In short: Sophos XDR, now sold as Sophos XDR Powered by Secureworks, adds third-party data, cross-product correlation, an AI Assistant and automated response playbooks to Sophos EDR, and includes Sophos Endpoint and the Email Monitoring System. It is licensed per user and per server, with Next-Gen SIEM, ITDR and NDR as optional add-ons.
What Sophos XDR is
Sophos XDR extends detection and response beyond endpoints and servers. It takes data from Sophos products and from other vendors' firewalls, email security, identity providers, cloud platforms and business applications, correlates it, groups related alerts into cases and lets an analyst investigate and respond from one place.
Since Sophos acquired Secureworks in 2025, the product has been sold as Sophos XDR Powered by Secureworks. XDR includes Sophos Endpoint and the investigation features of Sophos EDR, and also includes the Sophos Email Monitoring System, which works alongside your existing email security to spot phishing and business email compromise and can claw back messages in Microsoft 365 and Google Workspace.
What is included and what is extra
| Item | Included with XDR | Optional add-on |
|---|---|---|
| Sophos Endpoint and EDR features | Yes | |
| Detections on third-party data, cross-product correlation | Yes | |
| Vendor-agnostic third-party integrations, some with two-way actions | Yes | |
| AI-assisted investigation, case management and response playbooks | Yes | |
| Email Monitoring System | Yes | |
| Cloud telemetry from AWS, Azure, Google Cloud and Oracle Cloud workloads | Yes | |
| Next-Gen SIEM (long-term retention and compliance data) | Yes | |
| ITDR identity threat detection | Yes | |
| NDR network detection | Yes |
Next-Gen SIEM keeps telemetry for compliance and audit for up to ten years, and Sophos prices it on users and servers rather than data volume. Sophos AI Defense, for seeing and controlling AI tool use, is a separate Sophos product. Integrations change as Sophos adds and retires them, so before we quote we check that each of your existing tools is supported and whether anything needs an extra integration licence.
How Sophos XDR is licensed
XDR is licensed per user and per server at the XDR tier, and add-ons are quoted to match your organisation.
- Monthly through Forever Systems, following the users and servers you protect.
- Fixed term with a set renewal date.
- Upgrade to Sophos MDR when you want Sophos analysts to monitor and respond 24/7.
Ask us for a quote. We will list which of your existing tools XDR can take data from and which add-ons are worth having.
Requirements and deployment
XDR runs in the Sophos console (Sophos Central, becoming Sophos Fusion) on the standard Sophos agent. Third-party data comes in through integrations configured in the console, such as Microsoft security products, other firewalls, identity providers and cloud platforms. Some integrations allow two-way response, so an analyst can act in the third-party tool from the case. Microsoft integrations need consent granted in your Microsoft tenant, which we set up with you.
Who Sophos XDR suits and how we help
XDR suits organisations with a security-minded IT team, or a provider, that wants to see across endpoints, network, email and identity, including tools not made by Sophos. If you do not have people to look at cases out of hours, MDR is usually the better fit, because Sophos's own analysts do the watching and respond on your behalf.
We map your environment to the available integrations, connect them, tune detections and handle licence changes and renewals. For product depth see Sophos XDR on our specialist site.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What does Sophos XDR Powered by Secureworks mean?
It is the current name of Sophos XDR following Sophos's acquisition of Secureworks in 2025. You license it in the same way as before: per user and per server, with optional add-ons.
Are third-party integrations included in Sophos XDR?
Sophos XDR is designed to be vendor-agnostic and includes a large catalogue of third-party integrations. Integrations change over time, so we check each of your tools is supported, and whether anything needs an extra integration licence, before we quote.
What is Sophos Next-Gen SIEM?
An optional add-on that keeps security data for long-term retention and compliance, for up to ten years. Sophos prices it on users and servers rather than on the volume of data ingested.
Does Sophos XDR include ITDR?
No. Sophos lists ITDR as an optional add-on to Sophos XDR.