In short: Sophos licensing through Forever Systems covers Sophos Endpoint, EDR, XDR, MDR, ITDR, NDR, Firewall subscriptions, Email, Phish Threat, Workspace Protection, Mobile and Device Encryption. Endpoint, detection and MDR products are licensed per user with separate server licences, Email per mailbox and Firewall per appliance, billed monthly or on a fixed term.
What Sophos does
Sophos is a cyber security vendor headquartered in Abingdon, Oxfordshire. It is best known for endpoint protection (the product long sold as Intercept X), but its range now covers detection and response, a 24/7 managed detection and response service, identity and network threat detection, firewalls, email security, secure access and mobile management.
Almost everything is run from one cloud console. That console was called Sophos Central for years; Sophos now describes Sophos Fusion as the evolution of Sophos Central, with the new name arriving in consoles over the coming months. Sophos says Fusion is not a separate product or SKU and there is nothing extra to license. In 2025 Sophos acquired Secureworks, and its XDR product is now sold as Sophos XDR Powered by Secureworks.
This page is about licensing: what you count, which edition does what and how to buy. For product depth, deployment guides and comparisons, see our specialist site, Sophos Intercept X UK.
The Sophos product line-up
Each product below has its own licensing page on this site. You can start with one and add others to the same Sophos account later.
| Product | What it does | Licensed by |
|---|---|---|
| Sophos Endpoint | Prevention-first protection: deep learning anti-malware, anti-exploitation and CryptoGuard anti-ransomware | User; server |
| Sophos EDR | Endpoint plus threat hunting, investigation and Live Response | User; server |
| Sophos XDR | EDR plus third-party data, correlation and an AI Assistant for investigations | User; server |
| Sophos MDR | 24/7 managed detection and response, in MDR and MDR Plus tiers | User; server |
| Sophos ITDR | Identity threat detection for Entra ID and Active Directory | Add-on, quoted on your directory |
| Sophos NDR | Network detection and response from a passive sensor | Users and servers |
| Sophos Firewall | Base Licence, protection subscriptions and the Xstream Protection bundle | Appliance |
| Sophos Email | Email security for Microsoft 365 and Google Workspace | Mailbox |
| Sophos Phish Threat | Phishing simulation and awareness training | User |
| Workspace Protection | Protected Browser, ZTNA, DNS Protection and Email Monitoring System | Highest user or device count |
| Sophos Mobile | Mobile device management and mobile threat defence | User |
| Device Encryption | Central management of BitLocker and FileVault | User, counted separately |
How Sophos licensing works
Sophos sells subscriptions, not perpetual licences. What you count depends on the product:
- Users: Sophos Endpoint, EDR, XDR and MDR are licensed per user, so a person who signs in to a laptop and a desktop uses one licence. Usage is calculated separately for each licence type, and a device that has been offline for more than 30 days stops counting while it is inactive.
- Servers: Windows and Linux servers, virtual machines and cloud workloads need their own server licences.
- Mailboxes: Sophos Email counts individual and shared mailboxes. Aliases, distribution lists and public folders do not need a licence.
- Appliances: Sophos Firewall subscriptions are added to a specific firewall once it has been claimed in your Sophos account.
Add-ons such as Next-Gen SIEM, ITDR and NDR extend XDR and MDR, while Device Encryption and Workspace Protection sit alongside your endpoint licences. Through Forever Systems most Sophos products can be billed monthly on the users and servers you protect, or bought on a fixed term if you prefer a set renewal date. See monthly vs annual licences for the trade-offs.
Recent Sophos name changes
Sophos has renamed a lot recently, so older quotes and renewal notices may not match what you see today:
| Older name | Current name |
|---|---|
| Central Intercept X Advanced | Sophos Endpoint |
| Intercept X Advanced for Server | Server protection, which Sophos now markets as Sophos Workload Protection |
| Intercept X Advanced with XDR | Sophos XDR, now Powered by Secureworks |
| Sophos MDR Essentials | Sophos MDR |
| Sophos MDR Complete | Sophos MDR Plus |
| Sophos Central | Sophos Fusion (name arriving in consoles over the coming months) |
| Central Mobile Standard | Sophos Mobile Device Management |
| Central Mobile Advanced | Sophos Mobile |
| Intercept X for Mobile | Sophos Mobile Threat Defense |
| Sandstorm Protection (firewall) | Zero-Day Protection |
| Sophos Central Device Encryption | Sophos Device Encryption |
A rename on its own does not mean redeploying anything: Sophos says existing workflows carry on under the Fusion name. If your renewal notice still shows an older name, send it to us and we will map each line to the current licence before we quote.
Buying Sophos through Forever Systems
We set Sophos up in your organisation's name and manage the licensing from there.
- Scope: we count users, servers, mailboxes and firewalls, and check what you already own and when it renews.
- Recommend: we match the tier to your team. Endpoint suits organisations with good IT cover, EDR and XDR suit those with people to investigate alerts, and MDR suits those who want Sophos to watch around the clock.
- Quote: ask us for a quote, monthly or on term.
- Deploy: we create or take over the Sophos account, deploy agents and set policies.
- Manage: we add and remove users, upgrade tiers mid-term and handle renewals, all on one invoice with your other software.
If you are already a Sophos customer, we can take over the licences at renewal without reinstalling anything.
Explore Sophos
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Sophos licensed per user or per device?
Mostly per user. Sophos Endpoint, EDR, XDR, MDR, Mobile and Phish Threat count users, so one licence covers all of a person's computers. Servers need their own server licences, Sophos Email counts mailboxes and Sophos Firewall subscriptions are added to each firewall.
Is Sophos Central being replaced?
It is being renamed. Sophos describes Sophos Fusion as the evolution of Sophos Central, and the new name is arriving in consoles over the coming months. Sophos says Fusion is not a separate product, SKU or platform, there is nothing extra to license, and existing workflows continue.
Why does my Sophos renewal show different product names?
Because Sophos has renamed many products. Intercept X Advanced is now Sophos Endpoint, MDR Essentials and MDR Complete are now Sophos MDR and MDR Plus, Sandstorm is now Zero-Day Protection and Sophos Central is becoming Sophos Fusion. Send us your renewal notice and we will map each line to the current licence.
Can you renew my existing Sophos licences?
Yes. Send us your current renewal notice or licence summary and ask us for a quote. We can renew like for like, change tiers or move you to monthly billing at the same time.
Do you sell Microsoft licences on this site?
No. Sophos XDR and MDR integrate with Microsoft security tools, but Microsoft subscriptions are handled by Forever Group's Microsoft licensing team.