Escalating a support case: What to expect

Introduction

Sophos Support provides an escalation process for cases that require management attention or where the standard support process is not progressing as expected.

Escalation is used when a case requires additional attention due to high business impact or when expected service levels are not met. It is not intended as a way to speed up standard requests, as all cases are handled according to defined response times and severity levels.

A support escalation is appropriate when:

• Your case's first-response SLA commitment has not been met or has been breached according to your Support Plan. For more information, see Sophos Support Service level targets.
• Operations are halted or the issue is critical to your business.
• The urgency or business impact has increased since the case was first raised.
• The support process is not progressing as expected and requires management attention.

For guidance on how to determine the severity of your case, see Sophos Support: Case severity levels.

For critical or time-sensitive issues, we recommend contacting Sophos Support directly in addition to raising an escalation. If you have a named Customer Success Manager (CSM), Account Executive, Technical Account Manager (TAM), or Services Consultant, they can also escalate the case on your behalf.

How to escalate a case

What happens next

Once submitted, your case is immediately flagged as escalated and the escalation process begins.

You can escalate a support case using one of the following options:

Support Portal (recommended)

The fastest and preferred way to escalate a case is through the Support Portal. To escalate your case:

1. Sign in to the Sophos Support Portal.
2. Go to Cases.
3. Open the case you want to escalate.
4. Click Request Escalation.
5. Select your region.
6. Enter the reason for the escalation, including business impact.
7. Click Escalate.

Your case will be immediately flagged as escalated and visible to the Support Management team.

Email

You can also escalate a case by sending an email to: supportescalations@sophos.com

1. When using email, make sure to include:

   • Case number
   • Clear statement that this is an escalation request.
   • Reason for escalation and business impact.

Phone (for critical situations)

For critical issues, we recommend calling Sophos Support directly in addition to raising an escalation.

How your escalation flows

Once raised, your escalation follows these six stages:

flowchart LR

  A["<p style="color: white;"><b>Initiation</b></p>"]
  B["<p style="color: white;"><b>Acknowledgement</b></p>"]
  C["<p style="color: white;"><b>Action Plan</b></p>"]
  D["<p style="color: white;"><b>Investigate &amp;<br> Follow-ups</b></p>"]
  E["<p style="color: white;"><b>De-escalate</b></p>"]
  F["<p style="color: white;"><b>Case Closure</b></p>"]

  A --> B
  B --> C
  C --> D
  D --> E
  E --> F

  style A fill:#17192B,stroke:#17192B,stroke-width:0px
  style B fill:#233F6F,stroke:#233F6F,stroke-width:0px
  style C fill:#0878C9,stroke:#0878C9,stroke-width:0px
  style D fill:#1E66B4,stroke:#1E66B4,stroke-width:0px
  style E fill:#2E7D32,stroke:#2E7D32,stroke-width:0px
  style F fill:#414141,stroke:#414141,stroke-width:0px

Step-by-step breakdown

1. Initiation: Your submitted escalation alerts the Sophos support management team, who begin review within 30 minutes of receipt.

2. Acknowledgement: A support manager reviews the escalation within 30 minutes to confirm severity, business impact and the reason for escalation, confirming it is appropriate for management intervention. The escalation is acknowledged, expectations are set, and if a CSM is assigned to your account, they are informed.

3. Action Plan: Within 30–60 minutes of acknowledgement, the support manager creates and shares a documented action plan covering: current understanding of the issue, next technical steps, identified risks or blockers, named owner(s), and the committed update cadence.

4. Investigate & Follow-ups: The assigned support engineer conducts a case review, collects required information (logs, probing questions, and so on.), schedules a remote session if needed, and engages support product experts or the development team as required. You will receive updates every 24 hours, or at the cadence committed in the action plan.

5. De-escalate: Once the issue is resolved or a confirmed workaround or mitigation is in place, the case moves to de-escalation. Resolution is verified with you before the status is changed.

6. Case Closure: The case owner reviews the full case history to capture lessons learned and formally closes the case.

Escalation response targets

The following targets apply to all escalations handled by Sophos Global Support Delivery:

Roles & responsibilities

What you can expect from us

• A named owner on your escalated case from acknowledgement through closure.
• A written initial action plan shared within 30–60 minutes of acknowledgement.
• Proactive updates every 24 hours or as agreed; you will not need to chase us for status.
• Transparent communication about what we know, what we're doing, and what blockers exist.
• Escalation to the Development team or specialist teams when technically required.
• Formal confirmation from you before the case is de-escalated or closed.
• Escalation increases visibility and coordination, but resolution timelines depend on the technical complexity of the issue.

What we need from you

• A support case must be open before an escalation can be processed.
• A clear description of the issue and business impact; what is affected, how many users, and for how long.
• Steps already taken and results observed (this prevents duplication of effort).
• Your direct contact details and the contact details of involved parties.
• Availability for a remote session if needed and your working hours.
• Log files, screenshots, or diagnostic data where available (our engineer will guide you on what to collect if unsure).
• Advance notice of any maintenance windows or change freezes that may affect troubleshooting.
• Your prompt responses and cooperation, as timely engagement helps us move toward resolution and de-escalation more effectively.