In short: Sophos MDR Plus is the higher of Sophos's two MDR tiers and the new name for MDR Complete. It includes everything in Sophos MDR, adds full-scale incident response with no hourly caps, a dedicated incident response lead and root cause analysis, and includes the Sophos Breach Protection Warranty at no extra charge.
What is Sophos MDR Plus?
Every Sophos MDR customer gets 24/7 monitoring, threat hunting and containment. The difference with Sophos MDR Plus is what happens after an attack is confirmed. In the standard tier, Sophos stops the attack and limits its spread, then gives you guidance on how to neutralise it yourself. In MDR Plus, Sophos carries out the full incident response on monitored endpoints and makes sure the threat is fully eliminated, not just contained.
Sophos's MDR page describes this response as having no hourly caps and no extra fees. For a small or mid-sized organisation, that addresses two common worries during a breach: not having the skills to finish the clean-up, and not knowing what an emergency responder will cost.
What MDR Plus adds to Sophos MDR
Under Sophos's service description, MDR Plus includes everything in Sophos MDR plus:
- Full-scale incident response, performed remotely, covering triage and investigation, an incident timeline where feasible, containment, recommendations, an incident summary and a post-incident health assessment
- A dedicated incident response lead (called an Incident Response Advisor in the service description): a single point of contact who coordinates and communicates during the response, without taking over management of your organisation's overall response
- Root cause investigation, so you learn how the attacker got in and can close that route
- Threat removal, with Sophos working to remove the adversary completely from monitored endpoints rather than only containing it
- The Sophos Breach Protection Warranty, included at no additional charge, subject to Sophos's terms
All the standard MDR features carry on underneath: 24/7 monitoring, threat hunting, direct call-in access to Sophos's MDR operations team, health checks, 90 days of data storage, Microsoft 365 integrations and the included third-party integrations.
Sophos MDR vs Sophos MDR Plus
| Sophos MDR (formerly MDR Essentials) | Sophos MDR Plus (formerly MDR Complete) | |
|---|---|---|
| 24/7 monitoring and threat hunting | Yes | Yes |
| Containment (for example isolating hosts, disabling accounts) | Yes | Yes |
| After containment | Guidance for your team to complete the response | Sophos performs full-scale incident response |
| Hourly caps on incident response | Not applicable | No hourly caps |
| Dedicated incident response lead | No | Yes |
| Root cause analysis | No | Yes |
| Post-incident health assessment | No | Yes |
| Breach Protection Warranty | No | Included |
| Data storage | 90 days (extension available) | 90 days (extension available) |
| Sophos NDR | Add-on | Add-on |
Which should you choose? If you have an IT team that can rebuild systems, reset credentials and work through a remediation plan under pressure, Sophos MDR may be enough. If you would struggle to handle a confirmed breach on your own, or your board or insurer wants a defined incident response route, MDR Plus is usually the better fit.
What MDR Plus incident response does not cover
It is worth knowing the edges before you need them. Sophos's MDR service description sets out that MDR Plus incident response:
- Applies to incidents on monitored endpoints running Sophos's agent; containment and recovery on other systems remain your responsibility, with Sophos giving remediation guidance
- Is delivered remotely; on-site services are excluded
- Excludes decryption, disk-level forensic imaging, system restoration and recovery, ransomware negotiation, e-discovery and litigation support, regulatory or breach-notification guidance, dark web monitoring and formal chain-of-custody documentation
- Can be handed over to a third-party DFIR firm if you ask in writing, for example one appointed by your insurer; Sophos shares its findings and then ends its own response
If you need on-site responders, forensic work for legal purposes or ransom negotiation, those sit with Sophos Emergency Incident Response or an incident response retainer. Backups and recovery remain your job too, which is why we always review cloud backup alongside MDR Plus.
From MDR Complete to MDR Plus: what changed
In 2026 Sophos renamed its MDR tiers: MDR Essentials became Sophos MDR and MDR Complete became Sophos MDR Plus, alongside the move from Sophos Central to Sophos Fusion. The rename did not take incident response out of the top tier: MDR Plus keeps the full-scale incident response, the dedicated lead, root cause analysis and the warranty that MDR Complete customers relied on.
You may still see the old name in places. Some Sophos page titles and URLs still say MDR Complete, and older quotes may too. Sophos kept the same product codes, so an existing MDR Complete subscription carries on under the new name. Use your next renewal to check your user and server counts, your response mode and whether add-ons such as Sophos NDR, Sophos ITDR or Sophos Next-Gen SIEM now make sense. Our Sophos licensing guide lists all the recent renames.
How we help with Sophos MDR Plus
MDR Plus is licensed per user and per server, as a term subscription or monthly through MSP Flex. We do not publish prices: contact us and ask us for a quote, whether you are buying new, moving up from Sophos MDR or renewing MDR Complete.
- Side-by-side quote for Sophos MDR and MDR Plus, so you can see the difference for your own counts
- Deployment to every endpoint and server, which matters both for coverage and for warranty eligibility
- Response mode, contacts and escalation set-up agreed with your management team
- An incident plan that covers what Sophos does, what you do and what your insurer expects
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Sophos MDR Plus?
Sophos MDR Plus is the top tier of Sophos Managed Detection and Response. It includes 24/7 monitoring, threat hunting and containment, plus full-scale incident response, a dedicated incident response lead, root cause analysis and the Breach Protection Warranty.
Is Sophos MDR Complete still available?
MDR Complete has been renamed Sophos MDR Plus. Sophos kept the same product codes, so existing MDR Complete subscriptions continue under the new name.
Does Sophos MDR Plus include incident response?
Yes. MDR Plus includes full-scale remote incident response on monitored endpoints with no hourly caps. The standard Sophos MDR tier contains threats and gives you guidance, but you complete the response.
Does MDR Plus include ransom negotiation or on-site responders?
No. Sophos's service description excludes ransomware negotiation and on-site work from MDR Plus. Both are available through Sophos Emergency Incident Response.
Is the Breach Protection Warranty included with MDR Plus?
Yes, at no additional charge, provided you meet the conditions in Sophos's warranty terms, such as deploying to all endpoints and servers and using an eligible threat response mode.