In short: Sophos Workspace Protection combines Sophos Protected Browser, Sophos ZTNA, DNS Protection for endpoints and the Email Monitoring System in one subscription. The licence count is the highest user or device count across the four products, and it is sold standalone or as Sophos Endpoint Plus Workspace Protection, monthly or on a fixed term.
What Workspace Protection is
Sophos Workspace Protection extends Sophos protection to apps, data, staff and guests, including people working on devices you do not fully manage. It brings four products under one licence:
- Sophos Protected Browser: a hardened Chromium-based browser, or a lightweight browser extension, with built-in ZTNA, DNS and local data controls such as restrictions on copy and paste and downloads, plus visibility of shadow IT and AI use.
- Sophos ZTNA: zero trust network access that gives users access only to the applications they need and keeps those applications hidden from everyone else.
- DNS Protection for endpoints: blocks malicious and unwanted web content at the DNS layer for browsers and other web-enabled apps, including DNS over HTTPS.
- Email Monitoring System: works alongside your existing email security, adding visibility of advanced email threats and better reporting.
How each part is counted
| Product | Counted by |
|---|---|
| Sophos Protected Browser | Unique authenticated users over 30 days |
| Sophos ZTNA | Unique authenticated users over 30 days |
| DNS Protection for endpoints | Devices using DNS Protection |
| Email Monitoring System | Mailboxes |
You buy one Workspace Protection quantity, and the licence count is the highest user or device count across the four products. For most organisations that is simply the number of staff, plus contractors and guests who use the Protected Browser or ZTNA.
How Workspace Protection is licensed
There are two ways to buy it:
- Standalone Workspace Protection: the four products, without endpoint protection. Use this alongside another vendor's antivirus; Sophos Endpoint must be bought separately if you want it.
- Sophos Endpoint Plus Workspace Protection: a bundle that adds Sophos Endpoint, with CryptoGuard, anti-exploitation, adaptive defences and deep learning anti-malware, to the four products.
Through Forever Systems it can be billed monthly or bought on a fixed term. Note that the DNS Protection included with the Sophos Firewall Xstream bundle is the standalone, network-level service; DNS Protection on laptops and other endpoints needs Workspace Protection. Ask us for a quote.
Deployment and requirements
ZTNA publishes private applications through gateways you deploy in your network or cloud, with users signing in through your identity provider, such as Microsoft Entra ID. Managed devices use the Sophos agent, and unmanaged or contractor devices can use the Protected Browser. The Protected Browser can be rolled out as a full browser or as an extension to existing Chromium-based browsers. We design the gateway placement and the application access policies with you.
Buying Workspace Protection through Forever Systems
We start by listing the applications people reach through your VPN today and who uses them, including contractors. From that we size the licence, choose standalone Workspace Protection or the Sophos Endpoint bundle, and plan the ZTNA gateways. Ask us for a quote; we then pilot with one team, move the rest across and switch the VPN off once nobody needs it.
Who it suits and how we help
Workspace Protection suits organisations replacing a traditional VPN, those giving contractors or temporary staff access to a few internal applications, and those worried about data leaving through browsers and AI tools. We plan the VPN-to-ZTNA migration, publish applications, set browser data controls and handle licence changes. For product depth see Sophos ZTNA on our specialist site and compare approaches on our SASE, ZTNA and business VPN page.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Sophos ZTNA part of Workspace Protection?
Yes. Workspace Protection includes Sophos ZTNA together with Protected Browser, DNS Protection and the Email Monitoring System, licensed per user.
Does Workspace Protection include endpoint protection?
Not the standalone licence. Choose the Sophos Endpoint plus Workspace Protection bundle if you also need Sophos Endpoint.
How is the Workspace Protection licence count worked out?
Sophos takes the highest user or device count across the products in your bundle. For example, if more devices use DNS Protection than people use ZTNA or the Protected Browser, the DNS Protection device count sets the licence quantity.