Sophos Endpoint Protection
Security that talks to itself.
Most breaches don't happen because one product failed. They happen because products didn't talk to each other. Sophos endpoint, firewall and email protection share one console and one live threat picture - so when one layer spots trouble, every layer reacts.
Managed and supported by Sorting Your Hosting, billed monthly, per user or per server. No upfront licence purchase.
One ecosystem, three layers
- Endpoint — protects every laptop, desktop and server
- Firewall — Sophos XGS hardware guarding the network edge
- Email — stops phishing and malware before the inbox
Why the Sophos ecosystem works
Every Sophos product on this page reports into Sophos Central — a single cloud console covering endpoints, servers, firewalls, email and mobile devices. One login, one policy engine, one place to see everything.
The connective tissue is Synchronized Security. Sophos endpoints and Sophos XGS firewalls exchange a constant health signal called the Security Heartbeat. If a workstation starts behaving like it's compromised — ransomware activity, a suspicious process, contact with a known command-and-control server — its Heartbeat turns red and the firewall automatically isolates that machine from the rest of your network. No engineer has to be awake for it. The infection is contained in seconds, not hours.
The same shared intelligence works across email: threats identified on an endpoint feed the same SophosLabs intelligence that filters your inbound mail, and suspicious messages can be traced back to the device and user they touched. Because everything logs to one data lake, an attack that hops between layers — a phishing email, then a compromised laptop, then lateral movement across the network — shows up as one story, not three unrelated alerts.
What this means for you
- Compromised devices are cut off from the network automatically
- One console instead of juggling separate vendors
- Cross-product visibility: email, endpoint and firewall events in one timeline
- Fewer gaps for attackers to hide between products
Endpoint, EDR, XDR, MDR — what's the difference?
These aren't four competing products. They're four rungs on the same ladder. Each level includes everything below it and adds one thing: more of the work is done for you.
Level 1 · Prevent
Sophos Endpoint
The foundation. Deep-learning malware detection, exploit prevention, web and application control, and CryptoGuard — which detects ransomware encryption in progress, stops it, and rolls the files back.
Best for: every device, as the baseline. This is the minimum any business machine should run.
Level 2 · Detect & investigate
EDR
Endpoint Detection & Response. Adds the investigator's toolkit: query any device with Live Discover, open a remote terminal with Live Response, trace an alert back to its root cause, and isolate a machine with one click.
Best for: teams with in-house IT who want to hunt threats themselves — on endpoint data.
Level 3 · See everything
XDR
Extended Detection & Response. The same investigation tools, but fed by data from beyond the endpoint: firewall, email, cloud and network telemetry pooled in the Sophos Data Lake. Attacks that move between layers can't hide between products.
Best for: businesses already running Sophos firewalls or email — XDR is where the ecosystem pays off.
Level 4 · Done for you
MDR
Managed Detection & Response. Sophos' own analysts watch your environment 24/7/365 and act on threats for you. MDR Essentials covers round-the-clock monitoring, triage and threat response. MDR Complete adds unlimited full-scale incident response with root-cause analysis — if there's an active attack, Sophos runs the entire response until it's resolved.
Best for: any business without a 24/7 security team — which is almost every business.
Each tier includes everything in the tiers to its left.
| Capability | Sophos Endpoint | EDR | XDR | MDR Essentials | MDR Complete |
|---|---|---|---|---|---|
| Ransomware rollback, exploit & malware prevention | ✓ | ✓ | ✓ | ✓ | ✓ |
| Threat hunting & investigation tools (Live Discover, Live Response) | — | ✓ | ✓ | ✓ | ✓ |
| Cross-product telemetry (firewall, email, cloud, network) | — | — | ✓ | ✓ | ✓ |
| 24/7 monitoring & response by Sophos analysts | — | — | — | ✓ | ✓ |
| Unlimited full-scale incident response & root-cause analysis | — | — | — | — | ✓ |
| Who does the security work? | You | You | You | Sophos | Sophos |
Simple per-device pricing
Billed monthly. All prices exclude VAT. Servers carry a higher rate than user devices because they protect more and matter more.
Per user, per month
| Protection level | Monthly (ex VAT) |
|---|---|
| Sophos Endpoint | £4.00 |
| Sophos EDR | £6.00 |
| Sophos XDR | £6.50 |
| Sophos MDR Essentials | £8.50 |
| Sophos MDR Complete | £14.50 |
| Workspace Protection | £7.00 |
| Endpoint Plus Workspace Protection | £11.00 |
Per server, per month
| Protection level | Monthly (ex VAT) |
|---|---|
| Sophos Endpoint for Server | £6.50 |
| Sophos EDR for Server | £8.00 |
| Sophos XDR for Server | £9.00 |
| Sophos MDR Essentials for Server | £19.00 |
| Sophos MDR Complete for Server | £29.00 |
Running servers with us? Endpoint protection can be added to any VPS, dedicated server or private cloud we host.
Security add-ons (per user, per month)
| Add-on | Monthly (ex VAT) |
|---|---|
| Central Network Detection & Response (NDR) | £7.50 |
| Identity Threat Detection & Response (ITDR) | £5.00 |
| Central Data Storage — 1 Year Pack | £4.00 |
| Central Device Encryption | £1.50 |
| Central Phish Threat (user awareness training) | £2.50 |
| Central Mobile Standard | £2.00 |
| Central Mobile Advanced | £4.00 |
| Intercept X for Mobile | £2.00 |
Email protection (per user, per month)
| Product | Monthly (ex VAT) |
|---|---|
| Sophos Email | £3.00 |
| Sophos Email Plus | £4.50 |
| Portal Encryption add-on | £5.00 |
| DMARC Manager add-on | £1.00 |
| Email Monitoring System | £1.00 |
Full details on our Email Protection page.
Better together: pair it with a Sophos XGS firewall
Endpoint protection guards the device. A firewall guards the network. Run both from Sophos and they actively cooperate through the Security Heartbeat:
- Automatic isolation — a red-Heartbeat device is blocked from the network by the XGS firewall before an engineer even picks up the alert.
- Lateral movement protection — healthy endpoints refuse traffic from compromised ones, stopping infections spreading machine-to-machine even on the same switch.
- Application clarity — endpoints tell the firewall exactly which application generated each traffic flow, so unknown traffic stops being unknown.
- Richer XDR — firewall telemetry lands in the same data lake your XDR and MDR investigations run on.
We offer the full Sophos XGS range as a monthly subscription — hardware, licensing and support in one price, with no capital outlay.
Firewall Hardware-as-a-Service
From compact desktop units for small offices to rack-mounted appliances for data centres.
Not sure which level you need?
A reasonable rule of thumb: if nobody in your business is watching security alerts at 3am, start the conversation at MDR. If you have capable in-house IT and Sophos firewalls or email already, XDR gives them the full picture. If you just need strong, modern protection on every machine, Sophos Endpoint is the baseline — and you can move up a rung at any time without changing agents or consoles.
Tell us how many users and servers you have and what you run today, and we'll recommend the right mix — without selling you rungs you don't need.
Why buy through us?
- Monthly billing, no upfront licence purchase
- Deployment and onboarding handled for you
- One supplier for hosting, firewall, endpoint and email
- UK-based support that already knows your environment