Sophos XGS firewalls: sized from a survey, deployed remotely, managed around the clock.

XGS is the current-generation hardware, introduced from 2021, with the Xstream architecture adding a dedicated Flow Processor for TLS decryption and deep packet inspection, which materially improves SSL inspection performance over the XG generation. The software is Sophos Firewall OS on both, so configuration knowledge transfers. The XG line is no longer sold as new hardware; the replacement path is XGS, which is why XG estates reaching end of support land on this page.

Both are credible. Sophos wins for businesses adopting the Sophos ecosystem, Intercept X endpoint, MDR and Sophos Central management, because Synchronized Security delivers real operational value: a compromised laptop isolated at the firewall automatically. Fortinet wins where FortiClient is already deployed or FortiManager-scale management is required. For most US mid-market buyers the difference comes down to which ecosystem your team will commit to operating, and we will compare both honestly for your environment.

The standard bundle covers the core: IPS, anti-malware and web protection. Xstream Protection adds the capabilities compliance-driven industries usually need, TLS inspection at scale, sandboxing of unknown files, and zero-day protection, plus the ZTNA module. For financial services under the FTC Safeguards Rule, healthcare, and anyone whose cyber insurance application asks about encrypted traffic inspection, Xstream is normally the right tier. For general small business use the standard bundle is often sufficient. We assess it during sizing and confirm current bundle contents at quote time, because Sophos adjusts them.

Sophos MDR, formerly Managed Threat Response, is a 24/7 threat-hunting and response service delivered by Sophos analysts. They monitor firewall, endpoint, server, email and cloud telemetry and respond to confirmed threats within agreed parameters. It is worth it for businesses without an internal security operations function, which is most of the mid-market. We integrate MDR with our own managed service so there is one accountable owner: Sophos handles round-the-clock detection, we handle the remediation and the changes that follow.

Yes, via the ZTNA module. ZTNA is identity-aware and per-application, so remote workers get access only to the specific applications they need rather than the whole network, with device health checked before access is granted. It integrates with Microsoft Entra ID for SSO and conditional access, which matters if the rest of your identity stack is Microsoft. Migrating from legacy SSL-VPN to ZTNA is typically a 4-6 week project run alongside the firewall deployment, and the security posture improvement is real.

Sophos XGS supports high availability pairs, active-passive on most of the range and active-active on the larger rack models. For business-critical deployments we recommend an HA pair, sized during the survey. Failover is fast enough that sessions survive, and the second unit is the difference between a firmware update at 2am being routine and being a maintenance window your whole company notices.

The firewall covers a meaningful portion of the network controls those frameworks ask about: segmentation for PCI DSS card-data environments, network separation a HIPAA risk analysis expects between clinical and administrative systems, the encryption and monitoring expectations of the FTC Safeguards Rule, and the boundary protection families in NIST 800-171 for CMMC-bound contractors. We document the control mapping during deployment so your auditor or assessor gets configuration evidence rather than a brochure. Your compliance advisors own the interpretation; we own the controls.

Sophos XGS hardware is designed for years of service, and Sophos publishes end-of-sale and end-of-support dates per model. We track those dates for managed clients and flag refresh timing well ahead, so a replacement is a planned line item rather than a surprise. Sophos Firewall OS upgrades are delivered under an active subscription, and hardware refresh typically aligns to capacity outgrowing the current model rather than the hardware failing.

Yes. Common migrations include Cisco ASA, Fortinet FortiGate, Palo Alto, Check Point and older Sophos XG units. The work is policy translation rather than copying, because a rule base accumulated over years always contains entries that match nothing, plus VPN rebuild, SSL certificate handling and log continuity. A typical migration is several days of engineering plus one scheduled off-hours cutover, driven remotely with your on-site contact handling the physical swap.

Hardware is a one-time purchase and the protection bundle is an annual subscription per appliance, with Sophos MDR optional on top. Our design, deployment and management services are scoped per engagement with a custom quote after the survey, because the survey is what makes the number honest. Managed clients get 24/7 coverage with a 5-minute P1 response and a monthly report.