Reduce Ransomware Risk with Sophos MDR Plus
Posted by Saif Khan on 2023 Nov 1st
Ransomware rarely arrives as ransomware. It arrives as a stolen password, a phishing click, or an unpatched service facing the internet. By the time files start encrypting, the attacker has usually been inside for days.
That gap is the problem managed detection and response exists to close. Not better antivirus, but someone watching at 2am on a Sunday when the encryption starts.
Why prevention alone stops being enough
Endpoint protection blocks known threats well. The attacks that get through are the ones that do not look like attacks:
- Valid credentials. An attacker signing in with a stolen password is doing nothing technically suspicious.
- Living off the land. Using PowerShell, RDP and admin tools already on the machine, rather than malware a scanner would flag.
- Patience. Moving slowly, escalating privileges, finding the backups first.
None of that trips a prevention tool. It shows up as a pattern across time, which is what a human analyzt looking at correlated telemetry is for.
What Sophos MDR actually does
Sophos analyzts monitor your environment 24/7, hunt for threats, and contain active attacks. Where the tiers differ is who finishes the job.
| Capability | Sophos MDR | Sophos MDR Plus |
|---|---|---|
| 24/7 monitoring and threat hunting | Yes | Yes |
| Active threat containment | Yes | Yes |
| Who completes the cleanup | You, with guided steps | Sophos, end to end |
| Full incident response | Separate engagement | Included, no hourly caps |
| Dedicated incident response lead | No | Yes |
| Contractual response SLA | No | 60 min for 90% of high-severity cases |
| Breach Protection Warranty | Not included | Up to $1M in response expenses |
The test that decides the tier. If ransomware started encrypting at 2am on a Sunday, is there someone on your side who could run the cleanup? If the honest answer is no, MDR Plus is the tier that does it for you.
What it costs
Priced per user per year. Live pricing from our store, in USD, on a one-year subscription.
| Users | Sophos MDR | Sophos MDR Plus |
|---|---|---|
| 1 to 9 | $143.50 | $234.52 |
| 10 to 24 | $138.58 | $221.40 |
| 25 to 49 | $127.10 | $207.46 |
| 50 to 99 | $123.00 | $199.26 |
| 100 to 199 | $114.80 | $190.24 |
A 40-person business is $5,084 a year on Sophos MDR, about $424 a month. On MDR Plus it is $8,298, about $692 a month. Monthly billing is available through Nuformat as your MSP if you prefer not to commit to a term.
Almost no MDR provider publishes prices. We do, because the number is easier to judge in context than in a sales call.
The comparison that makes the number make sense
MDR is not competing with doing nothing. It is competing with building the same capability in-house.
Round-the-clock coverage needs more than one person. A single analyzt cannot cover nights, weekends and holidays. Even a minimal rotation is several salaries plus tooling, before anyone has looked at an alert. For a business under 200 people, MDR at $115 to $235 per user per year is not an alternative to a security team. It is an alternative to having no coverage outside office hours.
What you need to run it
- Sophos XDR or the Sophos XDR Sensor on managed endpoints. Covers Windows and macOS workstations, and Windows and Linux servers.
- A license count matching your users. Servers are licensed separately.
- Onboarding, which includes a health check of your environment.
Sophos MDR supports more than 350 third-party integrations, so it can take telemetry from tools you already run rather than requiring replacement.
Frequently asked questions
How does MDR reduce ransomware risk?
Ransomware attacks usually involve days of reconnaissance before encryption starts. MDR analyzts watch for that activity around the clock and contain it before the encryption stage. Prevention tools block known threats, but attackers using stolen credentials and legitimate admin tools do not look like threats until it is too late.
How much does Sophos MDR cost?
Sophos MDR is priced per user per year, from $143.50 per user for 1 to 9 users down to $114.80 for 100 to 199 users. Sophos MDR Plus, which includes full incident response, ranges from $234.52 down to $190.24. A 40-person business pays about $5,084 a year for Sophos MDR.
What is the difference between Sophos MDR and MDR Plus?
Both include 24/7 monitoring, threat hunting and active containment. MDR Plus adds full incident response carried out by Sophos with no hourly caps, a dedicated response lead, and a contractual 60-minute response target for 90 percent of high-severity cases. With standard MDR, Sophos contains the threat and you finish the cleanup using guided steps.
Can I pay monthly instead of a term?
Yes, through Nuformat as your managed service provider rather than as a multi-year purchase. Monthly rates are set by Sophos and can change, so only a term subscription fixes your price for the period.
Does MDR replace my endpoint protection?
No. It needs Sophos XDR or the XDR Sensor on managed endpoints, and it works alongside tools you already run. Sophos MDR supports more than 350 third-party integrations.
Will MDR stop every ransomware attack?
No service can promise that, and you should be wary of any that does. What MDR changes is the window: attacks are detected and contained during the reconnaissance phase rather than discovered when files are already encrypted. MDR Plus also carries the Sophos Breach Protection Warranty, which covers response expenses if an incident does occur.
Get MDR priced for your business
Nuformat is a Sophos partner serving Canada and the United States. Send us your user and server counts and we will price both tiers, compare term against monthly billing, and tell you which tier we would actually recommend. Request a quote.
Sophos MDR products and pricing · Sophos XDR
Prices in USD, current at the time of writing and subject to change. Service details as published in Sophos product documentation.