In short: A Sophos incident response retainer is a subscription that lines up Sophos's DFIR responders before you need them. The Incident Response Services Retainer gives on-demand access, a discount on emergency response, an external vulnerability scan and a health check. The broader Security Services Retainer adds prepaid Service Units for testing and readiness, plus guaranteed DFIR access with defined response commitments.
What is a Sophos incident response retainer?
When a serious incident hits, the first hours are often lost to paperwork: finding a responder, agreeing a contract and scope, approving costs and getting tools deployed. A retainer does that work in advance. You pay a subscription, and if something happens you engage Sophos Emergency Incident Response on terms already agreed.
Sophos has two related products:
- Sophos Incident Response Services Retainer: a subscription focused on emergency response, with on-demand access to Sophos's responders, a discount on emergency response services and a set of preparedness extras. Sophos says it is open to all organisations, whether or not they already use Sophos
- Sophos Security Services Retainer: the wider model Sophos now promotes on sophos.com, combining prepaid Service Units for proactive and readiness services with access to Sophos DFIR experts, defined response commitments and pre-negotiated rates
Both are about being ready. Neither is a monitoring service: for 24/7 detection you still need Sophos MDR or your own team with Sophos XDR.
What the Incident Response Services Retainer includes
Sophos's retainer announcement and service description list:
- On-demand access to Sophos's incident response experts, with Sophos committing to respond within hours of a written engagement request
- A predefined discount on Sophos's emergency incident response services, so rates are settled before an attack
- An external vulnerability scan of your internet-facing IP addresses, up to the limit of the tier you buy
- An endpoint configuration health check and device audit for existing Sophos customers, with remediation steps for anything found
- Preparedness guidance, plus access to a Sophos MDR ThreatCast threat intelligence webinar
The discounted response itself is scoped when an incident occurs. Sophos's published service description for this retainer has not been revised for some time, and inclusions can change, so we confirm the current terms in writing when we quote.
The Sophos Security Services Retainer
Sophos's current Security Services Retainer service description (revised August 2026) sets out a prepaid model in four levels, plus a Standalone DFIR Retainer for those who only want emergency cover:
- Prepaid Service Units, all issued at the start of the term and redeemable for services in Sophos's Security Services Retainer catalogue, such as Red Team engagements, incident response tabletop exercises, internal penetration tests and password cracking
- DFIR access with defined response commitments: initial response and engagement-start commitments get faster at each level, with service credits if Sophos misses them
- Conversion to DFIR hours: at Levels 2 to 4, Service Units can be converted into DFIR hours; Level 1 customers need the Standalone DFIR Retainer alongside it
- Pre-negotiated rates for additional DFIR hours and additional Service Units
- On-site support: available with the Standalone DFIR Retainer and Levels 2 to 4, with an on-site response commitment at Levels 3 and 4 in supported locations, which include the UK
- Extras at Levels 3 and 4: a named services liaison, quarterly reviews and status reports, and an annual executive briefing
Two points to plan for: unused Service Units expire at the end of the term without refund, and Sophos must deliver all services within the term, with several weeks' notice needed to schedule them. We help customers plan their readiness work through the year so the units are used, not wasted.
Retainer vs Sophos MDR Plus
Sophos MDR Plus already includes full-scale incident response on monitored endpoints, so do you need both? Often not, but the scopes differ.
| Sophos MDR Plus | Incident response retainer | |
|---|---|---|
| 24/7 monitoring and threat hunting | Yes | No |
| Incident response | Included, remote, on monitored endpoints, no hourly caps | Pre-agreed, discounted emergency response |
| Systems without Sophos agents | Guidance only | Can be in scope of an engagement |
| On-site responders | No | Available (depending on retainer level and location) |
| Ransom negotiation | No | Through Emergency Incident Response |
| Proactive testing and assessments | Health checks | Vulnerability scan and health check, or Service Units for testing and exercises |
| Breach Protection Warranty | Included | No |
When a retainer suits better
- You are not on Sophos MDR, for example you run another vendor's EDR or have your own SOC, but want a named responder lined up
- Your insurer, auditor or board asks for a pre-arranged incident response provider as part of your incident plan
- You want on-site support, forensics or negotiation that MDR Plus excludes
- You want regular testing and assessments, and would rather buy them from one prepaid budget
- You are on Sophos MDR (not Plus) and want a defined route for the full response once Sophos has contained an attack
Check whether your cyber insurance policy names its own panel responder; if it does, confirm with your insurer that a Sophos retainer is acceptable or how the two would work together.
How we help
We will compare a retainer against MDR Plus for your situation, confirm the current inclusions in writing, and build the retainer into your incident plan so your team knows exactly how to trigger it. We also help schedule the readiness services so they align with your Cyber Essentials cycle or audit dates.
Retainer pricing depends on the level and term: contact us and ask us for a quote.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is an incident response retainer?
It is a subscription that secures access to an incident response team on pre-agreed terms before you need it, so response can start quickly without contract negotiations during an attack.
What does the Sophos Incident Response Services Retainer include?
On-demand access to Sophos's incident responders, a predefined discount on emergency incident response, an external vulnerability scan, an endpoint health check and device audit for Sophos customers, preparedness guidance and a threat intelligence webinar. We confirm the current inclusions when we quote.
Do I need a retainer if I have Sophos MDR Plus?
Not always. MDR Plus includes full-scale remote incident response on monitored endpoints. A retainer can still help if you need on-site support, forensic work, ransom negotiation or coverage for systems without Sophos agents, or if your insurer asks for one.
What is the Sophos Security Services Retainer?
It is Sophos's broader retainer, sold in four levels with prepaid Service Units that can be spent on services such as Red Team engagements, tabletop exercises and penetration tests, plus access to Sophos DFIR with defined response commitments and pre-negotiated rates. A Standalone DFIR Retainer covers emergency response only.
Do unused Sophos Service Units roll over?
No. Under Sophos's current service description, unused Service Units expire at the end of the subscription term, so it pays to schedule services during the year.