Skip to Content

This document forms part of the Sophos End User Terms of Use available at https://www.sophos.com/en-us/legal, or other written agreement governing access and use of Sophos products and services. Capitalized terms not separately defined in these Licensing Guidelines have the same meanings as in the Sophos End User Terms of Use, or other written agreement, as applicable.

Sophos Products are licensed or made available by the applicable units specified in the table below. The Schedule issued by Sophos specifies the number of applicable units that the Customer has ordered for each Product.

Sophos reserves the right to change or update these Licensing Guidelines at any time and the updated Licensing Guidelines will be effective when posted on the website.

The following definitions apply to the table below:

Definitions for Sophos Products

1.'Computer' means any device or computing environment which benefits from the Product (for example, but without limitation, workstations, personal computers, laptops, netbooks, tablets, smartphones, and environments connected to an email server, an internet proxy or a gateway device, or a database). The Product does not have to be physically installed on the computer environment to provide benefit, nor is there a requirement for the computing hardware to be owned by the Customer. The term Computer as defined herein includes, without limitation, non-persistent deployments, electronic devices that are capable of retrieving data, and virtual machines.

2. 'Server' means a Computer (i) upon which the Product is installed or (ii) which benefits from the Product, wherein the Computer provides at least one application, client service, or capability.

3. 'User' means an employee, consultant or other individual who benefits from the Product.

NOTE: The Product does not have to be physically installed on the User's computer environment in order to provide benefit to the User.

4. 'Cloud Asset' means a single virtual machine instance (including any server instance or database instance) or container image, within a Cloud Environment that benefits from, or whose configuration is accessed by, the Product. For the purposes of this definition, ‘Cloud Environment’ means an environment facilitating or involved in the delivery of computing services over the internet, including but not limited to Amazon Web Services (AWS) accounts, Microsoft Azure subscriptions, Google Cloud Platform (GCP) projects, Kubernetes clusters, development code repositories, and container registries.

Terms for Products

General exception for Education, Health and Government Entities:

If Licensee or Customer is an educational, health or government entity, Products or Services that are usually licensed or made available on a per User basis may alternatively, at Sophos’ option, be licensed or made available on a per Computer basis, or for email Products only, on a per mailbox basis. If a bundle includes both email and non-email Products, the aforementioned licenses must be the higher of the entity’s Computer and mailbox count. If Licensee subsequently transfers such Products or Services to an entity that does not fall within the education, health or government sector then the License Entitlement or Service Entitlement shall revert to calculation on a per User basis.

Number of Computers (Devices) per User:

In the case of Products licensed or made available by User, each User may use a reasonable number of Computers unless a specific cap on Computers per User is stated in the table below. Sophos reserves the right to apply a cap on Computers where usage is deemed unreasonable.

TRIAL/EVALUATION LICENSES

Where permitted, Customer may request a \"trial\" license or subscription of a commercially available Product for evaluation purposes. In some cases, \"evaluation\" licenses or subscriptions may be generated automatically by Sophos, in its sole discretion, for Customers of Sophos Central Endpoint Protection and Server Protection Products; for example, in order to enable testing of pre-release features and Products, and/or for applicable temporary license or subscription extensions.

All such trial/evaluation licenses and subscriptions, whether or not they are labelled as such, are governed by the terms of the Sophos End User Terms of Use, or other written agreement (as applicable) relating to trials/evaluations; are provided for temporary usage only; and may be used for no longer than thirty (30) days unless otherwise specified by Sophos in writing. Note: a non-applicable date of \"December 31, 2999\" may be displayed in the Sophos Central console for evaluation licenses or subscriptions that are generated by Sophos.

Sophos ProductLicensing ModelApplicable Unit(s)NOTES.EXCEPTIONS AND APPLICABLE LIMITS
Sophos Central Products
Cloud Optix AdvancedSubscriptionCloud Assets

A subscription includes a maximum number of Cloud Assets.

The following Data Lake use limitations apply:

  • 1MB daily storage per Cloud Asset with a maximum 90 days storage
Central Intercept X Advanced for Server with XDRSubscriptionper Server

Following Data Lake usage limitations apply:

  • 40MB daily storage with a maximum 90 days storage per subscription
  • 1,000 daily Data Lake API queries.
Central Intercept X Advanced for ServerSubscriptionper ServerN/A
Central Intercept X Essentials for ServerSubscriptionper ServerN/A
Central Server ProtectionSubscriptionper ServerN/A
Sophos Capsule8 ProtectSubscriptionper ServerN/A
Sophos Capsule8 Protect+Subscriptionper ServerN/A
Sophos Capsule8 CompleteSubscriptionper ServerN/A
Central Intercept X Advanced with XDRSubscriptionper User

Following Data Lake usage limitations apply:

  • 20MB daily storage with a maximum 90 days storage per subscription
  • 1,000 daily Data Lake API queries.
Central Intercept X AdvancedSubscriptionper UserN/A
Central Endpoint Intercept XSubscriptionper UserN/A
Central Intercept X EssentialsSubscriptionper UserN/A
Central Endpoint ProtectionSubscriptionper UserN/A
Central Mobile AdvancedSubscriptionper UserMaximum upload size: 25 MB for documents, 300 MB for apps
Central Mobile StandardSubscriptionper UserMaximum upload size: 25 MB for documents, 300 MB for apps
Intercept X for MobileSubscriptionper UserN/A
Central Device EncryptionSubscriptionper UserN/A
Central Email StandardSubscriptionper UserN/A
Central Email AdvancedSubscriptionper UserN/A
Central Portal EncryptionSubscriptionper UserOnly available as an add-on for Central Email Advanced.
Zero Trust Network AccessSubscriptionper User

Two deployment modes available: on premise and Sophos Cloud gateway.

Following usage limitations apply to Sophos Cloud gateway mode:

  • average data transfer of 15GB per month per User.
Network Detection and ResponseSubscriptionper User and per ServerN/A
Central Phish ThreatSubscriptionper UserEach user who is sent mail from Phish Threat is considered to benefit from the product and requires a User license.
UTM and Sophos Firewall purchased on hardware appliance
FullGuardSubscriptionper hardware appliance 
EnterpriseGuardSubscriptionper hardware appliance 
Network ProtectionSubscriptionper hardware appliance 
Web ProtectionSubscriptionper hardware appliance 
Email ProtectionSubscriptionper hardware appliance 
Wireless ProtectionSubscriptionper UTM appliance 
Webserver ProtectionSubscriptionper hardware appliance 
Sandstorm (for UTM)Subscriptionper hardware appliance 
Zero-Day Protection (for Sophos Firewall)Subscriptionper hardware appliance 
BasicGuardSubscriptionper hardware appliance 
Xstream ProtectionSubscriptionper hardware appliance 
Standard ProtectionSubscriptionper hardware appliance 
Central OrchestrationSubscriptionper hardware appliance 
UTM Virtual Software
FullGuardSubscriptionper UserWhen a User communicates with or through the gateway (including without limitation DNS and DHCP queries to the gateway and communications both to the Internet and a different LAN segment), their IP address is added to list of licensed devices in the gateway’s local database. If several Users communicate through a single device then every User is counted as a separate User. If an IP address has not been used in the last seven (7) days, it is removed from the database.
Network ProtectionSubscriptionper User
Web ProtectionSubscriptionper User
Email ProtectionSubscriptionper User
Wireless ProtectionSubscriptionper User
SandstormSubscriptionper User
Webserver ProtectionSubscriptionper User
Sophos Firewall Virtual Software
Base LicensePerpetualper virtual ComputerSelection of licenses by number of CPU cores and amount of memory is available
FullGuardSubscriptionper virtual Computer
EnterpriseGuardSubscriptionper virtual Computer
Network ProtectionSubscriptionper virtual Computer
Web ProtectionSubscriptionper virtual Computer
Email ProtectionSubscriptionper virtual Computer
Webserver ProtectionSubscriptionper virtual Computer
Xstream ProtectionSubscriptionper virtual Computer

The applicable use limitation(s) for DNS queries are provided below.

Firewall modelDaily
Query Limit
XGS87(w), XG86(w), Virtual Firewall - 1C4 license310,000
XGS107(w), XG106(w), XG105(w), SG105(w)390,000
XGS116(w), XG115(w), SW115(w), Virtual Firewall - 2C4 license480,000
XGS126(w), XG125(w), SG125(w), Virtual Firewall - 4C6 license600,000
XGS136(w), XG135(w), SG135(w)830,000
XGS2100, XG210, SG2101,500,000
XGS2300, XG230, SG230, Virtual Firewall - 6C8 license1,900,000
XGS3100, XG310, SG3103,000,000
XGS3300, XG330, SG330, Virtual Firewall - 8C16 license4,800,000
XGS4300, XG430, SG4307,400,000
XGS4500, XG450, SG45012,000,000
XGS5500, XG550, SG550, Virtual Firewall - Unlimited license18,000,000
XGS6500, XG650, SG65032,000,000
XGS7500, XG75053,000,000
XGS8500120,000,000

DNS is not included in any consumption-based licensing.

Standard ProtectionSubscriptionper virtual Computer 
Central OrchestrationSubscriptionper virtual Computer 
Zero-Day ProtectionSubscriptionper virtual Computer 
Sophos Central Firewall Reporting
Central Firewall Reporting AdvancedSubscriptionGB storage capacity per Hardware appliance or per virtual Computer

A subscription includes a maximum number reports generated per Hardware appliance or per virtual Computer as follows:

Report time rangeReports generated per month
Last 24 hours2000
Last 7 days1000
Last 30 days200
Last 90 days80
90 days-1 year20
Other UTM Products
UTM Endpoint ProtectionSubscriptionper UserSold in license packs
Managed ServicesLicensing ModelApplicable Unit(s)Notes and Exceptions
Managed Detection and Response EssentialsSubscriptionper UserOne subscription includes 1 license to Central Intercept X Advanced with XDR.
Managed Detection and Response CompleteSubscriptionper UserOne subscription includes 1 license to Central Intercept X Advanced with XDR.
Managed Detection and Response Essentials ServerSubscriptionper ServerOne subscription includes 1 license to Central Intercept X Advanced for Server with XDR.
Managed Detection and Response Complete ServerSubscriptionper ServerOne subscription includes 1 license to Central Intercept X Advanced for Server with XDR.
Managed RiskSubscriptionper User and per ServerAvailable to Managed Detection and Response customers.
The following limitations apply per customer:
- 25 domains for asset monitoring

- 1,000 IPs for vulnerability scanning.
Rapid ResponseSubscriptionper User and per ServerOne subscription includes 1 license to Central Intercept X Advanced with XDR endpoint or server.
Compromise AssessmentSubscriptionper ComputerOne subscription includes a 7 day subscription to analysis of bands of Computers (5, 10, or 20 Computers).
Incident Response RetainerSubscriptionN/AEntitlement includes a maximum number of device count applicable to customer's purchase.
Integration Pack Add-Ons and Data RetentionLicensing ModelApplicable Unit(s)Notes and Exceptions
Network Detection and ResponseSubscriptionper User and per ServerAvailable to customers with Managed Detection and Response and Central Intercept X Advanced with XDR licenses (User and Server).
Public Cloud Integration PackSubscriptionper User and per Server
Email Integration PackSubscriptionper User and per Server
Firewall Integration PackSubscriptionper User and per Server
Network Integration PackSubscriptionper User and per Server
Back-up and Recovery Integration PackSubscriptionper User and per Server
Central Data Storage 1-year PackSubscriptionper User and per ServerAvailable to customers with Central Intercept X Advanced with XDR license (User and Server). Only data sent to Sophos Data Lake from Sophos XDR-enabled products and from Integration Pack(s) are in scope. Central alert, report, threat graph, and audit data are not in scope. Licensed based on combined number of Users and Servers.
Sophos FactoryLicensing ModelApplicable UnitNotes and Exceptions
Sophos Factory ProSubscriptionper creditCredits reset monthly.
Sophos Factory EnterpriseSubscriptionper creditCredits reset monthly.

Amazon Web ServicesTM, AWSTM, GCPTM, Google Cloud PlatformTM, KubernetesTM, MicrosoftTM, and Microsoft AzureTM are property of their respective owners. Third-party company, product, and service names are used for identification purposes only, and do not imply endorsement.

Updated: 8 July 2024

Archived Versions