Standard Protection covers the core network security features: firewall, IPS, VPN, and reporting. Xstream Protection adds the pieces most teams want on a firewall this size, including the Xstream TLS and DPI engine, Zero-Day sandboxing, Advanced Threat Protection, and Security Heartbeat. If you're inspecting encrypted traffic or want the full threat stack, Xstream is the one to pick. Not sure which fits your environment? Talk to a Sophos-certified rep and we'll walk you through it.

You buy a base license for the virtual appliance plus a protection subscription for the term you want, usually one, three, or five years. There's no monthly bill and no per-seat charge. When the term is up, you renew to keep protection, feature updates, and support active. Request a quote and we'll lay out the base license and bundle options so you can see exactly what's included.

It runs on VMware, Microsoft Hyper-V, KVM, and Citrix for on-premises virtual environments, and in the cloud on AWS and Azure. The license isn't tied to one platform, so you can deploy where it makes sense for your infrastructure. The same Sophos Firewall OS runs across all of them, which keeps management consistent no matter where the appliance lives.

Same software, different delivery. The virtual firewall runs the same Sophos Firewall OS and the same feature set as the XGS hardware line, so policies, VPN, and the Xstream engine all work the way your team already knows. The difference is that a hardware appliance ships with dedicated acceleration and set throughput ratings, while a virtual appliance uses the CPU, memory, and NICs you assign from your host. If you're consolidating onto existing virtual infrastructure, this is the way to get the full Sophos stack without adding a box.

This is the top of the virtual lineup, so it's the pick for high-traffic sites, data centers, and service providers running large or busy virtual estates. Since Sophos removed RAM caps in 2025, virtual licenses are counted by CPU core only, and sixteen cores gives you the most headroom in the range. Sizing still comes down to your real traffic, how many features you run, and whether you inspect a lot of encrypted traffic. Send us your throughput needs and user count and we'll confirm whether 16 cores is right or whether a smaller tier covers you.

When your subscription term ends, you renew the protection bundle to keep threat protection, feature updates, and support running. It's smart to renew before the current term lapses so there's no gap in coverage. We can quote a straight renewal, move you between Standard and Xstream, or line up a multi-year term to lock in your pricing. Reach out ahead of your expiration date and we'll handle the paperwork.