Sophos MDR vs. Managed EDR.
EDR is the technology. MDR is the humans (and AI) watching it. Most Ottawa SMBs need both — eventually. Here is how to know when, with real numbers.
If you have shopped for cybersecurity in the last 18 months, you have heard both terms — sometimes from the same vendor, in the same sentence. The marketing has gotten worse, not better. Let us untangle it, using actual numbers from the 2025 Sophos Active Adversary Report.
The core distinction
EDR (Endpoint Detection & Response) is software. It runs on every laptop, server and workstation, watches process behaviour, and stops things that look wrong. Market-leading products include Sophos Intercept X, CrowdStrike Falcon, SentinelOne, and Microsoft Defender for Endpoint.
MDR (Managed Detection & Response) is humans plus AI. Trained SOC analysts (and increasingly, AI agents under analyst supervision) watch the alerts EDR generates 24/7, hunt for things EDR did not fire on, and engage when something fires. MDR is delivered as a service, layered on top of EDR.
The simple way to remember it: EDR is the alarm. MDR is the monitoring station that calls the police.
Why the distinction matters in 2025
The Sophos 2025 Active Adversary Report (analysing 400+ MDR and IR cases from 2024) found median dwell time across all cases was just 2 days — but that includes the rapid responses MDR enables. In IR-only cases (no MDR running), median dwell time was 7 days; ransomware cases were 4 days, non-ransomware 11.5 days.
That same report found the median time between an attacker's initial action and their first attempt to breach Active Directory was just 11 hours. The compressed attack chain means an unmonitored EDR alert at 3 AM Saturday is a missed window of opportunity, not a delayed one.
The economics
For an Ottawa business under 50 employees, the comparison usually comes down to three options:
- EDR-only: license cost per endpoint per month, plus whoever your IT support is checking the console "regularly." Works only if you have a real internal IT team that can be paged at night.
- EDR + MDR: EDR licensing plus the MDR service on top. 24/7 SOC, real triage, real containment. Works for businesses that don't have on-call IT.
- Hire your own SOC analyst: a six-figure salary, vacation coverage, replacement risk. Doesn't pencil out under several hundred endpoints.
If you're under 100 endpoints and rely on an MSP for IT, MDR is almost always cheaper than the alternative — including the alternative of doing nothing. We don't post rate cards publicly; we'll quote a real number against your specific environment.
What Sophos MDR brings specifically
Disclosure: 4UIT is a Sophos Partner. Sophos MDR is a fit because:
- One of the largest dedicated MDR providers, with a global SOC team and an established Partner ecosystem in Canada.
- Combined human-led and AI-assisted detection. Sophos publishes ongoing performance metrics (response and resolution times) on its MDR product page.
- Full incident response included — analysts take action under a pre-agreed authorisation matrix, not just call you. The MDR Complete tier includes a breach-protection warranty.
- Compatibility with non-Sophos EDR (CrowdStrike, SentinelOne, Microsoft Defender) and ingestion of Microsoft 365, Defender for Cloud Apps, Defender for Identity, and Entra ID Protection telemetry.
How to decide
Three questions:
- Do you have on-call IT staff who actually monitor security alerts at night and on weekends? If no, you need MDR.
- What does an hour of business-day downtime cost you? If it is more than your monthly MDR bill, MDR is cheap insurance.
- Is your cyber-insurance renewal asking for 24/7 SOC coverage? Most 2025 Canadian renewals are. MDR satisfies it and frequently reduces premiums (talk to your broker).
If two of three are "yes," you should be evaluating MDR — not EDR.
Common misconception
"We have antivirus, we are fine." Antivirus matches files against a list of known-bad signatures. Modern attacks — fileless malware, living-off-the-land, identity-driven attacks — never put a file on disk that AV would recognise. The Sophos 2025 Active Adversary Report found compromised credentials were the #1 root cause of attacks for the second year running, at 41% of cases — followed by exploited vulnerabilities (21.79%) and brute force (21.07%). None of these are detected by traditional AV. EDR catches behaviour. MDR catches what EDR could not fire confidently on.
What 4UIT usually recommends
For Ottawa customers, the default stack is Sophos Intercept X EDR on every endpoint, Sophos MDR layered on top, integrated with the firewall and email gateway for XDR correlation. We don't post rate cards publicly — every engagement is shaped differently and we'd rather quote a real number than a marketing one. Customers who deploy this stack rarely regret it.
Want a real quote for your specific environment? Take a brief — 20 minutes, no deck.
On the cyber-insurance side: Sophos's February 2025 Quantifying ROI Report found that organisations using MDR services file cyber-insurance claims with values 97.5% lower than those relying on endpoint protection alone (median $75K vs $3M). The same report found 47% of MDR customers fully recovered from a significant cyberattack within a week, versus 18% for endpoint-protection-only.
Sources: Sophos 2025 Active Adversary Report · Sophos press release: 56% of cases — adversaries logged in · Sophos MDR product page.
// Frequently asked questions
What is the difference between EDR and MDR?
EDR (Endpoint Detection & Response) is software that runs on every laptop and server, watching for threatening behaviour and stopping it. MDR (Managed Detection & Response) is the 24/7 service of trained analysts watching the EDR alerts, hunting for what the EDR missed, and responding when something fires. EDR is the alarm; MDR is the monitoring station.
How fast does Sophos MDR detect threats?
Per Sophos' 2025 Active Adversary Report (covering 2024 cases), median dwell time across all MDR cases was just 1 day for non-ransomware and 3 days for ransomware. By comparison, IR-only cases (no MDR running) had median dwell times of 11.5 days for non-ransomware and 4 days for ransomware.
Do Ottawa SMBs really need MDR or is EDR enough?
If you have on-call IT staff who actively monitor security alerts at night and on weekends, EDR alone may be enough. If you do not — most Ottawa SMBs under 50 employees do not — you need MDR, because the median attacker reaches Active Directory in just 11 hours after initial access (Sophos 2025 Active Adversary Report).
Will my cyber insurer require MDR in 2025?
Increasingly, yes. Most Canadian cyber-insurance renewals in 2025 specifically ask whether 24/7 SOC monitoring is in place, and confirming it materially affects underwriting. Talk to your broker before renewal.
How much does Sophos MDR cost for an Ottawa SMB?
We don't post rate cards publicly — every engagement is shaped differently. The variables that matter: endpoint count, server count, what telemetry sources are in scope (M365, firewall, cloud, identity), tier (MDR Essentials vs. MDR Complete), and contract length. Email or call us for a real quote against your environment.