Description
Sophos Network Detection and Response NDR - 10-24 users and servers - 1 year subscription
Sophos NDR watches traffic inside your network to catch attacks on devices that cannot run security software, such as cameras, printers, building systems and unmanaged machines. A passive sensor connects to a mirror port, so it adds no delay to your network. This listing covers 10-24 users and servers for 1 year, Sophos part number MDRNDU12ABNCAA.
- Part numberMDRNDU12ABNCAA
- Licensed perUsers and servers, 10-24
- Term1 year
- SensorVirtual appliance included
- Works withSophos XDR or MDR
Who it is for
Lots of devices you cannot protect
IoT, OT, cameras, medical or plant equipment have no agent. NDR watches their traffic instead.
MDR customers who want network eyes
NDR detections flow into Sophos Fusion, so the Sophos team or your XDR investigations see network activity too.
Worried about attackers already inside
Spots command-and-control traffic, scanning and brute force attempts that get past the firewall.
What is included
- Passive sensor: connects to a SPAN or mirror port, deployed as a virtual appliance on VMware or Hyper-V, in AWS, or on certified hardware. The virtual appliance is included in the subscription.
- Five detection engines: Data Detection Engine, Domain Generation Algorithm, Deep Packet Inspection, Session Risk Analytics and Encrypted Payload Analysis.
- Sees into encrypted traffic without decrypting it, using session size, direction and timing to flag command-and-control servers.
- Finds unmanaged and rogue devices, including their manufacturer and operating system.
- Detections in Sophos Fusion, alongside your endpoint, firewall and email data, and a threat feed that Sophos Firewall can act on.
What you need first: Sophos lists NDR as an add-on for Sophos XDR and Sophos MDR. If you run neither yet, ask us and we will quote the pair.
Where it fits
- Sophos XDR or Sophos MDR. Required. The platform NDR feeds its detections into.
- Sophos NDR (this listing). Adds network visibility for devices without an agent.
- Sophos ITDR. Adds identity threat detection for Microsoft Entra ID accounts.
Count every user and server you protect with Sophos when choosing the band, the same way as your XDR or MDR license.
All bands and terms
| Users and servers | 1 year | 3 years |
|---|---|---|
| 1-9 users and servers | View | View |
| 10-24 users and servers | This listing | View |
| 25-49 users and servers | View | View |
| 50-99 users and servers | View | View |
| 100-199 users and servers | View | Quote |
| 200 or more | Ask Nuformat for a quote, priced to your exact count | |
Frequently asked questions
Do I need Sophos XDR or MDR to use Sophos NDR?
Sophos lists NDR as an add-on for Sophos XDR and Sophos MDR, and its detections feed into those workflows in Sophos Fusion.
Will Sophos NDR slow down my network?
No. The sensor is passive. It receives a copy of traffic from a SPAN or mirror port and is not inline, so it adds no latency and no single point of failure.
Do I need to buy hardware?
Usually not. The virtual appliance is included in the subscription and runs on VMware or Hyper-V, or in AWS. Certified hardware is an option for sites without a hypervisor.
How is Sophos NDR licensed?
By the number of users and servers. This listing covers 10-24 for 1 year, Sophos part MDRNDU12ABNCAA.
Can I pay monthly instead of for a full term?
Yes. Nuformat can bill Sophos NDR monthly as your managed service provider. Monthly rates can change, so a term subscription is the way to fix your price.
Get Sophos NDR quoted by Nuformat
Nuformat is a Sophos partner serving Canada and the United States. Tell us how many users and servers you protect and how your network is laid out, and we will size the sensor and confirm the band.
Request a quoteFeatures as listed on the Sophos NDR product page and Sophos Endpoint tech specs on sophos.com, checked October 11, 2026. Pricing and availability confirmed by Nuformat at quotation. All Sophos NDR options