Call us Today 1-833-283-7373 or Contact us

Sophos MDR · Sophos Silver Partner

Sophos MDR: threats caught and contained, 24/7.

Sophos MDR is a managed detection and response service. A Sophos team watches your endpoints, servers, firewall, cloud, email, and identity around the clock, hunts for attackers, and stops attacks for you. Two tiers, Sophos MDR and Sophos MDR Plus, licensed per user and per server.

In plain terms: MDR means a security team watches your systems day and night and steps in to stop attacks, so you get a full security operation without hiring one.

Buy now ↓ Get a quote

What Sophos MDR includes

Capability	What it does
24/7/365 monitoring	Sophos analysts watch your environment every hour of every day. A threat at 3 a.m. is handled at 3 a.m., not when someone logs in the next morning.
Threat hunting	Threat hunters look for attackers who slip past automated tools, so quiet, hands-on-keyboard activity is found before it turns into a breach.
Threat response	Sophos investigates, isolates hosts, kills processes, and blocks attackers, in the response mode you choose. You get remediation guidance for every case.
Works with what you run	Coverage reaches endpoint, firewall, cloud, email, and identity. Sophos MDR also takes telemetry from third-party tools, including Microsoft Defender for Endpoint, CrowdStrike, and SentinelOne, so there is nothing to rip out.
Reporting in Sophos Fusion	Cases, actions, and reports sit in the Sophos Fusion console, in language your team and your board can read.

Sophos MDR by the numbers

40,000+

organizations protected by Sophos MDR worldwide, according to Sophos.

89 seconds

from alert to automated response, the figure Sophos publishes for its MDR service.

30 minutes

target from case creation to first action by a Sophos analyst, on both tiers.

9 SOC teams

regional Sophos security operations teams share the work around the clock.

Buy below ↓Get a quote

Sophos MDR vs Sophos MDR Plus

Both tiers share the same 24/7 monitoring, threat hunting, and threat response by the Sophos SOC. The difference is who finishes a confirmed breach, and what Sophos commits to in writing.

Capability	Sophos MDR	Sophos MDR Plus
24/7 monitoring and threat hunting	Included	Included
Threat response and remediation guidance	Included	Included
Full incident response for confirmed breaches	Separate engagement	Included, no hourly caps
Assigned incident response advisor	—	Included
Root cause analysis	—	Included
Response-time commitment	30-minute first-action target	Contractual: 60 minutes for 90% of priority investigations, with service credits
Breach protection warranty	—	Up to US$1 million a year
	Buy →	Buy →

Warranty terms per Sophos: up to US$1,000 per breached endpoint, capped at US$1 million a year, after 12 months of continuous subscription and a 60-day waiting period. It requires a healthy environment, patches applied on time, and the Authorize or Collaborate-then-Authorize response mode. If you have no in-house security team, MDR Plus is usually the right fit. Ask us to size it.

How Sophos MDR works

1. Onboarding

We license the right tier, deploy Sophos protection or connect your existing tools, and set your contacts. Sophos runs a health assessment within 30 days of onboarding. At least 80% of licensed devices must be deployed.

2. Pick a response mode

Authorize: Sophos acts first and tells you after. Collaborate: Sophos investigates but takes no action without your written OK. Notify only: Sophos investigates and gives you remediation steps to run yourself. Authorize is the fastest, and it is required for the MDR Plus warranty.

3. Detect and respond

Detections become cases in Sophos Fusion within about two minutes. An analyst takes first action within the 30-minute target, then contains and guides cleanup.

4. Report and improve

You see every case and action in Sophos Fusion. As a Sophos Silver Partner, Nuformat stays with you after the sale for renewals, changes, and questions.

Add-ons and related services

Sophos MDR for servers

Servers are licensed separately from users. See Sophos MDR Server.

Sophos AI Defense

Find shadow AI and put guardrails on AI tools, as an add-on to Sophos MDR. See Sophos AI Defense.

Sophos Next-Gen SIEM

Long-term log retention and compliance reporting on top of MDR, priced by users and servers. See Sophos Next-Gen SIEM.

Sophos XDR instead?

If your own team wants to run detection and response, Sophos XDR gives you the same tools without the managed service.

Want to see what MDR changes in practice? Read how Sophos MDR Plus reduces ransomware risk and six benefits of MDR for a business.

Sophos MDR FAQ

What is Sophos MDR?+

Sophos MDR is a managed detection and response service. A Sophos security operations team monitors your systems 24/7, hunts for threats, and responds to attacks for you, across endpoint, server, firewall, cloud, email, and identity.

What is the difference between Sophos MDR and MDR Plus?+

Both include 24/7 monitoring, threat hunting, and threat response. Sophos MDR Plus adds full incident response for confirmed breaches with no hourly caps, an assigned incident response advisor, root cause analysis, a contractual 60-minute response commitment for 90% of priority investigations, and a breach protection warranty of up to US$1 million a year.

Are MDR Essentials and MDR Complete still sold?+

Those are the old names. Sophos MDR Essentials is now Sophos MDR, and Sophos MDR Complete is now Sophos MDR Plus.

How is MDR different from EDR or XDR?+

EDR and XDR are tools your own team runs. MDR is a managed service: Sophos runs detection and response for you, so you get the result without the staffing.

Do I need to run Sophos products already?+

No. Sophos MDR uses Sophos protection where you have it and takes telemetry from third-party tools such as Microsoft Defender for Endpoint, CrowdStrike, and SentinelOne.

What are the response modes?+

Authorize lets Sophos act first and tell you after. Collaborate means no action without your written consent. Notify only means Sophos investigates and you carry out the fix. You can switch modes later.

How fast does Sophos respond?+

Sophos targets first action within 30 minutes of a case being created, on both tiers. MDR Plus adds a contractual commitment of 60 minutes for 90% of priority investigations each month, backed by service credits.

What does the breach protection warranty cover?+

On MDR Plus, Sophos covers up to US$1,000 per breached endpoint, up to US$1 million a year, including ransom payments up to US$100,000 per claim. It starts after 60 days and needs a 12-month subscription, a healthy environment, timely patching, and the Authorize or Collaborate-then-Authorize mode.

How is Sophos MDR priced?+

Per user and per server, on 1 to 3-year subscriptions, in user bands such as 1-9, 10-24, and 25-49. Pick a band below, or tell us your counts and we will quote it and reply in two to three business days.

Can Nuformat help us choose and deploy it?+

Yes. As a Sophos Silver Partner we size the tier, handle the licensing, help with onboarding, and support you after the sale, for businesses in Canada and the USA.

Buy Sophos MDR below Pick a license term and user count to add to cart, or request a quote for monthly and volume pricing.