Description
TrendAI Vision One™ - Managed Detection and Response (MDR)
Sophos MDR is a 24/7 managed detection and response service where Sophos analysts monitor your environment, hunt for threats and contain active attacks. This listing covers the user or server count shown on a the term shown subscription. Sophos contains the threat and gives you guided steps to finish the cleanup.
Sophos MDR or MDR Plus?
Both tiers include 24/7 monitoring, threat hunting and active containment. The single decision is who finishes the response.
| Capability | Sophos MDR | Sophos MDR Plus |
|---|---|---|
| 24/7 monitoring and threat hunting | Yes | Yes |
| Active threat containment | Yes | Yes |
| Who completes the cleanup | You, with guided steps | Sophos, end to end |
| Full incident response | Separate engagement | Included, no hourly caps |
| Dedicated incident response lead | No | Yes |
| Contractual response SLA | No | 60 min for 90% of high-severity cases |
| Breach Protection Warranty | Not included | Up to $1M in response expenses |
The practical test: if a serious incident happened at 2am on a Sunday, is there someone on your side who can run the cleanup? If the honest answer is no, MDR Plus is the tier that does it for you.
How you work with the Sophos team
Three response modes, set by you, controlling how much the analysts do without asking first.
- Authorize. Sophos contains and remediates on your behalf. Most businesses without a security team choose this.
- Collaborate. Sophos works alongside your team during an incident.
- Notify only. Sophos alerts you and your team acts.
Sophos MDR supports more than 350 third-party integrations, so it can ingest telemetry from tools you already run rather than requiring you to replace them.
What you need to run it
- Sophos XDR or the Sophos XDR Sensor on the endpoints you want managed.
- A licence count matching your numbers. This listing covers the user or server count shown.
- Onboarding, which includes a health check of your environment.
Frequently asked questions
What is the difference between Sophos MDR and Sophos MDR Plus?
Both include 24/7 monitoring, threat hunting and active containment. MDR Plus adds full incident response carried out by Sophos with no hourly caps, a dedicated incident response lead, and a contractual 60-minute response target for 90 percent of high-severity cases. It also carries the Sophos Breach Protection Warranty. With standard Sophos MDR, Sophos contains the threat and you finish the cleanup using guided steps.
How many users does this listing cover?
This listing covers the user or server count shown for the term shown. If your count sits near a band boundary, tell us your exact numbers and we will confirm which listing is correct before you order.
Can I pay monthly instead of committing to a term?
Yes. Nuformat can bill Sophos MDR monthly as your MSP rather than as a multi-year purchase. Monthly rates are set by Sophos and can change, so only a term subscription fixes your price. Ask us and we will price both.
Does Sophos MDR replace my existing endpoint protection?
It needs Sophos XDR or the Sophos XDR Sensor on managed endpoints, but it does not require you to remove other tools. Sophos MDR supports more than 350 third-party integrations and can ingest telemetry from existing security products.
How quickly does Sophos respond to an incident?
MDR Plus carries a contractual 60-minute response target for 90 percent of high-severity cases. Standard Sophos MDR has no contractual SLA. Response modes are configurable, so you decide whether Sophos acts immediately or notifies you first.
All Sophos MDR options · Sophos XDR
Get this quoted by Nuformat
Nuformat is a Sophos partner serving Canada and the United States. Send us your user and server counts and we will confirm the right tier and band. Tell us your user count, internet speed and which services you plan to run, and we will confirm the sizing and reply in two to three business days.
Request a quoteService details as published in Sophos product documentation. Pricing and availability confirmed by Nuformat at the time of quotation.