Sophos MDR pricing.
Per-user/per-endpoint annual subscription via channel partners only; two tiers (MDR Essentials and MDR Complete). Field benchmarks roughly $80 to $200 per user per year (about $7 to $17 per endpoint per month).
Sophos MDR does not publish a list price on its official page in 2026 (Quote-only via partner (no list price published)). Field-reported bands cluster at 7 to 17 USD per endpoint / month, sourced from G2 deal data, channel-partner listings, and Reddit r/cybersecurity quote dumps verified 2026-06-19.
Ledger entry
What changes the quote
The headline per-endpoint band moves with endpoint count, contract length, 24x7 vs business-hours coverage, the inclusion of an incident-response retainer, whether the customer brings their own SIEM, and the compliance overlay (HIPAA, PCI, CMMC L2, FedRAMP, DORA). See /annex/quote-decoder for the question ladder that decodes a Sophos MDR quote line by line.
What is bundled and what gets line-itemed
Bundled into the base subscription: 24x7 SOC monitoring, EDR licence (where vendor-supplied), portal access, standard onboarding. Line-itemed at extra cost: ingest overage above the contracted GB/day, non-standard log sources, dedicated tenancy, evidence packs for regulated frameworks, IR retainer hours, and contract off-boarding. Cross-reference /annex/hidden-costs for the full schedule.
Recent changes
Completed Secureworks acquisition Feb 2025 ($859M); Taegis now offered as a co-branded option inside Sophos portfolio; about 6% workforce reduction post-close; Sophos Endpoint auto-included in all Taegis MDR/XDR subs (Oct 2025 portfolio refresh).
Source
Primary source: https://www.sophos.com/en-us/products/managed-detection-and-response, verified 2026-06-19. Inferred-band sourcing note: Channel-partner price-list data 2025-2026; band varies sharply on tier (Essentials vs Complete) and on whether the customer keeps or replaces Sophos Endpoint.
See notes to the ledger for the source-mark legend and the inferred-band derivation methodology.