In short: Sophos MDR is a 24/7 managed detection and response service run by Sophos analysts. It comes in two tiers: Sophos MDR (formerly MDR Essentials) and Sophos MDR Plus (formerly MDR Complete), which adds full-scale incident response with a dedicated incident response lead, root cause analysis and the Breach Protection Warranty. Both are licensed per user and server.
What Sophos MDR is
Sophos MDR is a managed service: Sophos's own security operations team monitors your environment around the clock, investigates detections and takes action to contain attacks. It uses Sophos's XDR tooling and works with data from Sophos products and from supported third-party tools, including Microsoft security products, other firewalls, identity and cloud services. Sophos describes it as vendor-agnostic: it can also run alongside some non-Sophos endpoint products, with Sophos agents in a detection-and-response-only mode.
Sophos has renamed the tiers: MDR Essentials is now Sophos MDR and MDR Complete is now Sophos MDR Plus. Older quotes and renewal notices may still use the previous names.
MDR and MDR Plus compared
| Feature | Sophos MDR | Sophos MDR Plus |
|---|---|---|
| 24/7 monitoring, investigation and threat response | Yes | Yes |
| Integration with Sophos and third-party security tools | Yes | Yes |
| Microsoft 365 audit logs and Microsoft Graph Security API at no extra cost (subject to your Microsoft subscriptions) | Yes | Yes |
| Choice of response mode: Authorize, Collaborate or Notify Only | Yes | Yes |
| 90 days of device data, with a one-year storage option | Yes | Yes |
| Full-scale incident response with a dedicated incident response lead | No | Yes |
| Root cause analysis after an incident | No | Yes |
| Response time service level with service credits | No | Yes |
| Sophos Breach Protection Warranty | No | Yes, on Sophos's terms |
With Sophos MDR, the team works to stop an attack and prevent it spreading, then gives you guidance to finish neutralising it yourself or through your provider. With MDR Plus, Sophos carries an active incident through until the threat is fully eliminated and investigates the root cause. The Sophos MDR page on our specialist site covers the service in depth.
How Sophos MDR is licensed
Both tiers are licensed per user and per server.
- Monthly through Forever Systems on the users and servers covered.
- Fixed term with a set renewal date.
- Upgrade from MDR to MDR Plus during the term.
- Add-ons: one-year extended data storage, third-party integration packs where a tool needs one, NDR, ITDR and Next-Gen SIEM for long-term retention and compliance, plus Device Encryption and Workspace Protection alongside your endpoint licences.
If you have an active incident and no MDR in place, Sophos also offers incident response services; see Sophos Rapid Response.
Onboarding and requirements
MDR uses the standard Sophos agent and console. At onboarding you choose a response mode: Authorize, where Sophos acts and then tells you; Collaborate, where Sophos investigates but takes response actions only with your consent (optionally switching to Authorize if nobody answers); or Notify Only, where Sophos investigates and gives you remediation guidance. You also name contacts for escalation and connect any third-party tools you want the team to see. Existing Sophos Endpoint customers do not need to reinstall.
Who it suits and how we help
MDR suits organisations that cannot staff a security operations centre around the clock but want threats investigated and contained at any hour. MDR Plus suits those who want incident response included rather than bought in a crisis.
We size the service, agree the response mode with you, connect integrations and stay as your first point of contact for licensing, changes and renewals. Ask us for a quote, and compare other providers on our EDR, XDR and MDR page.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between Sophos MDR and MDR Plus?
Both give 24/7 monitoring, investigation and threat response with third-party integrations. MDR Plus adds full-scale incident response led by a dedicated incident response lead, root cause analysis, a response time service level and the Sophos Breach Protection Warranty.
Is Sophos MDR Complete still available?
Yes, under a new name. MDR Complete is now Sophos MDR Plus, and MDR Essentials is now Sophos MDR.
Can Sophos MDR work with a non-Sophos endpoint product?
Yes. Sophos describes MDR as vendor-agnostic. With a third-party endpoint product, Sophos agents run in a detection-and-response-only mode with no protection actions. We check compatibility with your current product before we quote.
Can Sophos MDR act on my behalf?
Yes, in Authorize mode, where Sophos takes response actions and then notifies you. In Collaborate mode it acts only with your consent, and in Notify Only mode it investigates and gives you remediation guidance.