I wondered that but they are exactly the same.
The only difference seems to be KC was updated 15 minutes behind our clients (currently it is anyway)
But nearly 24 hours passed between Sophos first detecting it and KC Sophos not spotting it and passing it through, which is quite poor.