In short: Sophos Endpoint editions are five licence tiers built on the same Intercept X prevention: Sophos Endpoint (protection), Sophos EDR (endpoint investigation and response), Sophos XDR (detection and response across Sophos and third-party data), Sophos MDR (a 24/7 managed service) and Sophos MDR Plus (adding full-scale incident response and the Breach Protection Warranty).
The five tiers at a glance
Since the late-2025 licence changes, the Sophos endpoint range is a ladder. Each step includes everything below it:
| Tier | In one line | Who does the work |
|---|---|---|
| Sophos Endpoint | Intercept X prevention: deep learning, exploit prevention, CryptoGuard, Adaptive Attack Protection and policy controls | Automatic, managed by your IT team |
| Sophos EDR | Adds endpoint detections, case management, AI-assisted investigation and response tools | Your IT or security team |
| Sophos XDR | Adds third-party data, cross-product correlation, an AI assistant and Microsoft 365 response actions | Your security team |
| Sophos MDR | Adds 24/7 monitoring, threat hunting, containment and reporting by Sophos analysts | Sophos's MDR team, with you |
| Sophos MDR Plus | Adds full-scale incident response, a dedicated incident response lead, root cause analysis and the Breach Protection Warranty | Sophos's MDR and incident response teams |
Sophos XDR appears on sophos.com as Sophos XDR Powered by Secureworks, reflecting the Secureworks Taegis technology it now draws on. Sophos MDR was previously called MDR Essentials, and MDR Plus was previously MDR Complete. Each MDR subscription includes a Sophos XDR licence.
What each tier adds
This comparison is drawn from Sophos's published tech specs and licence entitlement policy. Most rows that are the same in every tier, such as automatic malware clean-up, ransomware rollback, Adaptive Attack Protection and estate-wide Critical Attack Warnings, are left out.
| Capability | Endpoint | EDR | XDR | MDR | MDR Plus |
|---|---|---|---|---|---|
| Intercept X prevention and policy controls | Yes | Yes | Yes | Yes | Yes |
| Root cause analysis threat graphs | Yes | Yes | Yes | Yes | Yes |
| Suspicious event detections and AI prioritisation | No | Yes | Yes | Yes | Yes |
| Automatic MITRE ATT&CK mapping | No | Yes | Yes | Yes | Yes |
| Cases, AI case summary, AI command analysis, AI search | No | Yes | Yes | Yes | Yes |
| On-demand device isolation, on-demand Adaptive Attack Protection and Live Response | No | Yes | Yes | Yes | Yes |
| Linux container detections and device exposure | No | Yes | Yes | Yes | Yes |
| AI assistant | No | No | Yes | Yes | Yes |
| Third-party data ingestion, cross-product correlation and forensic data export | No | No | Yes | Yes | Yes |
| Microsoft 365 response actions | No | No | Yes | Yes | Yes |
| Standard cloud data retention | None | 30 days | 90 days | 90 days | 90 days |
| 24/7 monitoring, threat hunting and containment | No | No | No | Yes | Yes |
| Full-scale incident response and dedicated IR lead | No | No | No | No | Yes |
| Breach Protection Warranty | No | No | No | No | Yes |
A one-year extension to cloud data retention is an add-on for EDR, XDR and MDR. Third-party integrations are now included in XDR and MDR: from November 2025 Sophos stopped requiring separate integration pack licences.
EDR vs XDR vs MDR: which do you need?
The three acronyms describe different jobs:
- EDR (endpoint detection and response) gives you the data and tools to investigate what happened on your computers and servers, and to act on it: isolate a device, open a remote shell, kill a process. It is the right step for an IT team that wants to look into alerts properly.
- XDR (extended detection and response) applies the same idea across everything: firewall, email, network, identity, cloud and non-Sophos tools. It suits organisations with security analysts who want one place to hunt and investigate.
- MDR (managed detection and response) is a service, not a tool. Sophos's analysts use the XDR platform on your behalf, 24 hours a day, and take action to contain threats. It suits the many UK SMEs that do not have anyone watching overnight.
A simple test: if nobody in your organisation will look at a security alert at 2am on a Sunday, the tools alone will not help you then, and MDR is the tier to consider. If you have a team, EDR or XDR lets them work faster. The vendor-neutral view is on our endpoint security and XDR guide.
Add-ons by tier
Some add-ons are available to every tier; others need XDR or MDR:
| Add-on | Available with |
|---|---|
| Sophos Endpoint for Legacy Platforms | All tiers |
| Sophos Device Encryption | All tiers |
| Sophos Workspace Protection | All tiers |
| Incident Response Services Retainer | All tiers |
| Additional cloud data retention | EDR, XDR and MDR |
| Sophos ITDR | XDR and MDR |
| Sophos NDR | XDR and MDR |
| Sophos Next-Gen SIEM | Eligible XDR and MDR |
| Sophos AI Defense | Eligible EDR, XDR and MDR |
| Sophos Managed Risk (vulnerability management) | MDR |
Other Sophos Endpoint licences
Three more licences sit alongside the main tiers:
- Sophos Endpoint 100: a fixed-price Sophos Endpoint offer, covering computers and servers, for organisations with up to 100 users
- Intercept X Essentials: the old entry-level licence, now end of sale, whose customers move to Sophos Endpoint at renewal
- Sophos Endpoint for Legacy Platforms: an add-on that keeps protecting eligible Windows and Linux systems after the operating system vendor's support ends
Servers use the same tiers with server licences; see Intercept X for Server and Sophos Cloud Workload Protection.
How Sophos Endpoint is licensed
User devices are licensed per user and servers per server; MDR and MDR Plus subscriptions are counted on users and servers too. Licences are bought as term subscriptions, or billed monthly on usage through Sophos's MSP Flex programme when a managed service provider runs the tenant. New tiers have sometimes reached MSP Flex later than term licences: Sophos EDR, for example, went on sale for term licences on 1 November 2025 and through MSP Flex in late January 2026. All tiers are managed in Sophos Fusion (formerly Sophos Central).
Sophos does not publish one price for each tier, and the final figure depends on numbers, term and add-ons. Contact us and we will recommend a tier and give you a written quote. Our Sophos licensing and Intercept X pricing pages explain the cost drivers.
Other Sophos Endpoint licences
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between Sophos Endpoint and Sophos EDR?
Sophos Endpoint is prevention: it blocks malware, exploits and ransomware automatically. Sophos EDR includes Sophos Endpoint and adds detections, case management, AI-assisted investigation, on-demand device isolation, Live Response and 30 days of cloud data retention.
Is Sophos XDR the same as Sophos EDR?
No. Sophos EDR covers endpoints and servers. Sophos XDR adds data from firewall, email, network, identity, cloud and third-party tools, correlates it across products, keeps 90 days of data and adds an AI assistant and Microsoft 365 response actions.
Does Sophos MDR include XDR?
Yes. Sophos's licence policy states that each Sophos MDR and MDR Plus subscription includes a Sophos XDR licence, so MDR customers get the XDR tools as well as Sophos's 24/7 analysts.
What happened to MDR Complete and MDR Essentials?
They were renamed. MDR Essentials is now Sophos MDR and MDR Complete is now Sophos MDR Plus. MDR Plus adds full-scale incident response, a dedicated incident response lead, root cause analysis and the Breach Protection Warranty.
Which Sophos Endpoint edition is right for a small business?
Most small businesses start with Sophos Endpoint, or Sophos Endpoint 100 if they have up to 100 users, and add Sophos MDR if nobody can respond to alerts around the clock. EDR suits small firms with a capable in-house IT person who wants to investigate alerts.