From£10
Detect and respond

Extended detection & response (XDR)

Sophos XDR (extended detection and response) from TriplePoint joins up what your devices, firewall, email, cloud and identity systems see into one picture. Attacks rarely stay in one place. See what's happening across your devices, firewall, email, cloud and identity together, so the pieces add up.

Per user, per month, excluding VAT.

Ask us about this
The risk

A typical attack crosses several systems: a phishing email, a stolen password, a sign-in from somewhere unusual, then a laptop running something it shouldn't.

Each security tool sees only its own piece, and on its own each piece might not look worth an alert.

What it does
  • Brings together detections from devices, servers, firewalls, email, network, cloud and identity
  • Works with more than 500 third-party tools, including Microsoft, CrowdStrike and Palo Alto Networks
  • Groups related activity into prioritised cases, so an attack across several systems shows up as one story
  • An AI assistant that answers questions in plain English
  • More than 130 ready-made automated response playbooks
  • Everything in EDR, included
Who it's for

Businesses with an IT team, or an IT provider, looking after several security tools, including ones from other vendors, who want to investigate across all of them in one place.

How we supply it

XDR is part of our five protection tiers, so you sign up for it online rather than buying it as a separate licence. If you already have AV-only or EDR, moving up is a live change to your account. If you'd rather not run it yourselves, MDR puts a 24/7 team on the same data.

What's under the hood

Sophos XDR - includes Sophos Endpoint and Sophos EDR, and feeds the same data to Sophos MDR if you'd rather hand the watching over.

Questions
EDR looks at devices. XDR looks across devices, firewall, email, cloud and identity together, so it can connect events that each look harmless on their own.
No. It works with a wide range of other vendors' tools too.
If you have someone in-house with the time to investigate, yes. If not, MDR usually makes more sense: the same visibility, with someone else doing the watching.

< Back to Detect and respond

Not sure what you need?

Tell us a little about your business and we'll recommend the controls that will work best for you, with no obligation and no jargon.

Talk to us
or
See every security area

Our experts spent 20 years at Sophos and include a certified ethical hacker.
More about us

Ask us about this