IR Firm Reference · Updated July 2026

Sophos Incident Response Cost: What You'll Actually Pay

Sophos is an MDR-first provider rather than a call-when-it-breaks DFIR firm. Its incident response is delivered two ways: Sophos Rapid Response, a fixed-fee remote engagement available to Sophos and non-Sophos customers, and incident response bundled into a Sophos MDR subscription. The February 2025 acquisition of Secureworks folded the enterprise-grade Taegis XDR/MDR platform into the portfolio. Sophos itself publishes no list price for Rapid Response or MDR, but its IR retainer is the one tier-1 offering in this market with a real filed price: four UK resellers list it on G-Cloud 15, and Phoenix Software's filed pricing document sets a per-user annual rate against a 200-user minimum. The figures below come from that filing and from Sophos's own sources; no dollar bands are stated where nobody publishes one.

How much does Sophos cost? Sophos is the rare case where a real filed number exists. Phoenix Software's UK G-Cloud 15 pricing document, filed 28 January 2026, prices the Sophos Incident Response Retainer at GBP 2.32 per user for 12 months with a minimum quantity of 200 users, and files longer terms at flat multiples of that annual rate. That figure is a reseller cost line in a public procurement filing rather than a Sophos customer list price, so treat it as a floor reference rather than what you will be quoted. Sophos itself publishes no list price: Rapid Response is a fixed fee scaled to your user and server count over a 45-day engagement, and MDR is sold per user or endpoint through channel partners.

GBP 2.32

IR Retainer, per user/yr (filed)

200 users

Filed minimum quantity

45-day

Rapid Response term

28,000+

MDR customers

Prices shown here are quoted as published and attributed to the surface that carries them, an AWS Marketplace listing or a filed G-Cloud pricing document, with a check date. Where this firm publishes no price, the entry reads "not published" and the quote drivers are given instead; we do not estimate a vendor's undisclosed rate. Always get a written quote for your estate.

Pricing Models

Model	Cost	Notes
Incident Response Retainer (UK G-Cloud 15, filed)	GBP 2.32 per user / 12 months	Filed reseller cost in Phoenix Software's G-Cloud 15 pricing document (SKU IRRETR12ZZRCAA, minimum quantity 200 users, filed 28 January 2026). Longer terms are filed at flat multiples of the annual rate: GBP 4.64 for 24 months, GBP 6.97 for 36, GBP 11.61 for 60. This is the reseller's cost line, not a Sophos customer list price, and it is the only publicly filed price for a tier-1 IR retainer we have found.
Sophos Rapid Response (fixed-fee IR)	Fixed fee by estate size	45-day remote engagement priced on user and server count, not an hourly rate; Sophos does not publish the fee. Onboarding starts within hours and most customers are triaged within 48 hours.
Sophos MDR subscription	Subscription, channel-priced	24/7 monitoring, detection, and response with IR included; sold per user/endpoint through channel partners. Sophos does not publish a self-service MDR rate.
Secureworks Taegis MDR/XDR (enterprise)	Enterprise subscription (not published)	Enterprise SecOps platform folded in via the 2025 Secureworks acquisition; scales with users and log volume.
Incident Management Retainer (Taegis)	Retainer, quote-based	Pre-arranged retainer from the Secureworks/Taegis side for a guaranteed response commitment.

What Drives What You'll Actually Pay

Driver	Cost	Basis
SMB ransomware, Rapid Response (non-customer)	Fixed fee by estate size	45-day engagement priced on user/server count; no open-ended hourly meter.
Ongoing coverage, Sophos MDR subscription	Channel-priced subscription	24/7 monitoring with IR included; sold per user/endpoint through partners, replacing separate SOC staffing plus on-demand IR.
Enterprise, Taegis MDR platform	Enterprise subscription (not published)	Secureworks Taegis SecOps at enterprise scale and log volume.

Verified Facts

Four UK resellers (Phoenix Software, Softcat, Chess ICT and CyberLab) list the Sophos Incident Response Retainer on G-Cloud 15 as an annual subscription giving on-demand access to Sophos incident responders, with 24/7 phone and email access, a vulnerability scan covering up to 50 IPs and FQDNs, a Sophos Central health check, and monthly threat-intelligence briefings. — Crown Commercial Service G-Cloud 15 service listings, checked September 2026

Phoenix Software's filed G-Cloud 15 pricing document prices the Sophos Incident Response Retainer at GBP 2.32 per user for 12 months (SKU IRRETR12ZZRCAA), with a minimum quantity of 200 users, rising to GBP 4.64 for 24 months, GBP 6.97 for 36 months and GBP 11.61 for 60 months. The figures are stated as Standard Platinum Reseller Cost, not a Sophos customer list price. — Crown Commercial Service G-Cloud 15, Phoenix Software pricing document filed 28 January 2026

Sophos Rapid Response is a fixed-fee remote incident response service with a 45-day engagement term, priced on the number of users and servers rather than an hourly rate, and available to both Sophos and non-Sophos customers. — Sophos Rapid Response product / press release

Sophos completed its all-cash acquisition of Secureworks (about $859M) in February 2025, folding the Taegis XDR and MDR platform into its security-operations portfolio. — Sophos press release, February 2025

Sophos is one of the largest pure-play MDR providers, supporting more than 28,000 organisations worldwide. — Sophos (2025)

Sophos authors the annual State of Ransomware report, a widely cited primary source on ransom payments and recovery costs. — Sophos State of Ransomware

When Sophos Is the Right Pick

Right pick when

+You want fixed-fee incident response with a known cost, not an open-ended hourly meter.
+You already run Sophos Endpoint or Firewall and want IR from the same vendor's telemetry.
+You want monitoring and incident response bundled rather than a reactive-only DFIR firm.

Wrong pick when

−You need the deepest nation-state attribution on a board-level report (a tier-1 DFIR firm may fit better).
−You want a purely hourly, no-subscription engagement with an independent boutique.
−You need OT/ICS-specialist forensics beyond Sophos's core coverage.

Frequently Asked Questions

How much does Sophos incident response cost?

Sophos is the rare case where a real filed number exists. Phoenix Software's UK G-Cloud 15 pricing document, filed 28 January 2026, prices the Sophos Incident Response Retainer at GBP 2.32 per user for 12 months with a minimum quantity of 200 users, and files longer terms at flat multiples of that annual rate. That figure is a reseller cost line in a public procurement filing rather than a Sophos customer list price, so treat it as a floor reference rather than what you will be quoted. Sophos itself publishes no list price: Rapid Response is a fixed fee scaled to your user and server count over a 45-day engagement, and MDR is sold per user or endpoint through channel partners.

What is Sophos Rapid Response?

Sophos Rapid Response is a fixed-fee remote incident response service that identifies and neutralises active attacks over a 45-day engagement, covering ransomware, network breaches, and hands-on-keyboard intrusions. It is available to both Sophos and non-Sophos customers, with onboarding starting within hours and most customers triaged within 48 hours. Because pricing is fixed by estate size rather than hourly, the cost is predictable before the work starts.

How did the Secureworks acquisition change Sophos IR?

Sophos completed its roughly $859 million acquisition of Secureworks in February 2025 and folded the Taegis XDR/MDR platform into its portfolio, making Sophos one of the largest pure-play MDR providers with more than 28,000 organisations. For incident response buyers this adds an enterprise-grade security-operations platform and an Incident Management Retainer option alongside the SMB-friendly Rapid Response service.

Do I need to be a Sophos customer to use its incident response?

No. Sophos Rapid Response is explicitly available to non-Sophos customers as well as existing ones, and responders deploy Sophos tooling during the engagement for visibility. Existing Sophos Endpoint or MDR customers benefit from telemetry already in place, which can shorten triage, but a prior Sophos deployment is not required to engage the Rapid Response team.

Is Sophos MDR cheaper than a tier-1 DFIR firm?

For ongoing coverage, a Sophos MDR subscription bundles 24/7 monitoring with incident response, which for an organisation without a SOC is often more economical than paying tier-1 emergency IR rates for a one-off engagement. Sophos does not publish an MDR list price, so compare quotes from Sophos partners. For a one-off sophisticated breach requiring nation-state attribution, a tier-1 DFIR firm such as Mandiant may still be the better fit despite the higher rate.

Compare Other IR Firms

Mandiant

Tier-1 DFIR, authors of the M-Trends report

CrowdStrike Services

Falcon-integrated IR and proactive retainer

Kroll

Cyber risk retainer with breach notification services

Coveware

Ransomware negotiation and recovery specialist

Unit 42

Palo Alto Networks DFIR and proactive retainer

IBM X-Force

Tier-1 DFIR retainer; authors Cost of a Data Breach

Arctic Wolf

MDR with incident response included

Sources: Crown Commercial Service G-Cloud 15, Phoenix Software Sophos Incident Response Retainer pricing document filed 28 January 2026 (also listed by Softcat, Chess ICT and CyberLab); Sophos Rapid Response product and press pages; Sophos press release: Secureworks acquisition (February 2025); Sophos State of Ransomware report. Updated July 2026.

IncidentCost.com is independent and not affiliated with Sophos. All figures are for planning purposes only.