Sophos MDR: What does Sophos do, and what stays with you?

At three in the morning, an attacker starts moving through the company network. The security software reports suspicious activity. But who investigates the alert, decides whether to isolate a server and informs the responsible people?

Sophos MDR provides an analyst team around the clock for this purpose. Managed Detection and Response covers detection, investigation and agreed response services. This takes pressure off the organisation’s own IT team. It does not replace their operational responsibility or preparation for an incident.

Originally published in 2022, this article has been revised to reflect the current service. The transition from MTR to MDR remains relevant as historical context; the earlier package overviews are not a current basis for ordering.

What exactly does Sophos take on?

The analysts assess available security alerts, investigate suspicious correlations and handle the incidents that emerge. They use telemetry from the connected systems. Management takes place in Sophos Fusion, formerly Sophos Central.

Depending on the purchased service and granted authority, the team can, for example, isolate a reachable computer, stop a malicious process or use a configured Microsoft 365 response integration to block sign-in and revoke sessions. These are concrete interventions. The corresponding function, technical access and permissions must be available.

An important detail lies in the service scope: the current Sophos documentation on response modes distinguishes between containment and full neutralisation. It assigns the latter to MDR Plus. A general promise such as “MDR fully handles every incident” is therefore not a useful description of the service. The purchased service is what counts.

Can Sophos act immediately?

The company sets a response mode. This decision should be made before the first incident, because an urgent alert does not itself grant authority to act.

With Collaborate, an additional option allows a switch to Authorize after unsuccessful telephone attempts to reach all listed contacts. This option must be explicitly enabled. Without it, the team cannot interpret a lack of contact as consent.

Our guide to setting up MDR contacts and Threat Response explains the settings. At least one authorised primary contact is required. Additional contacts are useful so that holidays, illness or a single switched-off phone do not interrupt the process. Entering a number does not, however, replace an internally organised availability arrangement.

Third parties: seeing data is not the same as intervening

MDR can also incorporate security data from other vendors. Existing products therefore do not all have to be replaced by Sophos. The data an integration supplies and the responses it enables must be checked for the specific product. The guide to MDR/XDR integrations helps with setup and verification.

A data-only connector can provide alerts without being able to block accounts or isolate devices. A response integration requires its own permissions. Likewise, a firewall sending events is not thereby prepared for every response action. On endpoints, the agent, policies and Live Response can determine which investigations and interventions are possible.

A typical example is a compromised Microsoft 365 account: revoking signed-in sessions and blocking further sign-ins can interrupt immediate use. That does not establish all possible consequences. Manipulated forwarding rules, affected business transactions, other access paths and safe re-enablement must be specifically investigated and assigned during the incident. Which steps Sophos can perform again depends on the integration and service scope.

What remains with the customer or IT partner?

The organisation’s own IT team continues to operate the infrastructure. This includes updates, secure configurations, user management, working backups and application recovery. MDR does not make an unpatched server permanently secure or restore encrypted business data from a backup.

Business decisions also remain with the company: which systems may be temporarily unavailable? Who informs management, customers or the insurer? Who assesses reporting obligations and engages any required external support? These tasks need named owners in the incident response plan. The MDR contract alone does not assign them to internal people.

There is still work after containment. The cause needs to be removed, affected access safely restored and recommended configuration changes implemented. A report only becomes operational progress when someone takes ownership of the outstanding tasks and checks their completion.

Every critical environment should therefore have a short list of responsibilities: what may Sophos do independently, what does the IT partner handle and who makes decisions within the company? Particularly for production-critical servers, the consequences of isolation must be discussed in advance.

What does MDR cost, and what belongs in the quotation?

A reliable total price requires user and server counts, the contract term, the desired response scope and the systems covered. Setup and the IT partner’s own responsibilities are additional factors. A lower licence price may say little if the required integrations and emergency availability are missing.

The Avanet shop lists offerings under Sophos MDR, MDR Complete, MDR for servers and MDR Complete for servers. Current vendor documentation also uses the name MDR Plus. Old product names and shop labels should therefore not be treated as equivalent to a current service scope without checking the quotation.

The integration packs in the original version of this article are likewise not a reliable current price list. A quotation must explicitly establish the included integrations, retention periods and any additional services. An included connection does not automatically license the connected third-party product either. We therefore do not give an unverified blanket unit price here.

How do you recognise an operationally ready MDR environment?

After purchase, having the licence appear in the portal is not enough. Monitored devices must be fully covered, the intended data sources must supply current events and response access must work. The chosen mode must fit the agreed incident response process.

For acceptance, the organisation and service provider should review contact paths and responsibilities, check integration health and agree on a coordinated, harmless functional test. The result must show who receives an alert and which response is possible technically and organisationally. Such a test does not require deliberately launching malware.

I would judge MDR by whether it creates a reachable, capable response chain in an emergency. An analyst team, working technical access and clear authorisation must come together. If any one is missing, a decisive gap remains even with a good licence.

Frequently asked questions