Description
Sophos ITDR, 10 to 24 users and servers, 1 year
Sophos Identity Threat Detection and Response watches the identity layer for account takeover, privilege abuse and credential misuse. This listing covers 10 to 24 users and servers for one year at $54.12 per unit.
Stolen credentials do not look like an intrusion. An attacker signing in with a valid password is doing nothing technically suspicious on the device. Endpoint and network tools see a normal login. Identity is the layer where that behaviour is actually visible.
What it watches
| Signal | What it catches |
|---|---|
| Anomalous sign-ins | Unfamiliar device or location, impossible travel |
| Privilege escalation | Accounts gaining rights they should not have |
| Credential theft | Passwords and tokens harvested from endpoints |
| Suspicious authentication | Patterns that do not match how that account normally behaves |
| Dormant account activity | Accounts that should be inactive suddenly being used |
Managed from Sophos Fusion alongside your firewall, endpoint and other Sophos protection, so identity alerts appear in the same place as everything else rather than in a separate console.
Why MFA is not the whole answer
Multi-factor authentication protects the sign-in event. It does not stop token theft, session hijacking, or misuse by an account that has already authenticated legitimately. ITDR covers what happens after the login succeeds, which is where an attacker actually does their work.
Pricing across bands
Per unit, per year, covering both users and servers. Price falls as the count rises.
| Users and servers | Price each |
|---|---|
| 1 to 9 | $54.12 |
| 10 to 24 ← this listing | $54.12 |
| 25 to 49 | $49.20 |
| 50 to 99 | $41.00 |
| 100 to 199 | $37.72 |
If your count sits near a band boundary, tell us the exact numbers and we will confirm which listing is correct before you order.
Frequently asked questions
What is Sophos ITDR?
Identity Threat Detection and Response monitors the identity layer for account takeover, privilege abuse, credential theft and suspicious authentication. It catches attacks that arrive with valid credentials, which endpoint and network tools see as normal activity.
Does MFA make ITDR unnecessary?
No. MFA raises the bar at sign-in but does not prevent token theft, session hijacking, or abuse by an account that has already authenticated. ITDR covers behaviour after authentication succeeds.
How is Sophos ITDR licensed?
Per user and per server for the term shown. This listing covers 10 to 24 users and servers for one year at $54.12 each. Price per unit falls as the count rises.
How does ITDR fit with MDR?
ITDR generates the identity signals. MDR is the service where Sophos analysts watch and act on them 24/7. If nobody in-house is monitoring alerts outside office hours, the signals go unread. Many businesses buy both.
Can I pay monthly instead of a term?
Yes, through Nuformat as your MSP rather than as an upfront term purchase. Monthly rates are set by Sophos and can change, so only a term subscription fixes your price for the period.
Get ITDR quoted by Nuformat
Nuformat is a Sophos partner serving Canada and the United States. Tell us your user and server counts and your directory setup, and we will confirm the band and price it against the monthly option.
Request a quoteAll Sophos ITDR options · About ITDR · Sophos MDR
Service details as published in Sophos product documentation. Prices in USD, current at the time of writing and subject to change.