Vai al contenuto
Legal: Banner with Media - Background
For All Users

Licensing Guidelines

This document forms part of the Sophos End User Terms of Use available at https://www.sophos.com/en-us/legal, or other written agreement governing access and use of Sophos products and services. Capitalized terms not separately defined in these Licensing Guidelines have the same meanings as in the Sophos End User Terms of Use, or other written agreement, as applicable.

Sophos Products are licensed or made available by the applicable units specified in the table below. The Schedule issued by Sophos specifies the number of applicable units that the Customer has ordered for each Product.

Sophos reserves the right to change or update these Licensing Guidelines at any time and the updated Licensing Guidelines will be effective when posted on the website.

The following definitions apply to the table below:

Definitions for Sophos Products

1.'Computer' means any device or computing environment which benefits from the Product (for example, but without limitation, workstations, personal computers, laptops, netbooks, tablets, smartphones, and environments connected to an email server, an internet proxy or a gateway device, or a database). The Product does not have to be physically installed on the computer environment to provide benefit, nor is there a requirement for the computing hardware to be owned by the Customer. The term Computer as defined herein includes, without limitation, non-persistent deployments, electronic devices that are capable of retrieving data, and virtual machines.

2. 'Server' means a Computer (i) upon which the Product is installed or (ii) which benefits from the Product, wherein the Computer provides at least one application, client service, or capability.

3. 'User' means an employee, consultant or other individual who benefits from the Product.
NOTE: The Product does not have to be physically installed on the User's computer environment in order to provide benefit to the User.

4. 'Cloud Asset' means a single virtual machine instance (including any server instance or database instance) or container image, within a Cloud Environment that benefits from, or whose configuration is accessed by, the Product. For the purposes of this definition, ‘Cloud Environment’ means an environment facilitating or involved in the delivery of computing services over the internet, including but not limited to Amazon Web Services (AWS) accounts, Microsoft Azure subscriptions, Google Cloud Platform (GCP) projects, Kubernetes clusters, development code repositories, and container registries.

Terms for Products

General exception for Education, Health and Government Entities:

If Licensee or Customer is an educational, health or government entity, Products or Services that are usually licensed or made available on a per User basis may alternatively, at Sophos’ option, be licensed or made available on a per Computer basis, or for email Products only, on a per mailbox basis. If a bundle includes both email and non-email Products, the aforementioned licenses must be the higher of the entity’s Computer and mailbox count. If Licensee subsequently transfers such Products or Services to an entity that does not fall within the education, health or government sector then the License Entitlement or Service Entitlement shall revert to calculation on a per User basis.

Number of Computers (Devices) per User:

In the case of Products licensed or made available by User, each User may use a reasonable number of Computers unless a specific cap on Computers per User is stated in the table below. Sophos reserves the right to apply a cap on Computers where usage is deemed unreasonable.

TRIAL/EVALUATION LICENSES

Where permitted, Customer may request a "trial" license or subscription of a commercially available Product for evaluation purposes. In some cases, "evaluation" licenses or subscriptions may be generated automatically by Sophos, in its sole discretion, for Customers of Sophos Central Endpoint Protection and Server Protection Products; for example, in order to enable testing of pre-release features and Products, and/or for applicable temporary license or subscription extensions.

All such trial/evaluation licenses and subscriptions, whether or not they are labelled as such, are governed by the terms of the Sophos End User Terms of Use, or other written agreement (as applicable) relating to trials/evaluations; are provided for temporary usage only; and may be used for no longer than thirty (30) days unless otherwise specified by Sophos in writing. Note: a non-applicable date of "December 31, 2999" may be displayed in the Sophos Central console for evaluation licenses or subscriptions that are generated by Sophos.

Sophos Product Licensing Model Applicable Unit(s) NOTES.EXCEPTIONS AND APPLICABLE LIMITS 
Sophos Central Products 
Cloud Optix Advanced Subscription Cloud Assets

A subscription includes a maximum number of Cloud Assets.

The following Data Lake use limitations apply:

  • 1MB daily storage per Cloud Asset with a maximum 90 days storage

Sophos  XDR Subscription per Server

Following Data Lake usage limitations apply:

  • 40MB daily storage with a maximum 90 days storage per subscription; and

  • 1,000 daily Data Lake API queries.

Sophos EDR Subscription per Server

Following Data Lake usage limitations apply:

  • 40MB daily storage with a maximum 90 days storage per subscription; and

  • 1,000 daily Data Lake API queries.

Identity Threat Detection and Response Subscription per Server Available to customers with XDR and Managed Detection and Response. 
Sophos Endpoint for Server Subscription per Server N/A 
Sophos XDR Subscription per User

Following Data Lake usage limitations apply:

  • 20MB daily storage with a maximum 90 days storage per subscription; and

  • 1,000 daily Data Lake API queries.

Sophos EDR Subscription per User

Following Data Lake usage limitations apply:

  • 20MB daily storage with a maximum 90 days storage per subscription; and

  • 1,000 daily Data Lake API queries.

Identity Threat Detection and Response Subscription per User Available to customers with XDR and Managed Detection and Response. 
Sophos Endpoint Subscription per User N/A 
Central Mobile Advanced Subscription per User Maximum upload size: 25 MB for documents, 300 MB for apps 
Central Mobile Standard Subscription per User Maximum upload size: 25 MB for documents, 300 MB for apps 
Intercept X for Mobile Subscription per User N/A 
Central Device Encryption Subscription per User N/A 
Central Email Advanced Subscription per User N/A 
Central Portal Encryption Subscription per User Only available as an add-on for Central Email Advanced. 
DMARC Manager Subscription per User Only available as an add-on for Central Email Advanced. 
Email Monitoring System Subscription per User N/A 
Zero Trust Network Access Subscription per User

Two deployment modes available: on premise and Sophos Cloud gateway.

Following usage limitations apply to Sophos Cloud gateway mode:

  • average data transfer of 15GB per month per User.

Network Detection and Response Subscription per User and per Server N/A 
Central Phish Threat Subscription per User Each user who is sent mail from Phish Threat is considered to benefit from the product and requires a User license. 
Sophos Firewall purchased on hardware appliance 
Network Protection Subscription per hardware appliance  
Web Protection Subscription per hardware appliance  
Email Protection Subscription per hardware appliance  
Webserver Protection Subscription per hardware appliance  
Zero-Day Protection (for Sophos Firewall) Subscription per hardware appliance  
Xstream Protection Subscription per hardware appliance

Only applicable to Sophos Firewall

The applicable use limitation(s) for DNS queries are provided below.

Firewall Model Daily Query Limit 
XGS88(w), XGS87(w), XG86(w), Virtual Firewall - 1C4 license 310,000 
XGS108(w), XGS107(w), XG106(w), XG105(w), SG105(w) 390,000 
XGS118(w),XGS116(w), XG115(w), SW115(w), Virtual Firewall - 2C4 license 480,000 
XGS128(w),XGS126(w), XG125(w), SG125(w), Virtual Firewall - 4C6 license 600,000 
XGS138,XGS136(w), XG135(w), SG135(w) 830,000 
XGS2100, XG210, SG210 1,500,000 
XGS2300, XG230, SG230, Virtual Firewall - 6C8 license 1,900,000 
XGS3100, XG310, SG310 3,000,000 
XGS3300, XG330, SG330, Virtual Firewall - 8C16 license 4,800,000 
XGS4300, XG430, SG430 7,400,000 
XGS4500, XG450, SG450 12,000,000 
XGS5500, XG550,SG550, Virtual Firewall - Unlimited license 18,000,000 
XGS6500, XG650, SG650 32,000,000 
XGS7500, XG750 53,000,000 
XGS8500 120,000,000

DNS is not included in any consumption-based licensing.

Standard Protection Subscription per hardware appliance Only applicable to Sophos Firewall 
Central Orchestration Subscription per hardware appliance Only applicable to Sophos Firewall 
FullGuard Subscription per hardware appliance Only applicable to UTM 
Basic Guard Subscription per hardware appliance Only applicable to UTM 
Wireless Protection Subscription per UTM appliance Only applicable to UTM 
Sandstorm (for UTM) Subscription per hardware appliance Only applicable to UTM 
UTM Virtual Software 
FullGuard Subscription per User When a User communicates with or through the gateway (including without limitation DNS and DHCP queries to the gateway and communications both to the Internet and a different LAN segment), their IP address is added to list of licensed devices in the gateway’s local database. If several Users communicate through a single device then every User is counted as a separate User. If an IP address has not been used in the last seven (7) days, it is removed from the database. 
Network Protection Subscription per User 
Web Protection Subscription per User 
Email Protection Subscription per User 
Wireless Protection Subscription per User 
Sandstorm Subscription per User 
Webserver Protection Subscription per User 
Sophos Firewall Virtual Software 
Base License Perpetual per virtual Computer Selection of licenses by number of CPU cores and amount of memory is available 
FullGuard Subscription per virtual Computer 
EnterpriseGuard Subscription per virtual Computer 
Network Protection Subscription per virtual Computer 
Web Protection Subscription per virtual Computer 
Email Protection Subscription per virtual Computer 
Webserver Protection Subscription per virtual Computer 
Xstream Protection Subscription per virtual Computer

The applicable use limitation(s) for DNS queries are provided below.

Firewall model Daily
Query Limit 
XGS87(w), XG86(w), Virtual Firewall - 1C4 license 310,000 
XGS107(w), XG106(w), XG105(w), SG105(w) 390,000 
XGS116(w), XG115(w), SW115(w), Virtual Firewall - 2C4 license 480,000 
XGS126(w), XG125(w), SG125(w), Virtual Firewall - 4C6 license 600,000 
XGS136(w), XG135(w), SG135(w) 830,000 
XGS2100, XG210, SG210 1,500,000 
XGS2300, XG230, SG230, Virtual Firewall - 6C8 license 1,900,000 
XGS3100, XG310, SG310 3,000,000 
XGS3300, XG330, SG330, Virtual Firwall - 8C16 license 4,800,000 
XGS4300, XG430, SG430 7,400,000 
XGS4500, XG450, SG450 12,000,000 
XGS5500, XG550,  SG550, Virtual Firewall - Unlimited license 18,000,000 
XGS6500, XG650, SG650 32,000,000 
XGS7500, XG750 53,000,000 
XGS8500 120,000,000

DNS is not included in any consumption-based licensing. 

Standard Protection Subscription per virtual Computer  
Central Orchestration Subscription per virtual Computer  
Zero-Day Protection Subscription per virtual Computer  
Sophos Central Firewall Reporting 
Central Firewall Reporting Advanced Subscription GB storage capacity per Hardware appliance or per virtual Computer

A subscription includes a maximum number reports generated per Hardware appliance or per virtual Computer as follows:

Report time range Reports generated per month 
Last 24 hours 2000 
Last 7 days 1000 
Last 30 days 200 
Last 90 days 80 
90 days-1 year 20
Other UTM Products 
UTM Endpoint Protection Subscription per User Sold in license packs

 

Managed Services Licensing Model Applicable Unit(s) Notes and Exceptions 
Managed Detection and Response Essentials Subscription per User One subscription includes 1 license to Sophos XDR. 
Managed Detection and Response Complete Subscription per User One subscription includes 1 license to Sophos XDR. 
Managed Detection and Response Essentials Server Subscription per Server One subscription includes 1 license to Sophos XDR. 
Managed Detection and Response Complete Server Subscription per Server One subscription includes 1 license to Central Intercept X Advanced for Server with XDR. 
Managed Risk Subscription per User and per Server

Available to Managed Detection and Response customers.

The following limitations apply per customer:

  • Asset Monitoring: 25 root domains
  • External Vulnerability Scanning: 1,000 IP addresses.
  • Internal Vulnerability Scanning: maximum number of IP addresses at 120% of customer's Managed Risk entitlement.

Emergency Incident Response Subscription per hour N/A 
Incident Response Retainer Subscription N/A Entitlement includes a maximum number of device count applicable to customer's purchase.

 

Integration Pack Add-Ons and Data Retention Licensing Model Applicable Unit(s) Notes and Exceptions 
Central Data Storage 1-year Pack Subscription per User and per Server Available to customers with Sophos XDR license (User and Server). Only data sent to Sophos Data Lake from Sophos XDR-enabled products and from Sophos XDR-enabled products. Central alert, report, threat graph, and audit data are not in scope. Licensed based on combined number of Users and Servers. 

 

Advisory Services Licensing Model Applicable Unit(s) Notes and Exceptions 
Sophos Penetration Testing Subscription per tier Offered in Extra Small, Small, Medium, and Large tiers. 
Sophos Wireless Penetration Testing Subscription per location N/A 
Sophos Web Application Security Assessment Subscription per tier

Offered in Small, Medium, and Large tiers.

 

 

Amazon Web ServicesTM, AWSTM, GCPTM, Google Cloud PlatformTM, KubernetesTM, MicrosoftTM, and Microsoft AzureTM are property of their respective owners. Third-party company, product, and service names are used for identification purposes only, and do not imply endorsement.

Updated: 4 December 2025

Archived Versions