In short: Sophos Intercept X pricing (now Sophos Endpoint) depends on five main things: the tier (Endpoint, EDR, XDR, MDR or MDR Plus), the number of users and servers, the subscription term or monthly billing, any add-ons, and whether a renewal or switch from another product applies. Sophos sells through partners, so the way to get a price is a written quote.
Why there is no single Intercept X price
Sophos sells through partners such as resellers, managed service providers and distributors, and the cost of a licence depends on how much is being protected, for how long and at which tier. Two organisations with the same headcount can pay quite different amounts because one wants automatic protection only and the other wants Sophos analysts watching 24/7.
We do not publish prices on this site. Instead, we explain what drives the cost and then give you a written quote that sets out each line in plain English. If you are comparing quotes, check they use the current product names (see Sophos licensing), because some resellers still quote end-of-sale licences.
The cost drivers
| Factor | Why it matters |
|---|---|
| Tier | Sophos Endpoint, Sophos EDR, Sophos XDR, Sophos MDR and Sophos MDR Plus each add more detection, investigation or managed response, and cost more as they go up |
| Users | User devices are licensed per user (some customers per device); one user with a laptop and a desktop counts once |
| Servers | Servers are licensed separately, per server, under server protection |
| Term | A fixed-term subscription, compared with monthly MSP Flex billing through a provider |
| Add-ons | Next-Gen SIEM, ITDR, NDR, AI Defense, Legacy Platforms and data retention extensions are optional |
| Organisation size | Very small organisations may be able to use the fixed-price Sophos Endpoint 100 licence |
| Renewal or switch | Renewals, co-terming several subscriptions and moving from another vendor can all change the commercial terms |
| Services | Deployment, migration from another antivirus and ongoing management are separate from the Sophos licence |
MDR or XDR: the biggest decision
The largest single swing in cost is whether you run detection and response yourself or have Sophos do it.
- Sophos XDR gives your own team the tools. It costs less than MDR, but only works if someone qualified is looking at detections, including at night and weekends.
- Sophos MDR puts Sophos's analysts on watch 24/7, and each MDR subscription includes a Sophos XDR licence. It costs more than XDR but replaces the cost of staffing a security operations rota.
- Sophos MDR Plus adds full-scale incident response and the Breach Protection Warranty, which can change the maths if you would otherwise buy incident response separately.
When we quote, we often show two tiers side by side so you can see the difference in cost against the difference in cover.
Ways to keep the cost down
- Count accurately. Remove retired devices and merge duplicate users before a renewal so you do not pay for machines you no longer have.
- Choose the right tier for your team. Paying for XDR without anyone to use it wastes money; so does paying for MDR Plus if MDR is enough.
- Use Endpoint 100 if you qualify. Organisations with up to 100 users can use a simpler fixed-price offer that covers computers and servers.
- Co-term subscriptions so firewall, email and endpoint renew on one date, which simplifies budgeting.
- Drop what is now included. Integration packs for XDR and MDR are no longer needed, because integrations are now included.
- Check your Microsoft licences. If you already have Microsoft 365 Business Premium, read Sophos vs Microsoft Defender before buying, so you do not pay twice without a reason.
What we need for a quote
- The number of users, and roughly how many laptops and desktops (Windows and macOS)
- The number of servers, and whether any are in Azure, AWS or other clouds
- Your current security product and its renewal date
- Whether you have someone to handle security alerts out of hours
- Any compliance needs, such as Cyber Essentials or cyber insurance requirements
- Whether you want us to deploy, migrate or manage it
With that, we can usually return a written quote quickly, with the options laid out side by side.
How we help
We give written, itemised Sophos quotes with no obligation, explain the difference between tiers in plain English, and tell you honestly if a cheaper tier, or a different vendor such as Cisco Secure Endpoint or Check Point Harmony Endpoint, would suit you better.
For a Sophos Intercept X quote, contact us and ask us for a quote.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
How much does Sophos Intercept X cost?
It depends on the tier, the number of users and servers, the term and any add-ons. Sophos sells through partners, so ask us for a quote and we will set out each option in writing.
Is Sophos Intercept X priced per user or per device?
Most customers are licensed per user, with some entitled to per-device licensing. A user with several devices counts once. Servers are licensed separately, per server.
Is Sophos MDR more expensive than XDR?
Yes, because it includes Sophos's 24/7 analysts as well as the technology. Compare it with the cost of staffing out-of-hours security cover yourself, not just with the XDR licence.
Can I pay for Sophos monthly?
Yes, through a managed service provider on Sophos's MSP Flex programme, which bills monthly on usage. A fixed-term subscription is the other option. Not every product reaches MSP Flex at the same time, so we confirm availability when quoting.
Is there a cheaper Sophos option for small businesses?
Sophos Endpoint 100 is a fixed-price Sophos Endpoint offer for organisations with up to 100 users, covering computers and servers. Ask us for a quote and we will confirm whether you qualify.