Sophos MDR Plus Server

Sophos MDR Plus – technology and human expertise

Sophos MDR Plus Server combines the included endpoint and XDR capabilities with a managed security service. Sophos investigates threats around the clock and supports attack response. This variant is licensed per server. Previously called MDR Complete, MDR Plus adds incident response for monitored systems running the full Sophos XDR agent.

An analyst team for servers – 24/7

The service adds a Security Operations Centre (SOC) to your IT team. Alerts receive attention outside your own working hours too. Your team remains responsible for setup, availability and tasks outside the agreed service scope.

What Sophos MDR Plus includes

MDR Plus adds incident-response assistance for confirmed incidents. This applies to monitored systems running Sophos XDR; different response limits apply to third-party-only or sensor-only systems. System recovery and on-site work are not guaranteed components of the service.

Investigate detections around the clock

The MDR team reviews relevant detections, correlates related activity and initiates the appropriate response. Alerts receive expert assessment rather than simply being forwarded.

Proactive threat hunting

Sophos searches available data for attack indicators and unusual relationships. Proactive threat hunting is included in MDR and MDR Plus and complements the investigation of incoming alerts.

Attack detection

Attackers can also use legitimate tools. Analysis combines telemetry and threat intelligence to identify suspicious behaviour in context and prioritise investigations.

Security Health Check

Sophos reviews visible security settings and flags configurations that weaken protection or data collection. Your IT team receives practical starting points for improvements.

Activity reports and case overview

Cases, investigation findings and actions remain visible in the console. Your IT team can trace decisions and completed actions. Available reports depend on your environment’s migration status.

Incident-response contact

For a confirmed incident, MDR Plus provides an incident-response contact. They coordinate with Sophos while your business remains responsible for operational crisis management.

Direct telephone support

If you suspect an attack, you can contact Sophos by telephone around the clock. Both MDR tiers include this access; MDR Plus adds extended incident response.

Bring security data together

Supported data sources give analysts additional attack context. Integrations are included in both MDR tiers and must be configured for your environment.

Improve security configuration

Recommendations help address weaknesses in visible settings. After incident response, MDR Plus also helps with root-cause analysis and measures to prevent recurring attacks.

Understand the existing environment

Device information and telemetry help establish the affected environment. Sophos Managed Risk is available separately for managed vulnerability management.

Define response permissions and responsibilities during onboarding

Before the service starts, configure reachable contacts, data sources and response permissions. The selected mode determines which actions Sophos may take; the subscribed tier determines their scope.

Notify Only

Sophos reports suspicious activity. Containment actions are not performed in this mode. For active response, Sophos recommends Collaborate or Authorize.

Collaborate

Sophos investigates the case and agrees response actions with your authorised contacts. An additional setting can permit action when your contacts cannot be reached.

Authorize

Sophos may perform agreed response actions without asking for approval each time and informs you of the actions taken. Scope and technical capabilities still depend on the tier, configuration and supported systems.