Description
Sophos MDR Plus - Server - 2 year subscription (1-9 servers)
Sophos MDR Plus is a 24/7 managed detection and response service: Sophos analysts monitor your servers, hunt for threats and contain active attacks. MDR Plus adds full incident response by Sophos and the Breach Protection Warranty. This listing covers 1-9 servers for 2 years, Sophos part number MDRCSS24BANCAA.
- Part numberMDRCSS24BANCAA
- Licensed perServer, 1-9 in this band
- Term2 years
- Coverage24/7 Sophos analysts
- CleanupSophos, end to end
Who it is for
Need the cleanup done for you
If a serious incident hit at 2am on a Sunday and nobody on your side could run the cleanup, MDR Plus has Sophos do it end to end.
Insurer or client asks about monitoring
Cyber insurance and client questionnaires commonly ask who watches your systems around the clock. MDR gives you a named answer.
Already invested in other tools
More than 350 integrations let Sophos use telemetry from security products you already run.
What is included
- Everything in Sophos MDR: 24/7 monitoring, threat hunting, active containment and the three response modes.
- Full incident response by Sophos, end to end, with no hourly caps.
- A dedicated incident response lead during an incident.
- Contractual response target: 60 minutes for 90 percent of high-severity cases.
- Sophos Breach Protection Warranty, covering up to $1M in response expenses.
- More than 350 third-party integrations, so it can use telemetry from tools you already run.
Sophos MDR or MDR Plus?
Both tiers include 24/7 monitoring, threat hunting and active containment. The single decision is who finishes the response.
| Capability | Sophos MDR | Sophos MDR Plus |
|---|---|---|
| 24/7 monitoring and threat hunting | Yes | Yes |
| Active threat containment | Yes | Yes |
| Who completes the cleanup | You, with guided steps | Sophos, end to end |
| Full incident response | Separate engagement | Included, no hourly caps |
| Dedicated incident response lead | No | Yes |
| Contractual response target | No | 60 min for 90% of high-severity cases |
| Breach Protection Warranty | Not included | Up to $1M in response expenses |
The practical test: if a serious incident happened at 2am on a Sunday, is there someone on your side who can run the cleanup? If the honest answer is no, MDR Plus is the tier that does it for you.
Upgrade path
- Sophos XDR for Server. Tools for your own team to investigate and respond.
- Sophos MDR. 24/7 monitoring and containment; you finish the cleanup.
- Sophos MDR Plus (this listing). Adds full incident response, a dedicated lead and the Breach Protection Warranty.
Add-ons to consider: Sophos ITDR for identity attacks on Entra ID and Active Directory, Sophos NDR for devices that cannot run an agent, Sophos Managed Risk for internet-facing vulnerabilities, Sophos Next-Gen SIEM for long-term log retention, and Fusion Data Storage for a year of investigation data.
All bands and terms
| Servers | 1 year | 2 years | 3 years |
|---|---|---|---|
| 1-9 servers | View | This listing | View |
| 10-24 servers | View | Quote | Quote |
| 25-49 servers | View | Quote | Quote |
| 50-99 servers | View | Quote | Quote |
| 100 or more servers | Ask Nuformat for a quote, priced to your exact count | ||
Frequently asked questions
What is the difference between Sophos MDR and Sophos MDR Plus?
Both include 24/7 monitoring, threat hunting and active containment. MDR Plus adds full incident response by Sophos with no hourly caps, a dedicated incident response lead, a contractual 60-minute response target for 90 percent of high-severity cases, and the Breach Protection Warranty. With Sophos MDR, Sophos contains the threat and you finish the cleanup with guided steps.
Does Sophos MDR replace my existing endpoint protection?
It needs Sophos XDR or the Sophos XDR Sensor on the devices you want managed, but it does not force you to remove other tools. Sophos MDR supports more than 350 third-party integrations.
How quickly does Sophos respond to an incident?
MDR Plus carries a contractual 60-minute response target for 90 percent of high-severity cases. Standard Sophos MDR has no contractual target. You set the response mode, so you decide whether Sophos acts straight away or notifies you first.
What does this listing cover?
1-9 servers for 2 years, Sophos part MDRCSS24BANCAA. Staff computers need Sophos MDR Plus user licenses, sold separately.
Can I pay monthly instead of for a full term?
Yes. Nuformat can bill Sophos MDR Plus for Server monthly as your managed service provider. Monthly rates can change, so a term subscription is the way to fix your price.
Get Sophos MDR Plus for Server quoted by Nuformat
Nuformat is a Sophos partner serving Canada and the United States. Send us your user and server counts and we will confirm the right tier and band.
Request a quoteService details as published in Sophos MDR product documentation and Sophos tech specs, checked October 11, 2026. Pricing and availability confirmed by Nuformat at quotation. All Sophos MDR Plus for Server options