It is licensed per server, in volume bands that lower the per-server price as your count goes up, and it is sold in one, two, or three year terms. Servers are counted separately from user or endpoint licenses, so a workload running on a server needs a server license. Tell us your server count and the term you want and we will build the quote.

Both tiers include around the clock monitoring, threat hunting, and active threat containment by the Sophos SOC. The difference is who finishes the response. With Essentials, Sophos contains the threat and hands you guided cleanup, and full incident response is a separate paid engagement. With Complete, Sophos runs the full incident response end to end at no extra cost, backed by a dedicated response lead, a 60 minute response target on 90% of high-severity cases, and a $1 million breach protection warranty.

Yes. MDR Complete for Server includes Intercept X Advanced for Server with XDR, which runs as a single lightweight agent on each protected server. The same agent and license apply whether the server is on-prem, virtual, or in the cloud, and it covers both Windows Server and Linux. That XDR agent is what gives the MDR team the telemetry they need to detect and respond.

Yes. Alongside Sophos firewall, email, and cloud, MDR integrates with a wide range of third-party firewall, network, email, cloud, and identity products so the SOC gets more context across your estate. Third-party integrations use Sophos integration pack licenses. Tell us what you are already running and we will confirm what feeds into detection.

The Sophos SOC investigates around the clock, and when a real threat is confirmed the team takes action on your behalf to shut it down. With Complete, they drive the incident all the way to full cleanup rather than handing it back to you, with no hourly caps and no extra fees for response. You get a named point of contact and can reach cross-discipline experts whenever you need them.