That's not up to Sophos to know though. Companies are required to comply with the regulations, at the penalty of incredibly stiff penalties. And the cost of p

That's not up to Sophos to know though. Companies are required to comply with the regulations, at the penalty of incredibly stiff penalties. And the cost of paying manual attention to every match would be debilitating. It is much more advantageous for them to automate it and be safe rather than sorry. Their policy of asking for more information on an initial positive match is reasonable. If you want to blame anyone, blame the U.S. agencies who implemented these restrictions. Sophos is just obeying the law.