Description
Sophos MDR - Server - 1 year subscription (25-49 servers)
Sophos MDR is a 24/7 managed detection and response service: Sophos analysts monitor your servers, hunt for threats and contain active attacks. Sophos contains the threat and gives you guided steps to finish the cleanup. This listing covers 25-49 servers for 1 year, Sophos part number MDRS0S12BCNCAA.
- Part numberMDRS0S12BCNCAA
- Licensed perServer, 25-49 in this band
- Term1 year
- Coverage24/7 Sophos analysts
- CleanupSophos contains, you finish
Who it is for
No security team after hours
Sophos analysts watch and contain attacks 24/7, so an alert at night or on a weekend is not left unread.
Insurer or client asks about monitoring
Cyber insurance and client questionnaires commonly ask who watches your systems around the clock. MDR gives you a named answer.
Already invested in other tools
More than 350 integrations let Sophos use telemetry from security products you already run.
What is included
- 24/7 monitoring and threat hunting by Sophos analysts, including nights, weekends and holidays.
- Active threat containment: Sophos stops the attack in progress, then gives you guided steps to finish the cleanup.
- Three response modes you choose: Authorize (Sophos contains and remediates for you, the usual choice without a security team), Collaborate (Sophos works alongside your team) or Notify (Sophos alerts, your team acts).
- Works with the tools you have: more than 350 third-party integrations, so it can use telemetry from existing security products.
- Onboarding that includes a health check of your environment.
Sophos MDR or MDR Plus?
Both tiers include 24/7 monitoring, threat hunting and active containment. The single decision is who finishes the response.
| Capability | Sophos MDR | Sophos MDR Plus |
|---|---|---|
| 24/7 monitoring and threat hunting | Yes | Yes |
| Active threat containment | Yes | Yes |
| Who completes the cleanup | You, with guided steps | Sophos, end to end |
| Full incident response | Separate engagement | Included, no hourly caps |
| Dedicated incident response lead | No | Yes |
| Contractual response target | No | 60 min for 90% of high-severity cases |
| Breach Protection Warranty | Not included | Up to $1M in response expenses |
The practical test: if a serious incident happened at 2am on a Sunday, is there someone on your side who can run the cleanup? If the honest answer is no, MDR Plus is the tier that does it for you.
Upgrade path
- Sophos XDR for Server. Tools for your own team to investigate and respond.
- Sophos MDR (this listing). 24/7 monitoring and containment; you finish the cleanup.
- Sophos MDR Plus. Adds full incident response, a dedicated lead and the Breach Protection Warranty.
Add-ons to consider: Sophos ITDR for identity attacks on Entra ID and Active Directory, Sophos NDR for devices that cannot run an agent, Sophos Managed Risk for internet-facing vulnerabilities, Sophos Next-Gen SIEM for long-term log retention, and Fusion Data Storage for a year of investigation data.
All bands and terms
| Servers | 1 year |
|---|---|
| 1-9 servers | View |
| 10-24 servers | View |
| 25-49 servers | This listing |
| 50-99 servers | View |
| 100 or more servers | Ask Nuformat for a quote, priced to your exact count |
Frequently asked questions
What is the difference between Sophos MDR and Sophos MDR Plus?
Both include 24/7 monitoring, threat hunting and active containment. MDR Plus adds full incident response by Sophos with no hourly caps, a dedicated incident response lead, a contractual 60-minute response target for 90 percent of high-severity cases, and the Breach Protection Warranty. With Sophos MDR, Sophos contains the threat and you finish the cleanup with guided steps.
Does Sophos MDR replace my existing endpoint protection?
It needs Sophos XDR or the Sophos XDR Sensor on the devices you want managed, but it does not force you to remove other tools. Sophos MDR supports more than 350 third-party integrations.
How quickly does Sophos respond to an incident?
MDR Plus carries a contractual 60-minute response target for 90 percent of high-severity cases. Standard Sophos MDR has no contractual target. You set the response mode, so you decide whether Sophos acts straight away or notifies you first.
What does this listing cover?
25-49 servers for 1 year, Sophos part MDRS0S12BCNCAA. Staff computers need Sophos MDR user licenses, sold separately.
Can I pay monthly instead of for a full term?
Yes. Nuformat can bill Sophos MDR for Server monthly as your managed service provider. Monthly rates can change, so a term subscription is the way to fix your price.
Get Sophos MDR for Server quoted by Nuformat
Nuformat is a Sophos partner serving Canada and the United States. Send us your user and server counts and we will confirm the right tier and band.
Request a quoteService details as published in Sophos MDR product documentation and Sophos tech specs, checked October 11, 2026. Pricing and availability confirmed by Nuformat at quotation. All Sophos MDR for Server options