Sophos licensing is the set of terms under which Sophos sells access to its endpoint, extended detection and response (XDR), email, network and firewall security products and its managed and advisory security services. One agreement, the Sophos End User Terms of Use, governs access to Sophos software, cloud services and security services. The contracting party is Sophos Technology Limited for customers in the United States, Canada and Latin America, and Sophos Limited for everyone else.[2] The Terms grant a non-exclusive, non-transferable licence for the Product Term, solely for the customer’s internal information security purposes.[2] How much a customer may use is set by two documents together. The Schedule states the number of units ordered. The Licensing Guidelines state which unit applies to each product.[1] Most products managed in Sophos Fusion are subscriptions per User or per Server. Firewall subscriptions are per hardware appliance or per virtual Computer.[1] The management console, previously called Sophos Central, is now Sophos Fusion.[7] For the general models, see named user licensing and subscription and consumption licensing.
Editions
Sophos publishes no public price list. Its partner news and product documentation name the licence tiers. In October 2025 Sophos dropped “Intercept X” from its endpoint product names. “Central Intercept X Advanced” became “Sophos Endpoint – User” and “Central Intercept X Advanced for Server” became “Sophos Endpoint – Server”. The change covers all Sophos Endpoint and Sophos XDR licences.[9] The same announcement ended sales of Intercept X Essentials and added a Sophos EDR tier.[9]
| Product family | Tiers named in Sophos documents | Licensing unit |
|---|---|---|
| Endpoint and server | Sophos Endpoint, Sophos EDR, Sophos XDR (User and Server)[1] | Per User; per Server[1] |
| Managed services | Managed Detection and Response, MDR Plus, Managed Risk[1] | Per User and per Server[1] |
| Sophos Email, Sophos Email Plus, add-ons[10] | Per User; counted by users and shared mailboxes[10] | |
| Workspace | Workspace Protection (Protected Browser, ZTNA, DNS Protection, Email Monitoring System)[1] | Per User, at the highest of three counts[1] |
| Firewall | Base License plus Xstream Protection, Standard Protection or individual subscriptions[7] | Per hardware appliance; per virtual Computer[1] |
| Advisory services | Incident response retainers, penetration testing, red team exercises[1] | Per hour, per tier or one-time[1] |
| Taegis | Taegis XDR, VDR and MDR tiers[1] | Per User; per asset (VDR)[1] |
Catalog SKUs record the price-list codes Sophos has published, for example Sophos Endpoint – User (CIXA) and the Xstream Protection bundle. Product-level detail is in Sophos endpoint, XDR and email licensing, Sophos MDR and security services licensing and Sophos Firewall licensing.
Metrics
| Sophos term | Catalog row | Definition (Licensing Guidelines) |
|---|---|---|
| User | User | An employee, consultant or other individual who benefits from the Product; it need not be installed on that person’s device.[1] |
| Server | Server | A Computer on which the Product is installed or which benefits from it and which provides at least one application, client service or capability.[1] |
| Computer | Computer | Any device or computing environment that benefits from the Product, installed or not, owned by the customer or not, including non-persistent deployments and virtual machines.[1] |
| per hardware appliance | Hardware appliance | Unit for firewall and UTM subscriptions bought on Sophos hardware.[1] |
| per virtual Computer | Virtual Computer | Unit for Sophos Firewall Virtual Software; licences are selected by CPU cores and memory.[1] |
| Mailbox | Mailbox | Sophos Email counts individual users and shared mailboxes; aliases, distribution lists and public folders are free.[10] |
The Terms define the Use Level as the Entitlement on the Schedule measured in the unit or meter from the Licensing Guidelines. A customer that wants more must buy more Entitlement first.[2] Catalog: Use Level is the Entitlement measured in Licensing Guidelines units.
Counting / floors
Users and devices. A per-User licence lets each User use a reasonable number of Computers, unless the product table sets a cap. Sophos may impose a cap where usage is unreasonable.[1] In Sophos Fusion a device is associated with one user at a time, and usage is calculated separately for each licence type.[6] Catalog: Reasonable number of Computers per User; Usage is calculated per user and per license type.
The console count is not the contract. Sophos says that where the in-product calculation differs from the EULA definition, the EULA definition takes precedence. Sophos Fusion also does not enforce the licence limit, because the calculation may be inaccurate.[6] Devices offline for more than 30 days drop out of the reported count.[6] A licence manager should therefore count Users and Servers as the Licensing Guidelines define them, and not simply copy the Fusion licensing page. Catalog: EULA definition prevails over the in-product usage count; Devices offline for more than 30 days stop counting.
Floors. The Licensing Guidelines publish no general minimum quantity. Minimums appear in programs and services instead. MSP Flex has a USD 200 monthly minimum commitment.[5] MDR requires Service Software on at least 80% of licensed volume.[3]
Education, health and government. For these sectors Sophos may, at its option, license per-User products per Computer instead, or per mailbox for email products. If such an entitlement is transferred to an organization outside those sectors, it reverts to per-User counting.[1] Catalog: Education, health and government per-Computer option.
Virtualization & partitioning
Sophos has no processor or partitioning rules. Virtualization matters in two places. First, the Computer definition expressly includes virtual machines and non-persistent deployments, so every virtual desktop that benefits from a per-Computer product counts.[1] Second, Remote Desktop Services sessions are covered by a server licence, and no endpoint licence is needed for them.[6] Virtual firewalls are licensed by the maximum number of CPU cores they will use.[11] Catalog: Computer includes virtual machines and non-persistent deployments; Virtual firewall licences limited by CPU cores only. See virtualization and partitioning.
Cloud / BYOL
Sophos Fusion products are cloud services, so the customer does not host the management platform. Sophos Firewall can run on virtual, software and cloud platforms. Its Base Firewall licence does not expire on cloud, virtual and software appliances.[8] See Sophos Firewall licensing for cloud (BYOL) instances and core-based sizing.
Programs
- MSP Flex and MSP term licenses. MSPs use the Managed Service Provider Agreement. MSP Flex partners are billed monthly in arrears for actual usage across all their Beneficiaries, with a minimum commitment. Other MSPs buy advance subscriptions for each Beneficiary.[5] See Sophos MSP Flex and partner licensing.
- Trials. A Trial Product may be used for 30 days unless Sophos agrees otherwise in writing.[2] After a Fusion trial expires, the same product cannot be trialled again for 30 days.[12]
- Free products and home use. Free Products and Home Use Licenses are provided as is. Home use is limited to the licensee’s own non-commercial personal use.[2]
- MDR Plus Breach Protection Warranty and Enhanced and Enhanced Plus Support are covered in the MDR and firewall articles.
Contract terms
Restrictions. Customers may not resell, sublicense, rent, lease or distribute the Product, or provide it on a timesharing or service bureau basis. They also may not disable or get around any monitoring or billing mechanism.[2] Assignment needs Sophos’s prior written consent, which will not be unreasonably withheld.[2] Catalog: Licence limited to internal information security purposes; Assignment or transfer needs Sophos consent.
Which version applies. Unless Sophos says otherwise, changes to the Terms apply to Entitlements acquired or renewed after the change. A material change that takes effect earlier gives the customer 30 days to terminate, with a pro rata refund.[2] Updated Licensing Guidelines take effect when posted. An archived version applies to entitlements acquired or renewed before 2022-01-17.[1] Catalog: Changes to the terms apply to Entitlements acquired or renewed later.
Expiry and end of life. When the Agreement ends, all rights end and the customer must destroy its copies of the Product.[2] The right to use a Product and its features is subject to the Sophos end-of-life policy, and the customer is responsible for reviewing it.[2] Owning a Sophos appliance gives no rights to its Software.[4] Catalog: On termination or expiry all rights end and copies must be destroyed; Use rights subject to the Sophos end-of-life policy; Owning the appliance gives no rights to the Software.
Service hours. Pre-purchased Security Service hours that are not used expire twelve months after purchase.[2] Catalog: Unused pre-purchased Security Service hours expire after 12 months.
Audits and compliance
The Terms combine telemetry, invoicing and a limited audit right. The customer acknowledges that Sophos may monitor the Product to track usage and Entitlement.[2] If the customer exceeds its Use Level, it must pay any invoice for the excess issued by Sophos or a Partner.[2] Sophos may audit only where tracking the Use Level is not possible. On request the customer must certify its aggregate usage. Sophos pays for the audit unless it shows underpayment of more than 5% of fees due. In that case the customer buys the missing Entitlement, pays for past excess use and reimburses reasonable audit costs.[2] Sophos may also suspend a Service immediately if the customer breaches the Use Level clause.[2] MSPs face a stronger clause: an audit of premises and books no more than once a year.[5] Catalog: Audit only where usage cannot be tracked; 5% underpayment shifts costs; Sophos monitors Products to track usage and Entitlement; Service may be suspended for exceeding the Use Level. For the general discipline, see software license audit and license compliance.
Some over-deployment has consequences outside licensing. Sophos may deny a claim under the MDR Plus Breach Protection Warranty if the customer has deployed more endpoints than its licence covers. See Sophos MDR and security services licensing.
Out of scope
- Prices. Sophos does not publish list prices; partners quote them.
- Signed enterprise agreements, public-sector contract vehicles and cloud marketplace private offers, which override the web terms and were not retrievable.
- The archived Licensing Guidelines for entitlements acquired or renewed before 2022-01-17, and legacy on-premises products that have reached end of life.
- Consumer products under the Sophos Consumer Terms of Service.
- Taegis products in depth. They appear in the Licensing Guidelines, but their service descriptions are not analysed here.