In short: Sophos EDR is Sophos's endpoint detection and response licence tier, launched in October 2025. It includes Sophos Endpoint prevention and adds AI-prioritised detections, AI case summaries, AI command analysis, natural-language search, historical data lake queries and live response for Windows, macOS and Linux devices and servers, managed in Sophos Fusion.
What is Sophos EDR?
Prevention stops most attacks, but not every suspicious event is clear-cut. A PowerShell command run at 2am, a new admin account or a login from an unusual device might be harmless, or might be an attacker who has already got in. Endpoint detection and response (EDR) gives you the data and tools to answer that question and do something about it.
Sophos EDR is the licence tier that sits directly above Sophos Endpoint. Sophos introduced it in October 2025 as part of a simpler endpoint and security operations line-up, and it became generally available for term licences on 1 November 2025, with MSP Flex (monthly) availability following in late January 2026. At the same time Sophos dropped "Intercept X" from its licence names, so the old "Intercept X Advanced with EDR" wording is no longer used.
Every Sophos EDR licence includes Sophos Endpoint (the protection technology long known as Sophos Intercept X), so you do not buy prevention and detection separately. If you already run Sophos Endpoint, Sophos says EDR can be added from your Sophos console in a single step. Sophos also says EDR can work with a non-Sophos protection agent such as Microsoft Defender, which helps if you are not ready to replace your current antivirus.
What Sophos EDR adds to Sophos Endpoint
Sophos Endpoint blocks threats. Sophos EDR helps you investigate and respond to the ones that need a human decision.
| Capability | What it does for your team |
|---|---|
| AI-prioritised detections | Ranks detections by risk so the most serious activity is looked at first |
| AI case summary | Groups related detections into a case and summarises what happened, the devices and users involved, the MITRE ATT&CK tactics seen and suggested next steps |
| AI command analysis | Explains in plain English what a complex command line was trying to do and its likely impact |
| AI search | Lets you ask questions of your data in natural language rather than writing queries |
| Live device queries (Live Discover) | Pulls current information from devices that are online |
| Data lake search | Searches historical endpoint data held in the Sophos Data Lake, including for devices that are offline |
| MITRE ATT&CK mapping | Labels detections with the attacker technique they match |
| Device exposure reporting | Highlights risky or out-of-date devices that widen your attack surface |
| Live response | Gives an audited remote shell on a device to run scripts or forensic tools, edit configuration files or reboot |
| Endpoint isolation | Cuts a suspect device off the network while you investigate |
Automated responses from the Sophos Endpoint layer, such as killing a malicious process, Sophos CryptoGuard ransomware rollback, network isolation and Adaptive Attack Protection, carry on working underneath.
Sophos's documentation is specific about one limit: Sophos EDR includes AI case summary, AI command analysis and AI search, but not the conversational AI Assistant, which comes with Sophos XDR and Sophos MDR. Sophos AI features currently work in English.
Platforms and deployment
- Operating systems: Windows, macOS and Linux, for user devices and servers, on premises or in the cloud
- Servers: servers are covered as well as user devices; see Sophos Endpoint – Server for server-specific protection
- Older systems: out-of-support Windows and Linux machines can be covered with the Sophos Endpoint for Legacy Platforms add-on
- Management: everything is run from Sophos Fusion, the evolution of Sophos Central, so there is no on-premises server to build
- Upgrades: existing Sophos Endpoint customers add EDR from the console rather than starting a new deployment
Sophos is upgrading existing EDR, XDR and MDR customers to its enhanced Sophos Fusion experience in phases, with in-product notifications before each upgrade, and the new capabilities come within the existing subscription. New term customers are provisioned on the enhanced experience from the start.
Who Sophos EDR suits
Sophos EDR is a good fit when you have someone who will actually look at the detections: an internal IT team with security responsibilities, or an outsourced IT provider. Typical buyers include:
- Small and mid-sized organisations that have outgrown "install antivirus and forget it" and want to investigate incidents themselves
- IT teams answering cyber insurance questionnaires that ask whether EDR is in place
- Organisations that want the entry ticket to newer Sophos add-ons: Sophos AI Defense, for example, requires an EDR, XDR or MDR licence
If nobody can respond out of hours, EDR on its own leaves a gap. In that case Sophos MDR gives you a 24/7 Sophos team doing the investigation and containment. If you also want firewall, email, identity, network and cloud signals in one place, look at Sophos XDR. The full tier comparison is on our Sophos Endpoint editions page.
Sophos EDR vs Sophos XDR vs Sophos MDR
| Sophos EDR | Sophos XDR | Sophos MDR | |
|---|---|---|---|
| Includes Sophos Endpoint | Yes | Yes | Yes |
| Data sources | Endpoints and servers | Endpoints plus firewall, email, network, identity, cloud and third-party tools | As XDR, monitored by Sophos |
| AI case summary, command analysis, AI search | Yes | Yes | Yes |
| Conversational AI Assistant | No | Yes | Yes |
| Who investigates | Your team | Your team | Sophos analysts, 24/7 |
| Eligible for Next-Gen SIEM add-on | No | Yes | Yes |
The pattern is simple: EDR is about endpoints, XDR widens the view to everything else, and MDR adds people who do the work around the clock.
How we help
Forever Systems supplies and supports Sophos EDR for UK organisations. We can:
- Review your current endpoint protection and tell you honestly whether EDR, XDR or MDR fits your team
- Migrate you from another product or an older Intercept X licence, with tuned exclusions
- Set up alerting, response playbooks and admin roles in Sophos Fusion
- Help your team read detections and use live response safely
Pricing depends on user and server counts, term and any add-ons, so ask us for a quote. Contact us for a written proposal.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between Sophos EDR and Sophos XDR?
Sophos EDR investigates and responds on endpoints and servers. Sophos XDR includes everything in EDR and adds data from firewalls, email, network, identity, cloud and third-party security tools, plus the conversational AI Assistant, automation playbooks and eligibility for the Next-Gen SIEM add-on.
Does Sophos EDR include Sophos Endpoint (Intercept X)?
Yes. Every Sophos EDR licence includes the full Sophos Endpoint protection stack, including deep learning malware detection, exploit prevention and CryptoGuard anti-ransomware. You do not need a separate prevention licence.
Is Sophos EDR the same as Intercept X Advanced with EDR?
It is the current equivalent. Sophos removed Intercept X from its licence names in late 2025; the tiers are now Sophos Endpoint, Sophos EDR, Sophos XDR, Sophos MDR and Sophos MDR Plus (Sophos MDR Essentials and MDR Complete were renamed Sophos MDR and Sophos MDR Plus in 2026).
Do I need to install a new agent to add Sophos EDR?
Not if you already run Sophos Endpoint: Sophos says EDR can be added from the Sophos console in a single step. Sophos EDR can also be used alongside a non-Sophos protection agent such as Microsoft Defender.
Does Sophos EDR include the Sophos AI Assistant?
No. Sophos EDR includes AI case summary, AI command analysis and AI search, but not the conversational AI Assistant, which comes with Sophos XDR and Sophos MDR. Sophos AI features currently support English only.
Is Sophos EDR enough without a 24/7 team?
EDR gives you the tools, but someone still has to act on detections, including at night and weekends. If you cannot cover that, Sophos MDR adds a 24/7 Sophos team that investigates and contains threats for you.