In short: The Sophos Breach Protection Warranty is included at no extra charge with Sophos MDR Plus. If a qualifying breach occurs on a properly deployed and configured estate, it contributes towards response expenses such as legal fees, notification, public relations, regulatory fines and, within a separate limit, ransom payments. It is not an insurance policy.
What is the Sophos Breach Protection Warranty?
The warranty is Sophos's commitment to share some of the cost of a breach that happens despite Sophos MDR Plus being in place. It comes with an MDR Plus subscription at no additional charge and covers certain expenses that typically follow a data breach.
The amount Sophos will pay is limited per licence or breached endpoint, with an annual aggregate cap, a separate per-claim sub-limit for ransom payments and a minimum level of out-of-pocket expenses before a claim can start. We do not reproduce the figures here, because Sophos sets them and can modify, suspend or cancel the warranty on written notice: only the current version on Sophos's legal website applies to a claim.
The warranty sits alongside the service rather than replacing it. Its real value is that it puts a vendor commitment behind the MDR Plus response, and the conditions are, in effect, a checklist of good security hygiene.
Who is eligible
- MDR Plus customers only. The standard Sophos MDR tier (formerly MDR Essentials) does not include the warranty.
- A current, fully paid subscription with a supported Sophos product correctly installed. Breaches in the first 60 days of a subscription are not covered, and the terms require at least 12 months of continuous subscription with no lapse.
- Not for MSP-delivered subscriptions under the standard terms. The standard warranty excludes managed service providers and their customers; Sophos publishes a separate MSP version of the MDR Plus warranty, so check which terms apply to your contract. We will confirm this when we quote.
- One claim per customer, even if you hold more than one subscription. The warranty cannot be transferred, and only the customer can claim.
Conditions you must meet
Whether a claim succeeds depends heavily on how the estate was set up and maintained. Sophos's terms require, among other things:
- Full deployment: the Sophos agent installed on all endpoints and servers, without deploying beyond your licence count
- An eligible threat response mode: Authorize or Collaborate then Authorize. Notify Only and Collaborate on its own are not eligible
- A perfect health score: an Account Health Check score of 100 in Sophos Fusion (formerly Sophos Central) at the time of the incident, with products correctly installed and malware scanning left switched on
- Supported operating systems: current releases supported by Microsoft or Apple; Windows 10 is covered only while you hold Microsoft's Extended Security Updates for it
- Timely patching: vulnerabilities fixed within set timescales according to severity (the most critical within days), including any required reboots
- Basic hygiene: backups in line with good practice, basic phishing awareness training for users, and enforced multi-factor authentication, complex passwords and automatic time-outs on remote management tools
These are sensible controls in their own right, and several overlap with Cyber Essentials. We can review them as part of onboarding and keep them in check, together with staff phishing awareness training and cloud backup.
What it covers, and what it does not
| Covered expense types (subject to limits) | Examples of exclusions |
|---|---|
| Reasonable legal fees | Data that can be restored from backup |
| Notifying affected individuals | Incidents caused by unpatched vulnerabilities or unprotected devices |
| Public relations costs | Virtual desktop environments, hypervisors and out-of-band management interfaces |
| Regulatory fines | Third-party products that cause the Sophos product to malfunction, acts of God, war, terrorism or suspected state-sponsored attacks |
| Ransom payments, within a separate limit | Payments to sanctioned or otherwise unlawful recipients, or any payment prohibited by law |
| Breaches after Sophos had already notified you of an incident, detection or unremediated gap, or where shared credentials were the way in |
Expenses must be approved by Sophos in writing before you incur them, including the vendors and rates you use, and VAT and other recoverable taxes are not covered. This is a summary, not legal advice: the warranty terms on Sophos's website are the only authoritative source.
How a claim works
The deadlines are short, so the process belongs in your incident plan. At the time of writing, Sophos's terms say:
- Report the potential breach by opening an MDR case with Sophos as soon as reasonably practicable and within 24 hours.
- Confirm in writing that you intend to claim, using Sophos's web form, within 5 days.
- Submit full claim details through Sophos's claim process within 15 days.
- Get approval before spending: Sophos must agree the costs, vendors and rates in advance, and can exclude its competitors as vendors.
- Send all invoices within 2 months and cooperate with Sophos's investigation.
Check the current terms for the exact timescales. If we support your Sophos estate, we will help you log the case and gather the evidence. Bear in mind that the warranty pays towards costs; the response itself comes from the MDR Plus team, and anything outside its scope, such as on-site work or ransom negotiation, sits with Sophos Emergency Incident Response.
Breach Protection Warranty vs cyber insurance
The warranty states that it is not a contract of insurance, and it is void anywhere it would be treated as insurance. It is governed by the law of England and Wales, with disputes going to arbitration in London. In practice:
| Breach Protection Warranty | Cyber insurance | |
|---|---|---|
| Who provides it | Sophos, as part of MDR Plus | An insurer, through a broker |
| Extra cost | None beyond MDR Plus | A separate premium |
| Scope | Specific breach response expenses, within limits | Usually broader: business interruption, third-party liability, incident response panels and more, depending on the policy |
| Conditions | Sophos deployment, configuration and hygiene requirements | Underwriting questions and policy terms |
Treat the warranty as a complement to cyber insurance, not a replacement. Running a 24/7 MDR service often helps when answering insurers' questions about monitoring and response, but only your broker and insurer can say what that means for your cover. Tell your insurer which responder you would use, because some policies require their own panel firm; MDR Plus allows incident response to be handed to a third-party DFIR firm.
Contact us if you would like a quote for MDR Plus or a review of whether your current Sophos set-up would meet the warranty conditions.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the Sophos Breach Protection Warranty?
It is a warranty included with Sophos MDR Plus that contributes towards certain response expenses, such as legal fees, notification, PR, regulatory fines and ransom payments, if a qualifying breach occurs. It has eligibility conditions and limits set out in Sophos's terms.
How much does the Sophos warranty cover?
Cover is limited per licence or breached endpoint, with an annual aggregate cap, a separate limit for ransom payments and a minimum claim threshold. Sophos publishes the amounts in its warranty terms, which can change, so check the current version on Sophos's legal website.
Is the Sophos Breach Protection Warranty included with Sophos MDR?
No. It is included only with Sophos MDR Plus (formerly MDR Complete), at no additional charge.
Is the Sophos warranty the same as cyber insurance?
No. The terms state that it is not a contract of insurance. It covers specific expenses within limits, whereas cyber insurance policies usually cover a wider range of losses. Most organisations should treat it as a complement to insurance.
What could stop a warranty claim being paid?
Common reasons include not having the agent on every endpoint and server, using Notify Only or Collaborate response mode, an Account Health Check score below 100, unpatched vulnerabilities, unsupported operating systems, missing the reporting deadlines, spending without Sophos's prior approval, and data that could have been restored from backup.