
Fire the marketing agency
The only acceptable response is for Sophos to fire the marketing agency.
Businesses only care about the bottom line. Sophos should publicly make an example of them, in the hope that other "legitimate" marketing agencies will get the message.