CyberIndexBeta

Sophos XDR

SophosSmall Business Antimalware (primary)Enterprise AntimalwareCompare with others in Small Business Antimalware

Product

Extended detection and response product for organisations, spanning endpoint and other telemetry. Sophos MDR is the world's largest Agentic SOC, delivering fully managed, 24/7 detection and response across your entire environment. Sophos XDR with Next-Gen SIEM unifies protection, detection, investigation, response, and historical context, bringing together real-time security operations and long-term data in one place. Sophos Next‑Gen SIEM extends Sophos XDR with long‑term retention and compliance‑focused data ingestion up to 10 years with predictable pricing based on users and servers. Sophos XDR covers Linux, macOS, Windows and Windows Server.

Current Version
2026.3.0.2104
Product Page
sophos.com/…/extended-detection-a…
Market
EnterpriseSMB
Licence
Paid
Price
Quote
Record Created
2026-09-19
Last Updated
2026-10-28

Vendor

Sophos was founded in 1985 by Jan Hruska and Peter Lammer, two Oxford doctoral students, and is still headquartered in Abingdon, outside Oxford. It listed in London in 2015 and was taken private in 2020 by Thoma Bravo, and in 2025 it acquired Secureworks, adding that company's managed detection business to its own. It sells to organisations, largely through resellers, and its two halves are endpoint and network. Sophos Intercept X is the endpoint product, Sophos Firewall the appliance line, and Sophos Central the single console that manages both — the integration between them is much of what it sells. Sophos MDR is the managed detection and response service, now the company's fastest-growing line with more than 40,000 customers, and Sophos XDR, Sophos Email and Sophos Backup and Recovery for M365 sit alongside. Sophos Home is the consumer product, and the free version is the one most individuals will have met. SophosLabs publishes its own threat research, and the company's products appear regularly in the public test cycles this index draws on. Vendor page →

Website
sophos.com
Country
United Kingdom
Headquarters
Abingdon, United Kingdom
Year Established
1985
Customers
625K organisations
Users
100M users
Revenue
$1.0B (2023)

Platforms

Cloudnative
Linuxnative
macOSnative
Windowsnative
Windows Servernative

Target Market

Enterprise secondarySMB primary

Capabilities

Malware DetectionkeyNot known
Ransomware ProtectionkeyNot known
Behavioral Detectionkeynative
Web ProtectionkeyNot known
Email ProtectionNot known
Host FirewallNot known
Sandbox AnalysisNot known
Cloud-Assisted ScanningNot known
Heuristic DetectionNot known
Device ControlNot known
Vulnerability ShieldingNot known
Central Management Consolenative

10 of 12 not yet known — not recorded, which is not the same as not supported.

Pricing

PlanLicencePriced perBilledPrice
SummaryPrice on requestnot statedno recurring chargeQuote

Versions

  • 2026.3.0.2104Windows Server
  • 2026.3.0.2090Windows
  • 2026.3Linux
  • 2026.2.0macOS

The newest release each source names per platform, not every release the vendor has shipped. A release date is shown only where one is recorded.

Independent Tests

At a glance — latest result per lab test

MITRE ATT&CK Evaluations (Enterprise)

2025-12-10lab report ↗

Each bar is one lab’s own figure on that lab’s own scale. Labs test different models at different times, so the figures are not combined into one score.

All results

MITRE ATT&CK Evaluations (Enterprise)MITRE ATT&CK Evaluations — Enterprise 20252025-12-10
Technique-level detection: 64%Any detection: 74.2%Benign activity not alerted: 29.4%Attack sub-steps evaluated: 89
MITRE ATT&CK Evaluations (Enterprise)MITRE ATT&CK Evaluations — Enterprise 20242024-12-11
Technique-level detection: 71.2%Any detection: 83.8%Benign activity not alerted: 30%Attack sub-steps evaluated: 80

Certifications

Not known

Change History

This record was created 2026-09-19. Everything below is what has changed since.

  • 2026-10-28New versionNew version: 2026.3.0.2104 (Windows Server)evidence
  • 2026-10-28New versionNew version: 2026.3.0.2090 (Windows)evidence
  • 2026-10-20New versionNew version: 2026.3 (Linux)evidence
  • 2026-10-20New versionNew version: 2026.2.0 (macOS)evidence
  • 2026-10-20New versionNew version: 2026.2.2.1 (Windows Server)evidence
  • 2026-10-20New versionNew version: 2026.2.2.1.0 (Windows)evidence
  • 2026-10-07Test result addedNew MITRE ATT&CK Evaluations (Enterprise) resultevidence
  • 2026-10-07Test result addedNew MITRE ATT&CK Evaluations (Enterprise) resultevidence
  • 2026-09-23Capability addedCentral Management Console: built inevidence
  • 2026-09-23Capability addedBehavioral Detection: built inevidence
  • 2026-09-23Platform addedRuns on Cloudevidence
  • 2026-09-23Platform addedRuns on Windows Serverevidence
  • 2026-09-23Platform addedRuns on Linuxevidence
  • 2026-09-23Platform addedRuns on macOSevidence
  • 2026-09-23Platform addedRuns on Windowsevidence
  • 2026-09-22Product updatedListed in Enterprise Antimalwareevidence
  • 2026-09-22Product updatedListed in Small Business Antimalwareevidence
  • 2026-09-20Pricing plan addedPrice: price on requestevidence
  • 2026-09-19Product createdNew product listedevidence
  • 2026-09-19Product updatedAlso sold to: Enterpriseevidence
  • 2026-09-19Product updatedSold to: SMBevidence
Something wrong? Suggest a correction →

May we count your visit? CyberIndex would like to use Google Analytics to see which pages are read. It sets cookies and sends your visit to Google. Decline and nothing is loaded — the site works the same either way. Privacy.