Sophos MDR Pricing: Tiers, List Prices and Year-One Cost

Sophos MDR is a managed detection and response service priced per user and per server in two tiers, Sophos MDR and Sophos MDR Plus. Sophos does not publish dollar figures, but its resellers do. Reseller list prices are a starting point for negotiation, and they answer most of what a buyer needs to know before a quote arrives.

The same product can carry three names on one deal: a legacy SKU code such as MDRCEU12AFNCAA on the quote, "MDR Plus" in the proposal, and "Complete" on a reseller catalog page. Sophos renamed its tiers in August 2026, but much of the pricing information online still uses the retired names. The same list shows whether the multi-year discount that third-party pricing guides describe exists at all, and where year-one cost comes from before any negotiation starts.

TL;DR:

• Sophos sells two MDR tiers, Sophos MDR and Sophos MDR Plus. The old names still appear in SKU codes and some Sophos documentation, so a quote can look like a different product from the proposal.
• Reseller list pricing contains no multi-year discount. Any saving on a longer term is a negotiated concession or a time-limited promotion.
• For small deployments, guided onboarding can cost several times the annual license, and the professional services line then decides year one more than the tier does.
• MDR Plus incident response and the breach warranty follow the Sophos XDR agent. Hosts running third-party EDR get no full incident response, and a single one of them takes the whole estate out of warranty.

How Sophos Prices MDR

Sophos prices MDR per user and per server on annual terms, and its pricing page promises "simple per-user and per-server pricing with no hidden extras." The page then routes to a sales form without a dollar figure. Per-user billing is one of several common MDR pricing models, and Sophos pairs it with a separate per-server rate. Sophos's MDR Plus documentation adds that "there are no warranty tiers, minimum contract terms, or additional purchase requirements," and reseller price bands start at a single seat.

The Sophos Community FAQ publishes the rename mapping, "Sophos MDR Essentials → Sophos MDR" and "Sophos MDR Complete → Sophos MDR Plus," effective August 2026 for new and existing customers. Distributor Avanet reported the same change and advised updating quotations to match. The service description, revised September 18, 2026, uses only the new names.

The old names still appear on the paperwork. SKU codes kept their legacy prefixes, and Sophos's partner guidance says "SKU codes remain unchanged." On a quote, MDRE0U is Sophos MDR per user, MDRCEU is MDR Plus per user, MDRS0S is MDR per server and MDRCSS is MDR Plus per server. Some Sophos documentation links still say "Complete" as well, including the MDR Plus tier page and the breach warranty.

Both tiers offer the same three threat response modes. Under Authorize, Sophos acts and then notifies you, while under Collaborate it takes no response action without written consent. Under Notify Only, it investigates and hands over remediation guidance, and the service description warns that this mode "can materially delay containment." The mode does not change the license price, but it does decide whether the MDR Plus warranty applies, covered below.

What the Published List Prices Show

EnterpriseAV, an authorized Sophos reseller, publishes twelve user bands and eight server bands for each tier, which puts more of Sophos's pricing in public view than many MDR vendors allow; Arctic Wolf, for example, publishes no commercial list price. The representative user rows below come from its MDR user and MDR Plus user pages as one-year new-license list prices, and renewals list at the same price as new licenses.

‍

Server licenses sit on a separate SKU family, and EnterpriseAV's MDR server and MDR Plus server pages list them on the same one-year basis.

‍

Volume discounts are steep: from the smallest band to the largest, list prices fall 48% for MDR per user, 52% for MDR Plus per user, 55% for MDR per server and 59% for MDR Plus per server. The MDR Plus premium is 66% at the smallest user band, 74% at 200 to 499 users and 53% at 20,000+. On base MDR, a server lists at about 1.8 times a user at the smallest band and under 1.5 times from 10 seats up; on MDR Plus, the multiple falls from about 1.6 to 1.3 or less. Another reseller, firewalls.com, shows the same $110.24 at the 200 to 499 MDR user band.

Why a Three-Year Term Costs Exactly Three Times One Year

EnterpriseAV publishes 12-, 24- and 36-month SKUs at the same bands, and the three-year list price is exactly three times the one-year price. MDR at 200 to 499 users lists at $110.24, $220.48 and $330.72; MDR Plus at that band lists at $191.76, $383.52 and $575.28. The reseller's discounted "Our Price" figures hold the same ratio to within a cent.

Third-party guides describe discounts that the list does not show. Vendr reports "15-25% lower annual pricing" for multi-year contracts that bundle several Sophos products, which is a negotiated outcome, and the mdrcost pricing page has withdrawn the multi-year percentages it once published. The one published three-year saving is time-limited: an MDR promotion offering 25% off three-year MDR and MDR Plus subscriptions for organizations under 500 seats, on new, expansion and renewal orders, with an end date of September 30, 2026.

What a Real First-Year Quote Looks Like

A 250-user, 40-server organization buying MDR Plus with guided onboarding lands at $66,940.80 in year one at reseller list. The math: 250 users at the 200 to 499 band ($191.76) is $47,940.00; 40 servers at the 25 to 49 band ($287.52) is $11,500.80; and MDR Guided Onboarding, SKU PRPE0A00ZZPCAA, is $7,500 on the EnterpriseAV services list. Year two drops onboarding and, if the organization stays in band, repeats the $59,440.80 license total.

The same organization on base MDR pays $27,560.00 for users and $7,601.60 for servers, $35,161.60 in licenses, so the tier decision alone is worth $24,279.20 a year.

At the small end, onboarding outweighs the license. Ten users on base MDR at the 10 to 24 band cost $1,362.10 a year, and the same onboarding package, if Sophos sells it at that size, costs five and a half times that.

The Line Items That Inflate Year One

Guided onboarding is a published, discretionary cost. Sophos's services catalog, updated July 2026, now titles the package for mid-market organizations of 251 to 1,000 users, lists MDR integrations and NDR sensor implementation as its second phase, and pairs it with an Enterprise package, SKU PRPN0A00ZZPCAA, that EnterpriseAV lists at $14,990. The same page describes it as intended for organizations under 1,000 users. Whether smaller buyers are offered it, or required to take it, is a question for the quote.

The service description states that Service Software "must be deployed on at least eighty percent (80%) of licensed volume" and that Sophos "reserves the right to suspend Service delivery" until you comply. It says nothing about billing for seats where the agent is not yet running, so assume you pay for every licensed seat and ask for the quote to state it.

Sophos announced its Sophos Fusion platform on July 15, 2026, and existing MDR customers gain its new capabilities inside their current subscriptions. The Fusion launch also brought three add-ons. A new SIEM add-on became available August 15, 2026, and Sophos says it is priced "based on users and servers, with no ingestion-based charges," which takes log volume, one of the usual drivers of SOCaaS quotes, off this line item. EnterpriseAV lists the SIEM add-on at $71.93 per license a year at the 200 to 499 users-and-servers band, which would add $20,859.70 a year to the 250-user, 40-server example.

AI Defense has run in early access since August, with general availability expected in October 2026, and CISO Advantage is due the same month. Neither has published pricing.

Integration costs moved the other way. Since November 2025, all Sophos MDR and XDR subscriptions include third-party technology integrations "at no additional cost," according to the Sophos announcement, and the standalone integration pack licenses were retired. The MDR product page now advertises more than 500 included integrations. Older guides that say non-Sophos telemetry costs extra no longer apply.

Two Packaging Details That Change the Math

Both change what a license covers, and Sophos's marketing pages blur both.

Taegis Is a Separate Product Line

Sophos Taegis products, which came with the Secureworks acquisition completed in February 2025, are a separate line from Sophos MDR. Sophos's Taegis page says Sophos Endpoint is "automatically included in all Taegis XDR and Taegis MDR subscriptions." Do not carry that bundling across to a Sophos MDR quote. The deployment rules differ too: the Taegis service description treats 40% of licensed volume as the point where onboarding ends, while Sophos MDR sets 80% as the floor for continued service.

MDR Plus Incident Response Follows the Sophos XDR Agent

The September 18 service description says MDR Plus incident response "applies only to Incidents affecting Monitored Endpoints running Sophos XDR." The clause reflects how the product is built: Sophos XDR is the detection platform and MDR is the managed service on top. Endpoints running a supported third-party EDR product that send telemetry to Sophos Fusion without a Sophos agent are "Agentless Third-Party Endpoints," and on those, "Response Action means host isolation and host un-isolation only."

The Breach Protection Warranty stacks on the same dependency. It attaches to MDR Plus only, requires MDR Plus agents on "all endpoints and servers," and applies only when the response mode is set to Authorize or to "Collaborate with authorize," not to "Notify only" or "Collaborate."

What Sophos Does Not Publish, and Why That Matters

Sophos's service description does not say whether the MDR license includes the Sophos Endpoint agent. Resellers suggest it does: EnterpriseAV's listing says MDR "includes Intercept X Advanced with XDR." Because full incident response depends on the agent, get any inclusion written on the quote. The endpoint product names have moved as well: the endpoint portfolio refresh of October 2025 folded Intercept X Advanced and its server edition into the Sophos Endpoint name, and Intercept X Essentials stopped taking new orders November 1, 2025.

The order schedule, the contract document you see at quote stage, holds the auto-renewal, renewal escalator, notice period and co-terming terms, none of which appear on Sophos MDR pages. Vendr's figure of 5% to 15% annual renewal increases is a third-party estimate, not a contract term.

The right tier and term depend on the fleet and the deal:

• If every endpoint and server runs Sophos XDR, then the MDR Plus premium buys incident response everywhere and the warranty, provided the response mode qualifies and the account health check is clean.
• If most hosts run third-party EDR, then base MDR delivers nearly everything MDR Plus would on those hosts, and the warranty is off the table.
• If you are a small organization, then price the onboarding line before comparing tiers.
• If a rep is pushing a 36-month term, then ask for the concession as a named line on the quote.

Before any of these, count how much of the fleet runs the Sophos agent, because the tier decision rests on that number.

How Daylight Prices Against This

Daylight does not publish list prices either. It quotes case by case, and on price it sits between AI SOC tooling and traditional MDR bundles. Buyers shopping on the per-seat rate alone will find cheaper options.

Daylight is a MASS company, meaning it offers managed agentic security services for Security Operations. Its AI-native MDR service is the entry point, alongside threat hunting and the Agentic Security Data Lake.

A Sophos quote ties its fullest response tier and its warranty to the Sophos agent. Daylight investigates alerts from the security tools a customer already runs, plus its own detection rules on streaming log data, and its bi-directional integrations let it take response actions and close resolved alerts in those same tools. Scope is set by the integrations in the contract, so a fleet on several EDR vendors can be covered without replacing endpoint agents. How response works on a mixed fleet is the question worth putting to any MDR provider at quote stage.

The fit has limits. Organizations running mostly on-premises infrastructure may see less benefit, and full value arrives only after the three- to five-month context-building period that follows onboarding. Mature in-house SOCs looking for a co-managed model are usually better served elsewhere.

Frequently Asked Questions About Sophos MDR Pricing

Does the Competitive Upgrade SKU Change the Math?

Yes, by about 15% on the first subscription. SKUs with the NCCU suffix, for buyers displacing a competing product, list at $122.60 per user for base MDR at the smallest band and $93.70 at 200 to 499 users, and at $203.69 and $163.00 for MDR Plus. Renewal SKUs carry standard list pricing, so expect the discount to fall away at renewal unless it is negotiated into the renewal terms. The competitive upgrade is the only standing discount in the published reseller list beyond volume bands.

Does XDR Sensor Satisfy the MDR Plus Incident Response Clause?

No. The service description counts XDR Sensor hosts as Monitored Endpoints, but the sensor is not full Sophos XDR, which is what the incident response clause names. Deploying the sensor over third-party EDR keeps investigation and isolation on those hosts without extending full incident response to them.

How Long Does Sophos MDR Retain Data?

Standard data storage is 90 days on both tiers, according to Sophos's MDR tier documentation, and one-year extended storage is sold as an add-on license with no published price. Retention beyond that is also available through the SIEM add-on, which keeps 13 months as standard and extends to 3, 5, 7 or 10 years.

What Does the $1M Warranty Actually Pay Out?

Usually far less than $1M. The warranty caps reimbursement at $1,000 for the lesser of each fully paid-up license or each breached endpoint, with $1M as the annual ceiling. A breach touching a few dozen endpoints therefore caps out in the tens of thousands. It also excludes any breached endpoint whose Account Health Check score was below 100 at the time of the incident.