In short: Sophos EDR is the tier between Sophos Endpoint and Sophos XDR. It includes Sophos Endpoint and adds detections mapped to MITRE ATT&CK, AI case summaries, AI search and command analysis, endpoint isolation and Live Response shell access. It is licensed per user and per server, billed monthly or on a fixed term.
What Sophos EDR is
Sophos EDR sits between Sophos Endpoint and Sophos XDR. It includes all of Sophos Endpoint's prevention and adds the tools an IT or security analyst needs to hunt for, investigate and respond to threats that get past prevention, on computers and servers running Windows, macOS and Linux, including legacy platforms.
It suits organisations that want investigation and response on their own devices but do not need to bring in data from firewalls, email or identity products from other vendors, which is what XDR is for. Because it runs on the same Sophos agent, EDR can be added to an existing Sophos Endpoint estate as a licence change.
What EDR adds over Endpoint
| Capability | Sophos Endpoint | Sophos EDR | Sophos XDR |
|---|---|---|---|
| Prevention, CryptoGuard, anti-exploitation, Adaptive Attack Protection | Yes | Yes | Yes |
| Detections mapped to MITRE ATT&CK tactics | No | Yes | Yes |
| AI case summary, AI search and AI command analysis | No | Yes | Yes |
| On-demand endpoint isolation | No | Yes | Yes |
| Live Response shell access | No | Yes | Yes |
| Detections on third-party data, cross-product correlation | No | No | Yes |
Live Response gives an analyst direct, audited shell access to a device to stop processes, run tools and collect evidence. AI search lets you query device data in plain English instead of writing SQL, AI command analysis explains what a complex command line was trying to do, and the AI case summary gives an overview of a detection with recommended next steps.
How Sophos EDR is licensed
Sophos EDR is licensed like Sophos Endpoint: per user for computers and per server for servers and cloud workloads, at the EDR tier. Users and servers are counted separately, and we normally license both at the same tier so coverage is consistent.
- Monthly billing on the users and servers you protect, through Forever Systems.
- Fixed term if you prefer a set renewal date.
- Upgrade to XDR or MDR when you need more coverage.
- Add-ons such as Device Encryption and Workspace Protection sit alongside the EDR licence.
Ask us for a quote and we will confirm which add-ons apply to your account.
Requirements and deployment
EDR uses the standard Sophos agent and the Sophos console (Sophos Central, becoming Sophos Fusion). There is no separate server or data store to run: telemetry is stored in the Sophos Data Lake for historical analysis, so you can look back at events after the fact. To use EDR well you need someone who will look at detections and cases, either in-house or through a provider; Forever Systems can do that as part of a managed service.
Who Sophos EDR suits
EDR suits organisations with an IT team that wants to investigate alerts properly, prove what happened after an incident and respond remotely, but whose security tools are mostly Sophos or who have no need to pull in other vendors' data. If you run third-party firewalls, email security or identity products and want them correlated, choose XDR. If you want Sophos analysts to do the watching around the clock, choose MDR.
For product depth, see Sophos XDR on our specialist site, and compare vendors on our EDR, XDR and MDR page.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between Sophos EDR and Sophos XDR?
Sophos EDR investigates and responds on endpoints and servers using Sophos data. Sophos XDR adds detections on data from firewalls, email, identity, cloud and other vendors' tools, cross-product correlation and an AI Assistant for investigations, and includes the Email Monitoring System.
Can I upgrade from Sophos Endpoint to EDR without reinstalling?
Yes. EDR includes Sophos Endpoint and runs on the same Sophos agent, so moving up is a licence and policy change rather than a redeployment.
Does Sophos EDR work on servers and Linux?
Yes. Sophos EDR covers Windows, macOS and Linux, including legacy platforms. Servers are licensed per server at the EDR tier, and computers per user.