Solution Brochure

Sophos Managed
Detection and Response

24/7 Threat Detection and Response
Sophos MDR is a fully managed 24/7 service delivered by experts who detect
and respond to cyberattacks targeting your computers, servers, networks, cloud
workloads, email accounts, and more.
Ransomware and Breach Prevention Services

Highlights

The need for always-on security operations has become an imperative. However, thecomplexity of modern operating environments and the velocity of cyberthreats make it
increasingly difficult for most organizations to successfully manage detection and responseon their own.

Ì Stop ransomware and otheradvanced human-led attacks
with a 24/7 team of threat
response experts

With Sophos MDR, our expert team stops advanced human-led attacks. We take action toneutralize threats before they can disrupt your business operations or compromise yoursensitive data. Sophos MDR is customizable with different service tiers, and can be delivered
via our proprietary technology or using your existing cybersecurity technology investments.

Ì Maximize the ROI of yourexisting cybersecurity
technologies

Cybersecurity Delivered as a Service
Enabled by managed detection and response (MDR) capabilities that provide complete
security coverage wherever your data reside, Sophos MDR can:• Detect more cyberthreats than security tools can identify on their own
Our tools automatically block 99.98% of threats, which enables our analysts to focus on
hunting the most sophisticated attackers that can only be detected and stopped by ahighly trained human.
• Take action on your behalf to stop threats from disrupting your businessOur analysts detect, investigate, and respond to threats in minutes — whether you needfull-scale incident response or help making accurate decisions.
• Identify the root cause of threats to prevent future incidents
We proactively take actions and provide recommendations that reduce risk to yourorganization. Fewer incidents mean less disruption for your IT and security teams, youremployees, and your customers.

Compatible with the Cybersecurity Tools You Already Have
We can provide the technology you need from our award-wining portfolio, or our analysts canleverage your existing cybersecurity technologies to detect and respond to threats.
Sophos MDR is compatible with security telemetry from vendors such as Microsoft,CrowdStrike, Palo Alto Networks, Fortinet, Check Point, Rapid7, Amazon Web Services(AWS), Google, Okta, Darktrace, and many others. Telemetry is automatically consolidated,correlated, and prioritized with insights from the Sophos Adaptive Cybersecurity Ecosystem(ACE) and Sophos X-Ops threat intelligence unit.

Ì Let Sophos MDR executefull-scale incident response,
work with you to manage
security incidents, or deliverdetailed threat notifications andguidanceÌ Improve cyber insurance
coverage eligibility with 24/7
monitoring and endpoint
detection and response (EDR)
capabilities
Ì Free up your internal IT andsecurity staff to focus on
business enablement

Sophos MDR Solution Brochure

MDR That Meets You Where You Are
Sophos MDR is customizable with different service tiers and threat response options. Let the Sophos
MDR operations team execute full-scale incident response, work with you to manage cyberthreats,
or notify your internal security operation teams any time threats are detected. Our team quickly
learns the who, what, when, and how of an attack. We can respond to threats in minutes.

Key Capabilities
24/7 Threat Monitoring and Response
We detect and respond to threats before they cancompromise your data or cause downtime. Backed by sevenglobal security operations centers (SOCs), Sophos MDR
provides around-the-clock coverage.

Compatible with Non-Sophos Security Tools
Sophos MDR can integrate telemetry from third-party
endpoint, firewall, network, identity, email, backup andrecovery, and other technologies.

Full-Scale Incident Response

Dedicated Incident Response Lead
We provide you with a Dedicated Incident Response Leadwho collaborates with your internal team and external
partner(s) as soon as we identify an incident and works withyou until the incident is resolved.

Root Cause Analysis
Along with providing proactive recommendations to improveyour security posture, we perform root cause analysis toidentify the underlying issues that led to an incident. We give
you prescriptive guidance to address security weaknesses
so they cannot be exploited in the future.

When we identify an active threat, the Sophos MDR
operations team can execute an extensive set of response
actions on your behalf to remotely disrupt, contain andfully-eliminate the adversary. With a Sophos MDR Complete
license, you benefit from unlimited full-scale incident
response, with no caps and no extra fees.

Sophos Account Health Check

Weekly and Monthly Reporting

For organizations that choose not to have Sophos MDR
perform full-scale incident response, the Sophos MDR
operations team can execute threat containment actions,interrupting the threat and preventing spread. This reduces
workload for internal security operations teams and enables
them to rapidly execute remediation actions.

Sophos Central is your single dashboard for real-time alerts,reporting, and management. Weekly and monthly reports
provide insights into security investigations, cyberthreats,and your security posture.

Sophos Adaptive Cybersecurity Ecosystem
Sophos ACE automatically prevents malicious activity andenables us to search for weak signals for threats that require
human intervention to detect, investigate, and eliminate.

Expert-Led Threat Hunting
Proactive threat hunts performed by highly-trained analysts
uncover and rapidly eliminate more threats than security
products can detect on their own. The Sophos MDRoperations team can also use third-party vendor telemetry
to conduct threat hunts and identify attacker behaviors thatevaded detection from deployed toolsets.

Direct Call-in Support
Your team has direct call-in access to our Security
Operations Center (SOC) to review potential threats andactive incidents. The Sophos MDR operations team isavailable 24/7/365 and backed by support teams across
26 locations worldwide.

We continuously review settings and configurations forendpoints managed by Sophos MDR and make sure they arerunning at peak levels.

Threat ContainmentIntelligence Briefings: “Sophos MDR ThreatCast”
Delivered by the Sophos MDR operations team, the “Sophos
MDR ThreatCast” is a monthly briefing available exclusively
to Sophos MDR customers. It provides insights into thelatest threat intelligence and security best practices.

Breach Protection Warranty
Included with all Sophos MDR Complete annual (one tofive years) and monthly licenses, the warranty covers up
to $1 million in response expenses. There are no warrantytiers, minimum contract terms, or additional purchaserequirements.

Sophos MDR Solution Brochure

Sophos MDR Included Integrations
Security data from the following sources can be integrated for use by the Sophos MDR
operations team at no additional cost. Telemetry sources are used to expand visibility acrossyour environment, generate new threat detections and improve the fidelity of existing threat
detections, conduct threat hunts, and enable additional response capabilities.

Sophos Endpoint

Workload Protection

Sophos Mobile

Block advanced threats anddetect malicious behaviors
across your endpoints

Advanced protection and threat
detection for Windows andLinux servers and containers

Keep your iOS and Androiddevices and data secure fromthe latest mobile threats

Product included in Sophos MDR pricing

Product included in Sophos MDR pricing

Product sold separately; integrated at no
additional charge

Sophos Firewall

Sophos EmailSophos Cloud

Monitor and filter incoming andoutgoing network traffic to stopadvanced threats before they
have a chance to cause harmProtect your inbox frommalware with advanced AI thatstops targeted impersonationand phishing attacks

Stop cloud breaches and gain
visibility across your critical
cloud services, including AWS,Azure, and GCP

Product sold separately; Xstream Protectionsubscription required; integrated at no
additional charge

Product sold separately; integrated at no
additional charge

Product sold separately; integrated at no
additional charge

Third-Party Endpoint
Protection

Microsoft Security Tools

Sophos ZTNA

Replace remote access VPN
with least-privileged access tosecurely connect your users toyour networked applications
Product sold separately; integrated at no
additional charge

Compatible with:
••
•
•
•
•

Microsoft
CrowdStrike
SentinelOne
Trend Micro
BlackBerry (Cylance)
Broadcom (Symantec)

••
•
•
•
•
•

Defender for Endpoint
Defender for Office 365
Defender for Cloud Apps
Defender for Identity
Entra ID Protection
Microsoft 365 Defender
Microsoft Purview DLP+ compatible with other solutions withthe Sophos ‘XDR Sensor’ agent

90-Days Data Retention

Retains data from Sophos
products and third-party(non-Sophos) solutions in theSophos Data Lake
Extendable to 1 year as an optional add-on

Microsoft Office 365
Management Activity

Provides information on user,admin, system, and policy
actions and events ingested
via the Office 365 ManagementActivity API

Google Workspace

Ingests security telemetry fromthe Google Workspace AlertCenter API

Sophos MDR Solution Brochure

Add-On Integrations
Security data from the following third-party sources can be integrated for use by theSophos MDR operations team via the purchase of Integration Packs. Telemetry sources
are used to expand visibility across your environment, generate new threat detections
and improve the fidelity of existing threat detections, conduct threat hunts, and enableadditional response capabilities.

Continuously monitor activity
inside your network to detectsuspicious actions occurring
between devices that areotherwise unseen
Compatible with any network via SPAN portmirroring

NetworkFirewallSophos NDRCompatible with:••••••••••

Barracuda
Check Point
Cisco Firepower
Cisco Meraki
Fortinet
F5Forcepoint
Palo Alto Networks
SonicWall
WatchGuard

Compatible with:
••
•
•
•
•
•

Cisco Umbrella
Darktrace
Secutec
Skyhigh Security
Thinkst CanaryVectra
Zscaler

Identity

EmailCompatible with:

Compatible with:

Compatible with:

••
•
•
•

• Mimecast• Proofpoint• Orca Security

Auth0
Cisco ISE
DuoManageEngine
Okta

Microsoft 365 and Google Workspace
integrations included at no additional charge

CloudAWS, Azure and GCP integrations included
with Sophos Cloud Optix product, soldseparately.

Microsoft integration included
at no additional charge

1-Year Data Retention

Backup and Recovery

Compatible with:• Acronis• Veeam

Retains data from Sophos
products and third-party(non-Sophos) solutions in theSophos Data Lake

Add-On ServiceSophos Managed Risk, Powered by Tenable

Reduce cybersecurity risk with proactive attack surface vulnerability management, delivered as a service.
Sophos Managed Risk identifies high-priority vulnerabilities so action can be taken to prevent attacks before they
disrupt your business. Available as an add-on for Sophos MDR.

Sophos MDR Solution BrochureSophos Service Tiers
Sophos MDR Essentials

Sophos MDR Complete

24/7 expert-led threat monitoring and response✓✓

Compatible with non-Sophos security products✓✓

Weekly and monthly reporting✓✓

Monthly intelligence briefing: “Sophos MDR ThreatCast”✓✓

Sophos Account Health Check✓✓

Expert-led threat hunting✓✓

Uses full Sophos MDR agent (protection, detection, andresponse) or Sophos MDR Sensor (detection and response)✓✓

Direct call-in support during active incidents✓✓

IR Retainer Add-on✓

Threat containment: attacks are interrupted, preventing spread

Full-scale incident response: threats are fully eliminatedRequires full Sophos MDR agent (protection, detection, and response)

Root cause analysis✓

Dedicated Incident Response Lead✓

Breach Protection Warranty✓

Covers up to $1 million in response expenses

Sophos MDR Guided Onboarding
Sophos MDR Guided Onboarding is available for remote onboarding assistance, as an optional
additional purchase. The service provides hands-on support for a smooth and efficient
deployment, ensures best practice configurations, and delivers training to maximize thevalue of your MDR service investment. You are provided a dedicated contact from the Sophos
Professional Services organization who will be with you through your first 90 days to makesure your implementation is a success. Sophos MDR Guided Onboarding includes:

Day 1 – Implementation

Day 30 – MDR TrainingÌ Project kickoff

Ì Learn to think and act like a SOC

Ì Configure Sophos Centraland review of features

Ì Understand how to hunt forindicators of compromiseÌ Build and test deployment processÌ Gain an understanding ofusing our MDR platform foradministrative tasks

Ì Configure MDR integrations
Ì Configure Sophos NDR sensor(s)Ì Enterprise-wide deployment

Ì Learn to construct queries
for future investigations

Day 90 Security Posture
Assessment
Ì Review current policies for bestpractice recommendations
Ì Discuss features that are
not in use that could provide
additional protection
Ì Security assessment
following NIST frameworkÌ Receive summary report withrecommendations from our review

Sophos MDR Solution Brochure

See why customers choose Sophos MDR

Sophos is an established leader in managed detection
and response, with industry recognition to back it up.

A Leader in the 2024 IDC MarketScape for Worldwide
Managed Detection and Response Services

A Gartner Peer Insights Customers’ Choicefor Managed Detection and Response

Rated overall Leader by customers in the Summer
2024 G2 Grid® Report for Managed Detection andResponse

A Leader in the 2024 Frost Radar report for
Global Managed Detection and Response

A strong performer in MITRE Engenuity
ATT&CK Evaluations for Managed Services

To learn more, visit
sophos.com/mdr

United Kingdom and Worldwide Sales
Tel: +44 (0)8447 671131
Email: sales@sophos.com

North American Sales
Toll Free: 1-866-866-2802
Email: nasales@sophos.com© Copyright 2024. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UKSophos is the registered trademark of Sophos Ltd. All other product and company names mentioned aretrademarks or registered trademarks of their respective owners.
2024-07-18 BREN (PS)

Australia and New Zealand Sales
Tel: +61 2 9409 9100
Email: sales@sophos.com.au

Asia Sales
Tel: +65 62244168
Email: salesasia@sophos.com