From£13
Detect and respond

24/7 managed detection & response (MDR)

Attackers don't keep office hours. Have a team of security analysts watching around the clock, investigating threats and stepping in to contain them.

Per user, per month, excluding VAT.

Ask us about this
The risk

Attackers work nights, weekends and bank holidays, and ransomware is often launched when they know nobody is watching.

Very few small businesses can staff a security team around the clock. Without one, an alert at 2am waits until someone reads it in the morning.

A team gathered round a laptop in the evening, working through an investigation together
What it does
  • 24/7 monitoring by Sophos's security operations teams, including nights, weekends and bank holidays
  • Analysts investigate and contain threats for you, rather than just sending an alert
  • Proactive threat hunting for attackers who haven't triggered an alert yet
  • Regular reporting on threat activity
  • Everything in XDR, included
  • Works with many non-Sophos security tools, including Microsoft, CrowdStrike and SentinelOne
  • MDR Plus adds full incident response with no hourly cap, root cause analysis, a dedicated incident response lead and a breach protection warranty
Who it's for

Businesses without their own security team that want experts on watch around the clock, without hiring them.

How we supply it

MDR is part of our five protection tiers, so you sign up for it online rather than buying it as a separate licence. MDR and MDR Plus are our top two tiers, and you can move up from AV-only, EDR or XDR at any time.

What's under the hood

Sophos MDR — used by more than 40,000 organisations and run by nine regional security operations teams, working from the same Sophos Fusion console as the rest of your protection.

Questions
Both give you 24/7 monitoring, threat hunting and containment. MDR Plus adds full incident response with no hourly cap: the team goes on to remove the threat completely and find the root cause. It also includes a breach protection warranty.
They'll contain an active threat so it can't spread, for example by isolating a device. How much they do without checking with you first is agreed when it's set up.
Yes, for everything that isn't security monitoring: setting up users, fixing printers, installing updates. MDR covers watching for attacks and responding to them.
It's a mix. AI handles a large share of routine cases automatically, which is what makes the response fast, and human analysts investigate the rest.

← Back to Detect and respond

Not sure what you need?

Tell us a little about your business and we'll recommend the controls that will work best for you — no obligation, and no jargon.

Talk to us →
or
See every security area →