliminating the repetitive, short‑lived alerts that often inflate ticket queues and drain operational capacity.
Operating efficiently in 2026 means removing day‑to‑day friction across the environments MSPs manage. With MSP revenue growth expected to reach only 10%* in a best‑case scenario, partners are doubling down on automation and operational maturity to protect margins and maintain service quality.
At the same time, MSPs are carrying increasing operational load. According to Sophos’ MSP Perspectives 2024 survey, keeping up with cybersecurity technologies is the top daily challenge (39%) and the shortage of in‑house security skills remains the single biggest risk for MSPs and their customers. Many partners are also consolidating their vendor stack down to between one and five security vendors at most to simplify operations and reduce overhead.
Sophos developed Self‑Healing Alerts with all this in mind, focusing on eliminating unnecessary tickets and making it easier for MSPs to maintain high-quality service without stretching already‑thin resources.
What’s new: Fewer, smarter alerts
Before Self‑Healing Alerts, several event types often generate high volumes of noise, including:
- Firewall connection lost/restored.
- VPN tunnel down/up.
- Gateway down/up.
- High‑volume Firewall ATP events.
- Endpoint update failures.
The new alerting experience reduces that noise with improvements such as:
- An inline alert flyout with full event correlation.
- Clear resolution state (system‑resolved vs. user‑closed).
- Smart timing thresholds to prevent “flapping” alert storms.
How much noise this removes
Alert fatigue is one of the most persistent operational drains for MSPs, and even small reductions can have a big impact on efficiency. Self-Healing Alerts intelligently correlate events and auto-resolve issues that recover on their own, reducing the volume of alerts technicians need to review.
- Over 70% of alert volume in Sophos Central can now rolls up into a single, correlated alert.
This eliminates large portions of repetitive up/down notifications and presents a single, contextual alert technicians can act on. - 51% of alerts in Sophos Central can now automatically close themselves.
These alerts correspond to events where the system detects recovery, significantly reducing the overall number of alerts and helping avoid unnecessary ticket creation.
What this looks like in practice
Self-Healing Alerts will change how your team works every day. Common scenarios that used to create alert storms are now condensed into a single, meaningful notification with full context.
Here’s how the experience improves in real-world MSP environments:
Before: A firewall losing and regaining connectivity could generate multiple “down” and “up” alerts, often resulting in duplicate tickets and post‑recovery noise.
After: A single correlated alert captures the full sequence and typically auto‑closes after recovery, with complete detail visible in the flyout for reporting, triage, and QBR conversations.
How self‑healing alerts help MSPs operate more efficiently
- Reduce alert volume at the source.
Noise is removed inside the platform before it reaches PSA/RMM tools — reducing unnecessary tickets and daily triage.
- Preserve scarce analyst time.
Talent shortages always rank high for MSP risk. Fewer alerts mean teams can spend more time on investigations, remediation, and proactive customer outcomes.
- Make consolidation deliver real gains.
As MSPs consolidate to fewer vendors, Self‑Healing Alerts ensure the environment actually feels simpler, quieter, and easier to manage.
- Strengthen reporting and customer confidence.
System‑resolved vs. user‑closed clarity, plus full event history, support stronger QBRs and demonstrate the type of operational maturity customers — and insurers — expect in 2026.
Availability
Self‑Healing Alerts begin later this month in Sophos Central. No additional cost or configuration is required. Partners will immediately benefit from fewer duplicate alerts, clearer context, and dramatically reduced noise from transient events.
*Source: OMDIA MSP Trends and Predictions 2026 Executive Summary
