In short: Sophos NDR watches network traffic from a passive sensor on a mirror port to spot lateral movement, command-and-control traffic, rogue devices and threats on unmanaged, IoT and OT kit. It is licensed on the number of users and servers, the virtual sensor is included, and a lighter NDR Essentials comes in the Sophos Firewall Xstream bundle.
What Sophos NDR is
Sophos NDR (Network Detection and Response) looks at what is happening on your network rather than on individual devices. That matters because attackers often use devices that cannot run an endpoint agent: printers, cameras, building systems, IoT and OT equipment, or a rogue machine plugged into a spare port.
A passive sensor watches a copy of your traffic and runs several detection engines in real time: a data detection engine that spots activity such as port scanning and SSH brute force, detection of domain-generation-algorithm traffic, deep packet inspection, session risk analytics and encrypted payload analysis. Detections flow into the Sophos console and into Sophos XDR and Sophos MDR investigations.
NDR and NDR Essentials
| Option | Where it comes from | What it gives you |
|---|---|---|
| Sophos NDR | Separate subscription, normally added to XDR or MDR | Passive sensors on the network segments you choose, with detections in XDR and MDR |
| NDR Essentials | Part of the Sophos Firewall Xstream Protection bundle | Network threat detection on the firewall |
If you already run Sophos Firewall with the Xstream bundle, NDR Essentials gives you a starting point at the network edge. Full NDR adds visibility of internal, east-west traffic between devices, which a perimeter firewall does not see.
How Sophos NDR is licensed
Sophos licenses NDR on the number of users and servers in your organisation, not on network throughput or the number of sensors, and the virtual sensor appliance is included in the subscription. Through Forever Systems it can be billed monthly or on a fixed term, matched to your XDR or MDR counts.
When analysts confirm a threat, they can push it to Sophos Firewall so that Active Threat Response blocks and isolates the activity at the network edge. Ask us for a quote and we will propose sensor placement as part of it.
Deployment and requirements
The sensor connects to a SPAN or mirror port on a switch, so it sits out of the traffic path and adds no latency or single point of failure. It runs as a virtual appliance on VMware or Microsoft Hyper-V, in AWS, or on certified hardware. Most organisations place a sensor at the core switch and add more for important segments such as server, OT or guest networks. We check your switches support port mirroring at the bandwidth required before you order.
Buying NDR through Forever Systems
- Survey: we look at your network layout, switches and the segments that hold servers, OT or IoT devices.
- Design: we propose how many virtual sensors you need and where, and check port mirroring and hypervisor capacity.
- Quote: ask us for a quote based on your user and server counts, normally matched to your Sophos XDR or MDR subscription.
- Deploy and run: we install the sensors, confirm detections reach the Sophos console and review findings with you in the first weeks, then handle changes and renewals.
Who it suits and how we help
NDR suits organisations with significant unmanaged kit (manufacturing, healthcare, education, property) or with flat networks where an attacker could move freely once inside. It is also valuable for proving to auditors and insurers that internal traffic is monitored.
We design sensor placement, deploy the virtual appliance, connect it to your Sophos account and handle licensing. For more on the product see Sophos NDR on our specialist site.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
How is Sophos NDR licensed?
On the number of users and servers in your organisation. The virtual sensor appliance is included in the subscription, so you do not pay per sensor.
Does Sophos NDR sit inline?
No. The sensor is passive and watches a copy of traffic from a SPAN or mirror port, so it cannot slow or interrupt your network.
What is NDR Essentials?
A network detection capability that comes as part of the Sophos Firewall Xstream Protection bundle. Full Sophos NDR adds passive sensors inside your network for internal traffic.