In short: Sophos Endpoint is Sophos's prevention-first endpoint protection, the product previously sold as Intercept X Advanced. It is licensed per user for computers, so one licence covers all of a person's devices, with separate server licences for Windows and Linux servers and cloud workloads. It is the base of Sophos EDR, XDR and MDR.
What Sophos Endpoint is
Sophos Endpoint is the protection agent at the heart of the Sophos range. It was previously sold as Central Intercept X Advanced; Sophos has dropped the Intercept X label from the licence name. It combines deep learning malware prevention, exploit mitigation, CryptoGuard anti-ransomware with file rollback and Adaptive Attack Protection, which tightens defences automatically when it sees an active attack.
It also includes web protection, web control (including acceptable-use rules for generative AI sites), application control, device control for removable media and Bluetooth, and data loss prevention, so most organisations can replace their antivirus and several separate controls with one agent. For a deeper look at the protection technology, see Sophos Intercept X Advanced on our specialist site.
User and server licences
Sophos licenses computers and servers separately:
| Licence | Covers | Counted by |
|---|---|---|
| Sophos Endpoint (user) | Windows and macOS computers | User: one licence covers all the devices a person signs in to |
| Server protection | Windows and Linux servers, virtual machines and cloud workloads in AWS, Azure, Google Cloud and Oracle Cloud | Server |
The server licence adds protections that matter on servers, such as unauthorised file protection, which stops untrusted executables running, and Linux detection that works without a kernel module, including container runtimes such as Docker, containerd and CRI-O. Sophos now markets server protection as Sophos Workload Protection, and the licence, policy and agent are the same whether the server is on premises, virtual or in the cloud. Remote Desktop Services sessions are covered by the server licence on the host. Sophos also supports legacy Windows and Linux environments, and we check how any older systems in your estate should be licensed. Our specialist page on Intercept X Advanced for Server goes into the server features.
How Sophos Endpoint is licensed
Sophos Endpoint is a subscription. Usage is counted per user and separately for each licence type. A device that has been offline for more than 30 days stops counting while it is inactive, and a device deleted from the console stops counting 30 days after deletion.
- Monthly: through Forever Systems, Sophos Endpoint can be billed monthly on the users and servers you protect, so starters and leavers are reflected without a contract change.
- Fixed term: alternatively buy a set number of licences for a term with one renewal date.
- Upgrades: you can move from Endpoint to EDR, XDR or MDR on the same Sophos agent, so a tier change is a licence and policy change rather than a reinstall.
- Add-ons: Device Encryption and Workspace Protection sit alongside your endpoint licences.
If your renewal still shows Intercept X Advanced or Intercept X Advanced for Server, these correspond to today's Sophos Endpoint and server licences, and we can quote the like-for-like renewal or an upgrade.
Deployment and requirements
Sophos Endpoint is deployed from the Sophos console (Sophos Central, now becoming Sophos Fusion) with a downloadable installer or through your existing software deployment tool. One lightweight agent covers Windows, macOS and Linux. Before installing, your existing antivirus needs to come off; we plan that removal as part of the migration so devices are never left unprotected.
Policies for threat protection, web control, device control and exclusions are set centrally and apply wherever the device is. If you also run Sophos Firewall, Synchronized Security lets the endpoint and firewall share health status so an infected device can be isolated automatically.
Who it suits and how we help
Sophos Endpoint suits organisations that want strong prevention and ransomware rollback with low day-to-day effort, and have an IT team or provider to act on the occasional alert. If nobody watches the console out of hours, consider Sophos MDR instead. Endpoint protection also supports the malware protection control in Cyber Essentials.
We count your computers and servers, check for legacy systems and recommend the tier. Ask us for a quote, and we will deploy the agent, migrate from your current antivirus and handle changes and renewals. Compare other options on our endpoint protection page.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Sophos Endpoint the same as Intercept X?
Yes. Sophos Endpoint is the current licence name for what was sold as Central Intercept X Advanced. The protection technology is the same; the product name on quotes and renewals has changed.
Do servers need a different Sophos licence?
Yes. Windows and Linux servers, including virtual machines and cloud workloads, need a server licence rather than a user licence. Server licences include server-specific protections such as unauthorised file protection, and the same licence covers on-premises and cloud servers.
How many devices does one Sophos Endpoint user licence cover?
Sophos counts licences per user, so a person who signs in to a laptop and a desktop with the same login uses one user licence. Servers are counted separately, and devices offline for more than 30 days stop counting while inactive.
Does Sophos cover Remote Desktop Services sessions?
Yes. Sophos says Remote Desktop Services sessions are supported when the host has a Server Protection licence, and a separate Endpoint Protection licence is not needed for those sessions.