Sophos endpoint protection is priced per endpoint for a 12-month contract, and Sophos publishes the rates on its own AWS Marketplace listing: Sophos EDR is $110.00 per user endpoint, Sophos XDR is $136.60 per user endpoint, and Sophos MDR is $239.64 per user endpoint. Server endpoints are billed separately and cost roughly double: $222.00 for EDR, $239.73 for XDR and $390.72 for MDR. sophos.com itself routes to a quote, and buying through a reseller or a private offer can land well below these figures, so treat the marketplace rates as the published list rather than the best price available.
Sophos Intercept X pricing tiers
| Tier | Price | Real EDR? | Notes |
|---|---|---|---|
| Sophos EDR (user endpoint) | $110.00 / 12 months$9.17/mo | Yes | Detection and response on user endpoints. Published AWS Marketplace rate. |
| Sophos XDR (user endpoint) | $136.60 / 12 months$11.38/mo | Yes | Extends detection across network, cloud, identity and email. The tier most buyers are quoted. |
| Sophos MDR (user endpoint) | $239.64 / 12 months$19.97/mo | Yes | 24/7 managed detection and response on top of the platform. |
| Server endpoints | $222.00 / $239.73 / $390.72 | Yes | EDR / XDR / MDR per server for 12 months. Servers are billed separately from user endpoints. |
The entry tier that delivers genuine EDR (continuous telemetry, behavioural detection, threat hunting, and response actions) is Sophos EDR at $110.00 per user endpoint, or XDR at $136.60 for cross-surface detection. Cheaper tiers in the table are NGAV or prevention-only and do not give you the post-incident investigation trail that defines EDR.
What it costs at your size
Worked annual figures at the entry EDR tier, before negotiation. Use these to size the budget line, then run your own numbers in the budget calculator, which layers deployment, tuning, and internal operating cost on top of the licence.
| Organisation | Endpoints | Tier | Annual licence | Per endpoint / mo |
|---|---|---|---|---|
| Micro / SMB | 50 users | Sophos XDR | $6,830 | $11.38 |
| Small business | 200 users | Sophos XDR | $27,320 | $11.38 |
| Mid-market | 1,000 users | Sophos XDR | $136,600 | $11.38 |
| Mid-market + MDR | 1,000 users | Sophos MDR | $239,640 | $19.97 |
| 1,000 users + 50 servers | 1,050 | Sophos XDR | $148,587 | blended $11.79 |
Licence only. Deployment, tuning, IR retainer, and internal operating cost sit on top: see the five TCO categories. At SMB scale the licence is roughly half of true all-in cost.
Four ways to bring the Sophos Intercept X number down
Use the marketplace rate as your reseller benchmark
Because Sophos is channel-led, the reseller margin is negotiable, but until now buyers had no published anchor to negotiate against. The AWS Marketplace rates are that anchor: if a partner quote sits above $136.60 per user per year for XDR, ask why.
Count servers separately
Sophos bills server endpoints on their own dimension at roughly double the user rate: $239.73 against $136.60 for XDR. An estate sized purely on headcount will under-budget by the server count times the difference.
Decide whether you need XDR or just EDR
Sophos prices EDR and XDR as separate dimensions, $110.00 and $136.60 per user per year. The $26.60 step buys detection across network, cloud, identity and email rather than endpoints alone. If your telemetry sources are endpoint-only, EDR is the honest buy.
Decide on MDR before signing, not after
Sophos pushes its MDR hard. It is genuinely strong, but at $239.64 per user per year it costs $103.04 more than XDR, which is a 75 percent uplift. Buy it if you lack analyst capacity, not by default.
Bundle with Sophos firewall for synchronised security
If you already run Sophos XGS firewalls, the synchronised-security integration adds real value and gives you negotiating leverage on a combined renewal.
When Sophos Intercept X is the right pick, and when it is not
- + You are an SMB or mid-market shop that wants strong anti-ransomware and a single, simple console.
- + You already run Sophos firewalls and want synchronised security across network and endpoint.
- + You want a well-regarded managed MDR option from the same vendor without integrating a third party.
- + You buy through a channel and can negotiate reseller margin.
- − You need the absolute top of the MITRE ATT&CK detection rankings: CrowdStrike and SentinelOne score higher in independent evaluations.
- − You are on Microsoft 365 E5: Defender for Endpoint P2 is already included.
- − You are cost-led on published list alone: Sophos XDR at $136.60 per user per year lists above CrowdStrike Falcon Pro at $99.99 and Bitdefender Business Security Premium at $88.00 or less.
- − Your estate is server-heavy: Sophos bills servers on a separate dimension at roughly double the user rate.