Who does what
Provider
- Monitor and investigate covered security alerts
- Contain threats when authorized
- Provide scoped incident response with MDR Plus
Your team
- Maintain agents, integrations and contacts
- Choose response authority and approve exceptions
- Own recovery and work outside the service scope
Coverage
- Endpoints
- Identity & Access
- Network
Details
Service scope
Best for Teams seeking managed response across Sophos and supported third-party tools
Response mode
Authorize permits action in advance. Collaborate requires consent for response. Notify Only leaves containment with you.
Service tier
MDR focuses on containment. MDR Plus adds remote incident response for covered endpoints running Sophos XDR. Recovery remains yours.
Endpoint setup
Agentless third-party endpoints support isolation and release. Sophos Agent or Sensor deployments support additional actions, including remote shell access.
Full service analysis
Sophos MDR monitors and investigates security alerts around the clock, then contains threats when your response mode permits. Your team maintains deployment, contacts and recovery, with incident-response responsibilities determined by the tier and endpoint setup.
- Your team owns
- Endpoint deployment and integration health
- Response-mode selection and reachable contacts
- Recovery and work outside the contracted scope
Integration costs
Ask for an itemized integration list. The service page describes integrations as included, while the tier documentation still describes paid third-party integration packs. Confirm the terms applying to your quote.
Incident coordination
MDR Plus provides technical response and an advisor within scope. Keep an owner for business decisions, other responders and system restoration.
Pricing & contract
- Billing
- Custom
Quote the current MDR or MDR Plus tier and endpoint deployment. Ask for an itemized integration list because Sophos pages differ on third-party integration-pack charges. Extended retention and wider incident-response work need separate scope.
Tradeoffs & buying questions
Strengths
-
Configurable response authority
-
Support for existing third-party security tools
-
Scoped incident response available with MDR Plus
Considerations
-
Agentless endpoint response has a narrower action set
-
Plus incident response requires eligible Sophos XDR endpoints
-
Integration licensing needs an itemized quote
Ask before buying
- Which current tier and endpoint deployment model does the quote cover?
- Which integrations allow response actions and what licenses do they require?
- Who handles unsupported systems, recovery and insurer or forensic coordination?
Customer feedback
Customers value
-
Lean teams value after-hours investigation
-
Users describe prompt response and useful escalation
Reported concerns
-
Some users find cost and onboarding demanding
-
Reporting and notifications can need more tailoring
-
Many reviews are incentivized and describe earlier packages
Integrations
Endpoint
- Sophos Endpoint
- Microsoft Defender
- CrowdStrike
1 more integrations
- SentinelOne
Other integrations
- Microsoft 365
Common questions
Can Sophos act without asking first?
Authorize delegates supported actions. Collaborate requires consent, with an optional fallback if contacts cannot be reached. Notify Only leaves containment to your team.
What does MDR Plus add?
MDR Plus adds incident response for eligible Sophos XDR endpoints. It does not take over system restoration or your wider incident coordination.
How should we compare an older MDR Complete quote?
Confirm the current package and contract. Some marketplace listings still use MDR Complete naming, while current documentation names MDR and MDR Plus.