Welcome to the Cryptomator Communit
the reason might be, that Sophos tries to access the vault with admin rights. See