Sophos
UK-based Sophos sells both firewalls and Intercept X for endpoints. Used together, an infected PC is cut off the network automatically. Sophos MDR adds a 24/7 monitoring team. Everything lives in Sophos Central.
- Headquarters
- United Kingdom
- Positioning
- EntryMid-marketEnterprise
- Official website
- www.sophos.com
Who it suits
Companies with 30-300 PCs, no in-house security team, and a need for someone to watch ransomware alerts overnight.
Overview
Sophos today
Sophos is a British company headquartered in Abingdon, near Oxford, and has been owned by the investment firm Thoma Bravo since 2020. In February 2025 it completed the purchase of Secureworks and its Taegis XDR platform, which made Sophos one of the largest providers of MDR (24/7 managed detection and response) in the world.
How the product families fit together
- Sophos Firewall runs on XGS Series hardware: second-generation desktop models (XGS 88 to 138, with 2.5 GbE ports and an optional 5G module on some) for branches and small offices, and 1U and 2U models for head offices. The current firmware is SFOS v22, released at the end of 2025.
- Intercept X protects PCs and servers, including CryptoGuard anti-ransomware that rolls back files that were encrypted.
- Sophos MDR and Sophos XDR: either Sophos analysts watch and respond for you, or your own team does it with the same tools.
- Sophos Email, Sophos ZTNA, and Sophos switches and access points are managed from the same place.
Everything lives in Sophos Central, a cloud management console.
Why they work best together
When both the firewall and Intercept X come from Sophos, an infected PC is isolated from the network automatically (Synchronized Security and Active Threat Response) until it is cleaned. For organizations with nobody watching a screen at night, that is the main benefit.
Licensing is by annual subscription. Firewalls are sold with bundles such as Xstream Protection; endpoint and MDR are priced per user or device. Sophos fits best at companies with 30 to 300 PCs and no security team of their own.
Strengths
- With the firewall and Intercept X together, an infected machine is cut off from the network on its own, without waiting for someone to click a button.
- Sophos MDR puts analysts on watch 24/7 who can act on an incident immediately, which suits organizations with one or two IT staff.
- Firewall, endpoint, email, switches and Wi-Fi are all managed from Sophos Central, with no management server to install.
- The new XGS desktop models have 2.5 GbE ports and some take a 5G module, useful as a backup link at branches with a single fiber line.
Things to know before choosing
- Many of the benefits only appear when Sophos supplies both the firewall and the endpoint protection. Use just one and the main selling point disappears.
- Everything is an annual subscription and management depends on Sophos Central in the cloud. It is a poor fit if your organization needs fully offline systems.
- Older XG appliances and some first-generation XGS models have reached end of sale or end of life. Check the dates before renewing a licence on old hardware.
- Sophos access points (AP6 series) are Wi-Fi 6 and 6E, with no Wi-Fi 7 model yet and fewer options than specialist Wi-Fi brands. For hotels or large halls, use a dedicated Wi-Fi vendor.
Using it in Laos
Sophos matches the shape of many Lao organizations: 50 to 200 PCs, one or two IT staff, and nobody watching the systems at night. Ransomware tends to start on a Friday night or during a holiday, which is why MDR is the part that really earns its keep.
What we see on sites:
- Purchasing: XGS hardware and licences are ordered through distributors in Thailand. Licences activate the same day; hardware that is not in stock can take several weeks.
- Power: desktop models run on an external adapter. Always use a UPS and surge protection.
- Internet: Sophos Central and MDR need internet access. Branches with frequent outages should have a 4G/5G backup link.
- Language: the MDR team works in English. Someone in your organization must be able to take the call and make decisions during an incident.
Good fits: mid-sized private companies, hotels, private hospitals, international schools and multi-branch retail.
Compared with alternatives
Fortinet is the better pick if SD-WAN and VPN across many branches matter most and you want high performance for the money. WatchGuard is a close alternative for small businesses, especially when you want MFA (AuthPoint) on VPN logins. If you only need light antivirus for older PCs and don't care about a matching firewall, ESET is enough. Choose Sophos when you want firewall, endpoint and a 24/7 monitoring team from one vendor.
Product lines
- Sophos Firewall
- Sophos Intercept X
- Sophos MDR
- Sophos XDR
- Sophos Email
- Sophos ZTNA
- Sophos Central
Solutions that use this brand
Next-Generation Firewall (NGFW)A firewall that knows which app and which user, with IPS, web filtering, HTTPS inspection and VPN, sized on real all-features-on…
Endpoint Protection & EDREDR that watches behaviour, not just virus lists. It stops ransomware mid-run and cuts an infected PC off the network at once.
Email SecurityStop phishing, fake boss and fake supplier emails (BEC) and malicious attachments with filtering, SPF/DKIM/DMARC and sandboxing.
Secure Remote Access (VPN/ZTNA)Staff and contractors reach internal systems from anywhere through VPN or ZTNA with MFA, seeing only what they need.
SOC & SIEM MonitoringFirewall, server and endpoint logs in one SIEM, with people watching the alerts and a clear plan for when something happens.
SD-WAN for BranchesProvincial branches run two internet links at once. If one fails, the other takes over within seconds, and everything is…
Security Awareness TrainingStaff training in Lao, Thai and English using examples they actually see, plus simulated phishing to measure real improvement.
Microsoft 365 for BusinessLicensed Exchange email, Teams, OneDrive and Office, with MFA, Intune and Defender switched on from day one, not after the first…
Business Email & DomainDomains (.la, .com) registered in your company's name, and business email with SPF, DKIM and DMARC so mail reaches inboxes and…FAQ
What does Sophos MDR actually do when something happens at night?
Sophos analysts investigate the alert and, within the authority you give them, can isolate a machine, kill a process or remove malicious files straight away, then tell you what they did. Before you start, agree how far they may act on their own and who they should call.
We already have another brand of firewall. Can we use just Intercept X?
Yes. Intercept X and MDR work without a Sophos firewall, and MDR can take logs from many other firewall brands. What you miss is the automatic network isolation enforced by the firewall.
We still run an older Sophos XG. Should we replace it?
Check that model's end-of-life date first. Many XG Series appliances are already past end of support and no longer get new firmware. If you would be renewing for several more years, moving to XGS is usually better value, and most of the configuration can be exported and imported.
All brand names and trademarks belong to their respective owners. Mention does not imply official partnership unless explicitly stated. Products are sourced through legitimate distribution channels.
Send us a floor plan or a few photos of the site
We’ll come back with a few questions, then a first design. The first consultation is free, in Lao, Thai or English, on WhatsApp or our Facebook page.