You need two things: a perpetual Base License, which covers core firewalling, unlimited IPsec and SSL VPN, and Sophos Central management, plus a protection subscription that turns on the advanced security features. Most buyers pick the Standard Protection or Xstream Protection bundle, which packages the base license and the subscription together for one part number. If you already own a base license, you can buy just the subscription. Not sure which fits? Talk to a Sophos-certified expert and we will size it with you.

Sophos sizes its virtual firewalls by the number of vCPU cores the license allows, not by users. This tier lets you assign 2 cores to the virtual machine. Sophos removed the old RAM restrictions on virtual licenses, so you can give the VM as much memory as your host allows without buying a bigger license. Two cores is a comfortable fit for branch offices, lab and test networks, and smaller cloud workloads. If you expect heavy TLS inspection or high throughput, step up to a 4-core or larger license.

The same SFOS image runs across all the major platforms. On-premises you can use VMware ESXi and vSphere, Microsoft Hyper-V, KVM, or Citrix Hypervisor. In the cloud it is available through the Microsoft Azure Marketplace and on AWS with pay-as-you-go or bring-your-own-license pricing, and it supports Nutanix AHV. You can also install the software directly on your own Intel x86 server. Protection and management work the same way no matter where you run it.

Standard Protection covers the classic gateway security most sites need: next-gen IPS, web protection, application control, plus support and firmware updates. Xstream Protection adds the heavier hitters, including high-performance TLS 1.3 inspection, Zero-Day sandboxing with AI file analysis, Central Orchestration for SD-WAN and multi-firewall management, and DNS Protection. If your network carries a lot of encrypted traffic or you have compliance requirements, Xstream is the one to pick.

Yes. Subscriptions run on 1, 3, or 5-year terms and renew through Sophos Central, and you can move up to a larger core license or a higher bundle when your needs change. One thing to know: Sophos license and renewal products can only be activated in the United States, and pricing is quote-based. As a Sophos Platinum Partner, we can pull current pricing, confirm the right SKU, and get your keys delivered. Request a quote and we will take it from there.