Secureworks Taegis Managed XDR Cost in 2026

The Taegis platform architecture

Taegis is Secureworks's cloud-native security analytics platform, built to ingest telemetry from endpoint (Secureworks's own EDR plus third-party EDR including CrowdStrike, SentinelOne, Microsoft Defender), network (firewalls, NDR sensors), identity (Active Directory, Okta, Azure AD), cloud workloads (AWS, GCP, Azure), and applications. The platform applies Secureworks-developed detection content driven by Counter Threat Unit intelligence and offers an investigation surface for both Secureworks SOC analysts and customer security teams.

Taegis is sold in three tiers: Taegis XDR (the platform alone, customer operates), Taegis ManagedXDR (Secureworks SOC operates the platform on the customer's behalf, 24/7), and Taegis MDR (ManagedXDR plus included Counter Threat Unit threat hunting). The progression maps to customer maturity: organisations with internal SOC capability and existing detection-engineering function can run Taegis XDR; organisations wanting outsourced operations land on ManagedXDR; organisations wanting outsourced operations plus proactive hunting land on MDR.

The platform architecture is genuinely cloud-native and competitive with peers (Microsoft Sentinel, Panther, Hunters). The structural strength is integration depth across multiple telemetry sources rather than endpoint-only. The structural weakness historically has been less aggressive product velocity than cloud-native pure-plays like Panther or Hunters; the Sophos acquisition is expected to bring more investment, though the realised impact through 2026 is still emerging.

Pricing detail and tier comparison

The per-host model scales linearly with deployment size, which is favourable for organisations with predictable host counts and unfavourable for organisations with rapidly growing infrastructure (the bill rises with growth without negotiation). Multi-year contracts typically carry 15-25% discounts; enterprise-scale deals (5,000+ hosts) often unlock further 10-15% volume discounts.

The Sophos acquisition context

Sophos completed acquisition of Secureworks in early 2025, combining Sophos's existing SMB-focused MDR portfolio (Sophos MDR, Sophos XDR) with Secureworks's enterprise-focused Taegis platform and Counter Threat Unit intelligence. The strategic intent is to span SMB through enterprise with a single product family, with Sophos brands serving the SMB tier and Taegis serving the mid-market through enterprise tier.

For current Secureworks customers, the practical impact through 2026 has been platform investment continuity, product road-map consolidation (some overlap between Sophos and Secureworks portfolios is being reduced), and uncertainty about long-term branding. Customers in active procurement should verify which Taegis tier they are buying, whether the Counter Threat Unit team is delivering hunting on their account, and what platform commitments the combined entity is making for 2027 and beyond.

Reference checks with Secureworks customers who renewed in 2024 and early 2025 are particularly important during this transition. The risk is not that Taegis disappears, but that customer-facing service quality dips during the integration window and that platform feature investment shifts in directions specific Secureworks customers did not anticipate.

Where Secureworks Taegis fits

The strongest competitive positioning is mid-market to lower-enterprise (1,000 to 10,000 hosts) customers with multi-source telemetry needs (endpoint plus identity plus cloud plus network) and a preference for cloud-native platform plus 24/7 outsourced operations. The per-host pricing is competitive in that range, the platform handles diverse telemetry well, and the CTU intelligence is genuinely differentiating.

Less good fits include very small organisations (under 500 hosts) where the platform overhead is large relative to scope and Huntress or Sophos MDR (now under the same parent) are more cost-effective, and large enterprises (above 25,000 hosts) where per-host pricing becomes expensive relative to flat-rate enterprise MSSPs or in-house build. Organisations with significant existing Splunk investment usually prefer co-managed Splunk (Deepwatch, Trustwave) over a parallel Taegis deployment.

For broader MDR market context see the cross-portfolio MDR cost reference. For competitive Secureworks alternatives see the Expel, eSentire, and Arctic Wolf cost pages.

Related pages

Frequently Asked Questions