Sophos NDR 5500: What the new appliance brings
Sophos NDR stands for Network Detection and Response and detects suspicious activity in network traffic. Visibility into east-west traffic is particularly valuable: for example, traffic between devices on the same subnet whose communication never passes through a firewall. NDR can also analyze north-south traffic between the internal network and the internet.
The product has been available for some time. A typical deployment used a virtual machine receiving a copy of traffic through a switch mirror port. This additional network data helps Sophos MDR (Managed Detection and Response) detect and investigate attacks inside the network as well. The VM needs reserved resources and a correctly configured traffic feed through the virtualization host. Deployment on your own hardware was also possible, initially on models certified by Sophos.
The Sophos NDR 5500 now adds a dedicated Sophos appliance. It removes the need to provision a VM or select compatible third-party hardware. The traffic to be inspected still needs to reach the appliance. It was introduced on November 4, 2026, with the first order date scheduled for November 10, 2026.
The NDR 5500 handles network analysis on a separate platform. Firewall duties are covered by the XGS 2380, 3380, 4580 and 5580, announced at the same time. The new Xstream Plus bundle does not include an NDR 5500 appliance.
Which attacks NDR makes visible
A compromised device may initially behave inconspicuously and later attempt to reach other systems on the network. These are exactly the movements NDR is designed to reveal. Its analysis looks for unusual connections, communication with attacker infrastructure and suspicious traffic patterns. This is particularly useful for IoT devices, production systems or other devices without an endpoint agent.
In Sophos Fusion, these detections can be investigated alongside endpoint and firewall data. This gives the security team additional clues about which devices are communicating and where an attack might spread. In the appropriate inline mode, the appliance can also block known malicious packets with the IDS/IPS add-on.
Analysis includes assessing encrypted connections, detecting algorithmically generated domains and evaluating session risk. Intrusion and data analysis engines provide additional insight. The investigation console lets you examine detections and visible network devices, including devices without an agent.
NDR also evaluates characteristics of encrypted connections without having to decrypt all their contents. What matters is which traffic we feed to the sensor. To inspect communication between devices on the same subnet, for example, it must be mirrored at the appropriate switch. A monitoring point only at the internet gateway is not enough.
NDR 5500 hardware and bypass variants
The NDR 5500 is a 1U Long appliance with a dual-processor architecture, two SSDs and two Flexi Port slots. Two hot-swappable power supplies are included. This provides a dedicated platform without first having to provision a separate virtualization host.
| Feature | Specification |
|---|---|
| Form factor | 1U Long |
| Architecture | Two processors |
| Storage | Two SSDs |
| Power | Two hot-swappable power supplies |
| Flexi Port slots | 2 |
| Copper variant | 2 modules, each with 4 × 1-GbE copper bypass ports |
| Fiber variant | 2 modules, each with 2 × 10-GbE fiber bypass ports, LC |
The choice of modules depends on the connections into which the appliance will be integrated: 1-GbE copper or 10-GbE fiber. The copper variant provides eight bypass ports in total, while the fiber variant provides four. Each inline link uses two ports, giving four copper or two fiber links.
Connections and analysis performance
Depending on the module variant, the NDR 5500 provides 1-GbE copper or 10-GbE fiber connections. These figures describe connection speed. How much traffic the appliance can analyze simultaneously also depends on packet sizes, connection counts and the active analysis functions. A specific throughput figure for NDR analysis and IDS/IPS operation on the NDR 5500 is still pending at the time of writing.
Planning must consider the traffic at the intended monitoring points. If several internal links are mirrored, for example, their traffic volumes combine at the sensor, regardless of internet connection speed. We therefore size the solution around internal network load and its peaks. For inline deployment, analysis capacity must also match the connection passing through the appliance.
Passive monitoring or active blocking
SPAN/TAP: inspecting copies of traffic
With SPAN or port mirroring, a switch sends copies of selected packets to NDR. A TAP provides traffic through a dedicated capture point. The appliance then sits outside the production forwarding path and cannot itself drop the original packet.
The right monitoring points and sufficient capacity on the mirror port are essential. Mirroring several heavily loaded links to a lower-capacity port can result in missing packets. Our NDR traffic mirroring guide explains how to plan the traffic feed.
Passive Inline and Active Inline
The Sophos appliance requires the IDS/IPS add-on for both inline modes. In Passive Inline, it inspects traffic passing through it without actively blocking it. In Active Inline, it can block known malicious packets directly in the traffic path using IPS rules.
In inline operation, production traffic passes through the appliance. This makes its behavior during a failure important: the bypass modules provide a path around the analysis. Connection behavior during a power failure, restart or maintenance must be considered when planning integration. We recommend starting in monitoring mode to assess detections before introducing active blocking.
The integrated NDR features of Sophos Firewall remain separate. NDR Essentials or Active Threat Intelligence on the firewall are not a separate NDR 5500 appliance and do not replace its independently planned monitoring points inside the network.
Pricing and licensing
The NDR 5500 comes in two configurations. The copper variant, SKU NC55XP00ZZPCCE, includes two bypass modules with four 1-GbE ports each. It suits networks where the connections to be monitored use Gigabit copper. Its hardware list price is EUR 24,700 excluding VAT, including both modules.
The fiber variant, SKU NC55XP00ZZPCDE, includes two bypass modules with two 10-GbE Fiber LC ports each. It is the appropriate configuration for integration into corresponding 10-GbE fiber links and also costs EUR 24,700 excluding VAT, including the modules. The available connections and planned network integration therefore determine the choice.
These list prices provide initial guidance and are based on the Benelux price list for appliances with EU/UK power cables, excluding VAT and project-specific services. We will create the product page with both variants and our selling prices in the shop over the next few days. Orders are scheduled to open on November 10; we will confirm the delivery date for your quotation.
Hardware is part of the cost
The foundation is the Sophos NDR software license, priced according to the number of protected users and servers. It includes behavioral detection and unlimited virtual deployments within the licensed scope. The appliance is purchased separately. Its signature-based IDS/IPS features and inline operation require the additional per-appliance IDS/IPS add-on. Active blocking requires Active Inline mode.
Two hardware support levels are available. Enhanced Support includes round-the-clock support, software updates, remote assistance and advance hardware replacement. Enhanced Plus adds priority handling, access to senior technical specialists and a device-dependent allowance for remote consulting. NDR launches with term licensing; MSP Flex availability remains unconfirmed. MDR service is agreed separately.
As an alternative to buying, Right-of-Use offers provide use for a limited period. For both module variants, the listed prices excluding VAT for the “NDR 5500 with Central NDR” package are EUR 7,528.75 for one year, EUR 22,586.25 for three years and EUR 37,643.75 for five years, each covering the entire term.
Which option makes financial sense depends on the period of use and the required licensing and support scope. Our quotation brings together the hardware or right of use, user and server licenses, add-ons and support so that you can compare the total cost.
When a dedicated appliance makes sense
A dedicated NDR appliance is particularly useful when specific network segments need monitoring and a separate hardware platform is preferred. If adequately sized virtualization infrastructure is already available, a virtual deployment may be more economical. For Active Inline, supported hardware, bypass cabling and the add-on are central considerations.
The value comes from visibility into relevant connections and the subsequent handling of detections. This requires clear responsibilities: who investigates an alert, who may block traffic and who reverses a false block? An MDR service can support this work, but it is a separate service and is not included simply by purchasing the appliance.
Sophos NDR Solution Brief
The Sophos NDR Solution Brief summarizes the solution in PDF format.
