In short
Sophos detection and response comes in three tiers on the Sophos Endpoint agent. Sophos EDR adds MITRE ATT&CK-mapped detections, AI-assisted investigation, isolation and Live Response. Sophos XDR, now sold as Sophos XDR Powered by Secureworks, adds third-party data and cross-product correlation. Sophos MDR and MDR Plus add Sophos's own analysts, monitoring and responding 24/7.
Get a quote for Sophos detection and response
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
How Sophos structures detection and response
Sophos builds everything on Sophos Endpoint, its prevention product, which Sophos describes as prevention-first protection with deep learning malware prevention, exploit mitigation, CryptoGuard anti-ransomware and Adaptive Attack Protection. Detection and response then comes in three steps on the same agent, so moving up is a licence and policy change rather than a reinstall:
| Step | What it is | Who acts on it |
|---|---|---|
| Sophos EDR | Endpoint detection and response on computers and servers | Your team, or a provider on your behalf |
| Sophos XDR | EDR plus data from Sophos and third-party firewalls, email, identity, cloud and business applications | Your team, or a provider on your behalf |
| Sophos MDR | A managed service run by Sophos's own security operations team, built on the XDR tooling | Sophos's analysts, within the response mode you choose |
Everything is managed in Sophos's cloud console, long known as Sophos Central and now described by Sophos as evolving into Sophos Fusion. For antivirus and Sophos Endpoint on its own, see our sister site endpointprotection.uk; for the products in depth, our Sophos specialist site covers Sophos Intercept X.
Not sure which licence fits? Ask us
Tell us what you need and we will recommend the right licence for your organisation, with a quote.
Sophos EDR: investigation on your own devices
Sophos EDR includes Sophos Endpoint and adds the tools an IT or security analyst needs to hunt, investigate and respond when something gets past prevention, on Windows, macOS and Linux computers and servers:
| Capability | Sophos Endpoint | Sophos EDR | Sophos XDR |
|---|---|---|---|
| Prevention, CryptoGuard, anti-exploitation, Adaptive Attack Protection | Yes | Yes | Yes |
| Detections mapped to MITRE ATT&CK tactics | No | Yes | Yes |
| AI case summary, AI search and AI command analysis | No | Yes | Yes |
| On-demand endpoint isolation | No | Yes | Yes |
| Live Response shell access | No | Yes | Yes |
| Detections on third-party data and cross-product correlation | No | No | Yes |
Live Response gives an analyst audited shell access to a device to stop processes, run tools and collect evidence. AI search lets you query device data in plain English rather than writing queries, which makes threat hunting far more approachable for a generalist IT team. For Sophos EDR in depth, see Sophos EDR on our Sophos site.
Sophos XDR: beyond the endpoint
Sophos XDR is now sold as Sophos XDR Powered by Secureworks, following Sophos's 2025 acquisition of Secureworks. Sophos describes it as unifying detection, investigation and response across multiple security layers, and as vendor-agnostic by design:
- Third-party data: integrations with other vendors' firewalls, email security, identity providers, cloud platforms and business applications, some with two-way actions so an analyst can respond in the other tool
- Cross-product correlation: related alerts are grouped into cases instead of arriving one by one
- AI Assistant: natural-language help with searching and investigating security data
- Email Monitoring System: included with XDR, bringing email signals in without replacing your existing email security
- Optional add-ons: Sophos Next-Gen SIEM for long-term retention, Sophos ITDR for identity threats and Sophos NDR for network detection
XDR suits teams who want to see across endpoints, network, email and identity, including tools not made by Sophos. Our extended detection and response guide explains the general trade-offs, and Sophos XDR covers the product in depth.
Is Sophos detection and response the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Sophos MDR and MDR Plus
If nobody can watch cases at night, at weekends and over holidays, Sophos MDR puts Sophos's own analysts on top of the XDR tooling. Sophos describes the service as 24/7 detection, expert threat hunting and incident response, and as working with Sophos products and with tools from other vendors, including Microsoft, CrowdStrike and SentinelOne.
Sophos has renamed its tiers: MDR Essentials is now Sophos MDR and MDR Complete is now Sophos MDR Plus. Older quotes and renewal notices may use either set of names.
| Sophos MDR | Sophos MDR Plus | |
|---|---|---|
| 24/7 monitoring, investigation and threat response | Yes | Yes |
| Works with Sophos and supported third-party security tools | Yes | Yes |
| Choice of response mode | Yes | Yes |
| Full-scale incident response with a dedicated incident response lead | No | Yes |
| Root cause analysis after an incident | No | Yes |
At onboarding you choose a response mode: Authorize, where Sophos acts and then tells you; Collaborate, where Sophos investigates and takes response actions with your consent; or Notify Only, where Sophos sends notifications and takes no containment action. Most organisations without their own security operations centre choose Authorize or Collaborate. Read more on Sophos MDR and MDR Plus.
Which Sophos tier suits you
A quick guide, based on who will act on what the platform finds:
| If you | Consider |
|---|---|
| Have an IT team that wants to investigate and respond on its own devices | Sophos EDR |
| Run firewalls, email or identity tools from several vendors and want them correlated | Sophos XDR |
| Have nobody to watch cases out of hours | Sophos MDR |
| Want incident response included rather than bought in a crisis | Sophos MDR Plus |
| Already pay for Microsoft Defender for Endpoint and want it watched | Sophos MDR, which Sophos says integrates with Defender |
If you are comparing Sophos with other platforms, the best EDR solutions guide sets out the questions to ask, and our endpoint security vendors page lists the other vendor-run services, such as Check Point MDR and Bitdefender MDR.
How Sophos is licensed
Sophos EDR, XDR and MDR are licensed like Sophos Endpoint: per user for computers, so one licence covers the devices a person signs in to, and per server for servers and cloud workloads. Users and servers are counted separately, and we normally license both at the same tier so coverage is consistent.
Through Forever Systems, Sophos can be billed monthly on the users and servers you protect, or bought on a fixed term with one renewal date; terms are confirmed at quote. Moving from EDR to XDR, or from XDR to MDR, is a licence change on the same agent. Licensing detail is on our Sophos EDR licensing, Sophos XDR licensing and Sophos MDR licensing pages.
How Forever Systems helps
We can help you decide which Sophos tier fits your team, count users and servers, deploy the agent and remove the product it replaces, connect third-party tools for XDR, and agree the response mode and escalation contacts if you choose Sophos MDR. Sophos's analysts run the MDR service; we make sure it is set up to work for you, and licence changes and renewals sit on one Forever Systems account.
Contact us to talk about Sophos EDR, XDR or MDR for your organisation.
How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos, Check Point, TrendAI and Cisco
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
What is the difference between Sophos EDR, XDR and MDR?
Sophos EDR adds detection, investigation and response on your computers and servers. Sophos XDR adds data from Sophos and third-party firewalls, email, identity and cloud tools, correlated into cases. Sophos MDR is a managed service in which Sophos's own analysts monitor and respond around the clock.
Do Sophos EDR, XDR and MDR need a new agent?
No. All three build on the Sophos Endpoint agent, so moving up is a licence and policy change in the Sophos console rather than a reinstall.
What is Sophos XDR Powered by Secureworks?
It is the current name for Sophos XDR, following Sophos's 2025 acquisition of Secureworks. It adds third-party data, cross-product correlation, an AI Assistant and the Email Monitoring System to Sophos EDR.
What are Sophos MDR and MDR Plus?
They are the two tiers of Sophos's managed detection and response service, formerly MDR Essentials and MDR Complete. MDR Plus adds full-scale incident response with a dedicated incident response lead and root cause analysis.
Can Sophos MDR monitor other vendors' tools?
Yes. Sophos describes MDR as vendor-agnostic and lists integrations with Microsoft, CrowdStrike, SentinelOne and other vendors, so you can add the service without replacing everything. We check support for your exact tools before quoting.
How is Sophos detection and response licensed?
Per user for computers and per server for servers, at the EDR, XDR or MDR tier. Through us it can be billed monthly, with terms confirmed at quote. Ask us for a quote.
Still have a question about Sophos detection and response?
Ask us and a member of our team will reply by email.
More endpoint security guides
Check Point EDREDR in every Check Point Endpoint Security edition, Infinity XDR in Elite and Check Point MDR, explained.
Cisco EDRCisco Secure Endpoint's detection and response, Talos threat hunting, Cisco XDR and the Breach Protection Suite.
Bitdefender MDRBitdefender's managed detection and response on GravityZone: what its SOC does and what you agree up front.