In short: Sophos Next-Gen SIEM is a paid add-on for Sophos XDR and Sophos MDR, generally available to new term customers since August 2026. It adds custom AI-assisted integrations and parsers, compliance dashboards and 13 months of data retention as standard, extendable to 3, 5, 7 or 10 years. It is priced per user and server, not by data volume.
What is Sophos Next-Gen SIEM?
A traditional security information and event management (SIEM) system collects logs from everything, keeps them for a long time and lets you search and report on them. It is also often expensive, because most SIEMs charge by the amount of data you send, and hard to run.
Sophos Next-Gen SIEM takes a different route. It is an extension of Sophos XDR and Sophos MDR, not a separate console. The detection, investigation and response work stays in XDR; Next-Gen SIEM adds the things auditors and regulators ask for: more data sources, longer retention and compliance reporting.
It is part of Sophos Fusion and became generally available to new term (non-MSP) customers at the end of August 2026, alongside the enhanced Sophos XDR Powered by Secureworks and Sophos MDR (see Secureworks Taegis, now part of Sophos). It is available to customers on those enhanced XDR and MDR solutions.
What Next-Gen SIEM adds
| Capability | Detail |
|---|---|
| Long-term retention | 13 months as standard, with add-ons to extend to 3, 5, 7 or 10 years |
| Included integrations | The third-party integrations that already come with Sophos XDR |
| Custom integrations | AI-assisted ingestion for sources not supported out of the box, such as legacy systems, regional tools and in-house applications |
| Custom parsers | AI parsers normalise raw data without custom code, so the new sources can be searched and reported on with the rest |
| Compliance dashboards | Built-in dashboards, such as one for ISO 27001; Sophos says it is designed to help with frameworks including ISO 27001, PCI DSS, SOC 2, HIPAA and GDPR |
Sophos describes these as helping you meet framework requirements, not as a certification in themselves: you still need your own controls, policies and evidence. Plan your log sources early, because the way each source is collected affects what you can keep and report on.
Licensing and eligibility
- Add-on only: Next-Gen SIEM cannot be bought on its own; you need Sophos XDR or Sophos MDR (either MDR tier)
- Enhanced platform: it is available to customers on the enhanced XDR and MDR solutions in Sophos Fusion; existing customers are upgraded in phases
- Per user and server: pricing is based on users and servers, not gigabytes ingested, and Sophos says there are no ingestion-based fees
- Retention options: retention can be extended beyond the standard 13 months to 3, 5, 7 or 10 years
- Availability: generally available to new term (non-MSP) customers first, with MSP availability planned to follow
Because the price does not rise with data volume, you can collect the logs you actually need rather than filtering them down to stay inside a budget. Ask us for a quote based on your user and server counts and the retention you need.
SIEM vs XDR: do you need both?
| Sophos XDR | Sophos XDR + Next-Gen SIEM | |
|---|---|---|
| Main purpose | Detect, investigate and respond to threats | The same, plus compliance evidence and long-term log retention |
| Data sources | Sophos products and included third-party integrations | Adds custom integrations and parsers for other sources |
| Retention | Standard XDR retention | 13 months, extendable up to 10 years |
| Reporting | Security operations dashboards | Adds compliance dashboards and reports |
| Console | Sophos Fusion | Sophos Fusion (no separate SIEM console) |
If your only goal is catching and stopping attacks, XDR (or MDR) may be enough. Next-Gen SIEM earns its place when you must prove things months or years later: who logged in, what changed, which firewall rule allowed a connection.
UK compliance context
UK organisations rarely have a single law that says "keep logs for X years", but several obligations push in that direction:
- UK GDPR requires you to show accountability and to investigate personal data breaches; good logs are what make that investigation possible
- NCSC guidance on logging and monitoring encourages organisations to collect and keep security logs so incidents can be detected and investigated
- Contracts and frameworks such as ISO 27001, PCI DSS and supplier security schedules often set their own retention expectations
- Cyber insurance claims usually need evidence of what happened and when
Cyber Essentials does not require a SIEM, but many organisations that hold Cyber Essentials go on to frameworks that do expect central logging. For help choosing a retention period, talk to your compliance lead and to us.
How we help
We will check which of your current log sources Sophos XDR already covers, identify which need custom integrations, recommend a retention period and set up the compliance dashboards you need. If you are replacing an existing SIEM, we will plan the overlap so you do not lose history.
Contact us for a quote.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Sophos Next-Gen SIEM?
It is a compliance-focused add-on for Sophos XDR and Sophos MDR that adds long-term data retention, custom integrations and parsers, and compliance dashboards and reports, all within Sophos Fusion.
How long does Sophos Next-Gen SIEM keep data?
Sophos says 13 months is included as standard, with options to extend retention to 3, 5, 7 or 10 years.
How is Sophos Next-Gen SIEM priced?
Per user and per server rather than by the volume of data ingested, with no ingestion-based fees. Ask us for a quote.
Can I buy Sophos Next-Gen SIEM without XDR or MDR?
No. It is only available as an add-on to Sophos XDR or Sophos MDR.
What is the difference between SIEM and XDR?
XDR focuses on detecting and responding to threats using correlated security data. SIEM focuses on collecting and keeping logs from many sources for search, compliance reporting and investigation over long periods. Sophos Next-Gen SIEM adds SIEM capabilities to Sophos XDR rather than running as a separate system.