Both tiers give you around the clock monitoring, threat hunting, and active threat containment from the Sophos SOC. The difference is who finishes the job. With Essentials, Sophos stops the attack and hands your team a guided plan to clean up, and full incident response is a separate engagement. With Complete, Sophos runs the entire response from start to finish with no hourly caps and includes the breach protection warranty.

It is the same managed detection and response service applied to your servers instead of user endpoints. It is licensed per server rather than per user, and it runs on the same term as your Sophos server protection. Most organizations that run important workloads on servers pair a user tier with a matching server tier.

You need Sophos endpoint or server software that supports MDR on each device you want covered, and MDR licenses include Intercept X Advanced with XDR to provide it. Sophos MDR also supports third-party endpoint protection, so mixed environments running tools like Microsoft Defender or CrowdStrike can still be monitored.

Yes. Sophos runs security operations centers staffed by analysts, threat hunters, and incident responders every hour of every day. When something serious surfaces, MDR Complete carries a 60 minute response target for the large majority of high severity cases.

MDR is licensed per user for endpoints and per server for servers, billed on one, two, or three year terms. Sophos sells it through partners rather than posting a public price, so the right number depends on your device count, tier, and term. As a Sophos Platinum Partner, we can size it and quote it for you.

Yes. MSPs commonly deliver Sophos MDR to their customers through the Sophos Central Partner dashboard, including monthly usage based billing. We work with MSPs on licensing and can help you structure coverage across your client base.

You decide how far Sophos goes ahead of time. At minimum, the SOC investigates, confirms, and contains the threat to stop it spreading. On Complete tiers, Sophos analysts carry the response all the way through neutralization and give you root cause guidance so the same incident does not come back.