Sophos ITDR
Sophos ITDR: A focused identity defense add-on for organizations already using Sophos XDR or MDR. Ranked #8 of 25 in Identity Threat Detection and Response Software by our editors (8.4/10); pricing: Pricing on request · 30-day trial; best for sophos customers adding identity threat defense.
At a glance
- Editor score8.4 / 10
- PricingPricing on request · 30-day trial
- Best forSophos customers adding identity threat defense
- Free planNo
- Credential theft detectionYes
- Founded1985 · Oxford, United Kingdom
- Facts checked20 Sep 2026
Where it wins
- Monitors Microsoft Entra ID and on-premises Active Directory
- Combines credential monitoring, identity cataloging, and risk scoring
- Automates actions such as password resets and account locking
Where it doesn't
- Requires Sophos XDR or Sophos MDR as an add-on
- No perpetual free plan; access is through a 30-day trial
- Support is currently limited to Germany, Ireland, and US data regions
Our verdict on Sophos ITDR
Sophos ITDR is a cloud identity security product for organizations that need visibility across human and machine identities. It monitors Microsoft Entra ID and on-premises Active Directory for identity risks, misconfigurations, and suspicious activity. Its coverage includes compromised credentials, privilege escalation, account takeover, abnormal user behavior, and MITRE ATT&CK Credential Access detections. Sophos customers are the clearest fit, particularly teams already using Sophos XDR or Sophos MDR.
The product is positioned as an add-on rather than a standalone offering. Pricing uses a contact-sales model, and the available trial lasts 30 days; there is no perpetual free plan. Its strongest ecosystem fit is within Sophos XDR and Sophos MDR, while Microsoft Entra ID and on-premises Active Directory form the main directory integrations. This makes ITDR more relevant for organizations aligning identity monitoring with an existing Sophos security environment than for teams seeking an independent identity platform.
Sophos ITDR’s main depth is its combination of identity context and response. It catalogs human and non-human identities, assigns identity risk scores, prioritizes findings, monitors dark-web and breach-database credentials, and analyzes user behavior for abnormal activity. Automated responses include password resets and account locking, helping security teams move from detection to containment. The product should appeal to organizations that need coverage across cloud and on-premises directories, credential theft, privilege abuse, and directory attacks. Organizations that do not use Sophos XDR or MDR, or that require a standalone identity threat product, should consider alternatives with a different deployment model.
Your product? Our editors can test Sophos ITDR in depth and publish a review, labelled as paid · from $149/mo →
Sophos ITDR pricing
Sophos ITDR fact sheet
| Free plan | No |
|---|---|
| Paid from | Not verified |
| Credential theft detection | Yes |
| Privilege abuse detection | Yes |
| Directory attack detection | Yes |
| Automated response | Yes |
| Identity coverage | Human_and_machine |
| Data retention | Not verified |
| Free trial | 30 days |
| Deployment | Cloud |
| Platforms | Web |
| Support | Tickets, Community, Docs |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 4 integrations: Sophos XDR, Sophos MDR, Microsoft Entra ID, on-premises Active Directory |
| Pricing | Pricing on request · 30-day trial |
| Website | sophos.com |
| Facts checked | 20 Sep 2026 |
Sophos ITDR integrations
Sophos ITDR lists 4 integrations on its own site.
- Sophos XDR
- Sophos MDR
- Microsoft Entra ID
- on-premises Active Directory
Alternatives to Sophos ITDR
- CrowdStrike Falcon Identity ProtectionBroad hybrid identity defense with detection, enforcement, and automated response.9.4
- AuthMind Advanced Identity Threat Detection and ResponseBroad identity attack-path visibility with detection and automated containment.9.3
- SilverfortBroad identity threat detection and response for hybrid enterprise environments.9.2
See all Sophos ITDR alternatives →
Sophos ITDR vs the competition
- Sophos ITDR vs CrowdStrike Falcon Identity Protection
- Sophos ITDR vs AuthMind Advanced Identity Threat Detection and Response
- Sophos ITDR vs Silverfort
- Sophos ITDR vs Varonis Identity Threat Detection and Response
- Sophos ITDR vs Semperis Identity Resilience Platform
- Sophos ITDR vs Vectra AI Identity Threat Detection and Response
Compare Sophos ITDR with any tool side by side →
Used Sophos ITDR? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Sophos ITDR for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Sophos ITDR is listed in our Identity Threat Detection and Response Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/sophos-itdr/"><img src="https://www.itechguides.com/best/badge/sophos-itdr.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update