Description
Sophos XDR - 1 year subscription (1-9 users) - CIXXDU12AANCAA
Sophos XDR gives your IT team the tools to find, investigate and stop attacks across computers, servers, firewall, email and Microsoft 365, from one console. It includes everything in Sophos Endpoint. This listing covers 1-9 users for 1 year, Sophos part number CIXXDU12AANCAA.
- Part numberCIXXDU12AANCAA
- Licensed perUser, 1-9 in this band
- Term1 year
- IncludesSophos Endpoint
- Data kept90 days in the cloud
Who it is for
IT team that wants to investigate
You have someone who can look into alerts and wants the tools to see what happened, where, and stop it.
Firewall, email and Microsoft 365 in one view
XDR pulls in data from Sophos Firewall, Sophos Email, Microsoft 365 and other tools, so one investigation covers them all.
A step toward a managed service
Start with XDR now and add Sophos MDR later. MDR uses the same agent and console, so nothing has to be reinstalled.
What is included
- Everything in Sophos Endpoint: CryptoGuard ransomware rollback, deep learning AI, anti-exploit and Adaptive Attack Protection.
- Detection: AI-prioritized detections mapped to the MITRE ATT&CK framework, plus device exposure insights.
- Investigation: automatic and manual cases, AI Case Summary, AI Search, AI Assistant and on-demand Sophos X-Ops threat intelligence.
- Response: on-demand device isolation, Live Response remote terminal and Microsoft 365 response actions.
- Cross-product data: correlates events from Sophos and non-Sophos tools, and keeps 90 days of data in the cloud for investigations.
Sophos Endpoint, XDR or MDR?
All four include the same prevention. The difference is who investigates and responds when something gets past it.
| What you get | Sophos Endpoint | Sophos XDR | Sophos MDR | Sophos MDR Plus |
|---|---|---|---|---|
| Prevention: ransomware rollback, deep learning AI, anti-exploit | Yes | Yes | Yes | Yes |
| Tools to detect, investigate and respond yourself | No | Yes | Yes | Yes |
| Cloud data retention | None | 90 days | 90 days | 90 days |
| Uses firewall, email, Microsoft 365 and non-Sophos data | No | Yes | Yes | Yes |
| AI Assistant for investigations | No | Yes | Yes | Yes |
| 24/7 Sophos analysts watching and responding for you | No | No | Yes | Yes |
| Full incident response by Sophos, and Breach Protection Warranty | No | No | Separate | Included |
The practical test: XDR suits a business with someone who can act on alerts during the day. If nobody can respond at night or on a weekend, Sophos MDR adds a 24/7 team.
Upgrade path
- Sophos Endpoint (included). Prevention, ransomware rollback and automatic cleanup.
- Sophos XDR (this listing). Adds investigation and response tools, AI Assistant and 90 days of cloud data.
- Sophos MDR. Sophos analysts watch and respond 24/7. MDR Plus adds full incident response and the Breach Protection Warranty.
Add-ons for XDR: Sophos Fusion Data Storage keeps data for 1 year instead of 90 days; Sophos ITDR watches Microsoft Entra ID identities; Sophos NDR watches network traffic from devices that cannot run an agent.
All bands and terms
| Users | 1 year | 2 years | 3 years |
|---|---|---|---|
| 1-9 users | This listing | View | View |
| 10 or more users | Ask Nuformat for a quote, priced to your exact count | ||
Frequently asked questions
Does Sophos XDR include Sophos Endpoint?
Yes. Sophos XDR includes Sophos Endpoint and Sophos EDR, so you do not buy Sophos Endpoint separately for the same users.
What is the difference between Sophos XDR and Sophos MDR?
With XDR, your team uses the tools to investigate and respond. With Sophos MDR, Sophos analysts do it for you around the clock.
How long does Sophos XDR keep data?
Sophos XDR keeps data in the Sophos Data Lake for 90 days. The Sophos Fusion Data Storage add-on extends that to 365 days.
What does this listing cover?
1-9 users for 1 year, Sophos part CIXXDU12AANCAA. Servers need Sophos XDR for Server licenses, sold separately.
Can I pay monthly instead of for a full term?
Yes. Nuformat can bill Sophos XDR monthly as your managed service provider. Monthly rates can change, so a term subscription is the way to fix your price.
Get Sophos XDR quoted by Nuformat
Nuformat is a Sophos partner serving Canada and the United States. Tell us your user and server counts and what else you run, and we will confirm the right band and term, usually the same business day.
Request a quoteFeatures as listed in the Sophos Endpoint and XDR tech specs and the Sophos XDR service description on sophos.com, checked October 11, 2026. Pricing and availability confirmed by Nuformat at quotation. All Sophos XDR options