Standard is the core secure email gateway: anti-spam, anti-malware, and anti-phishing filtering on inbound and outbound mail, quarantine, allow and block lists, SPF, DKIM, and DMARC authentication, and per-user or group policies. Advanced adds the heavier protection most buyers are after: Active Threat Protection with cloud sandboxing and Time-of-Click URL rewriting, phishing impersonation and business email compromise defense, data loss prevention, email encryption, and API-based Microsoft 365 integration. If you need sandboxing, impersonation protection, encryption, or DLP, choose Advanced.

Yes. Sophos Central Email is a standalone cloud service and does not require a Sophos firewall or any other Sophos product. It runs in Sophos Central, so if you already use Sophos firewall or endpoint it shares one console, but many customers run it on its own purely for email protection.

It does. Sophos Central Email protects Microsoft 365, Google Workspace Gmail, on-premises Microsoft Exchange, and effectively any mail platform where you own the domain and control the DNS records. On Microsoft 365 with an Advanced license you can skip MX changes and connect through Sophos Mailflow Rules for faster API-based processing.

It is licensed per user, meaning per mailbox, in user bands across 1, 2, and 3 year terms. You buy the band that covers your user count, so a 40-mailbox company lands in a larger band than a 12-mailbox one. Not sure which band or term fits your seat count? Talk to a Sophos-certified rep and we will size it for you.

Standard blocks the bulk of spam and known phishing with SophosLabs reputation filtering and live threat updates. Advanced goes further against targeted attacks: it rewrites and re-checks links at click time, sandboxes suspicious attachments before they execute, and compares sender display names and domains against your VIPs and commonly spoofed brands to catch impersonation and CEO-style fraud.

Sophos Central Email is a digital license, so there is no hardware to ship. Once your order is processed the license appears in Sophos Central, then you connect your domain by MX record or, on Microsoft 365 Advanced, through Mailflow Rules. If you would rather not touch the setup, our team can configure it for you.