Licensing, the cloud console, jurisdiction, hardware lifecycle, exploit record, MSP Flex billing and where DLP runs, from Sophos's own documents, each with its source.
| Topic | Sophos — from their own documents | Zedmos |
|---|---|---|
| Licensing model | XGS appliance plus a per-device subscription: a base licence on every firewall, with protection sold individually or as Standard Protection (Network, Web and Enhanced Support) and Xstream Protection (adding Zero-Day Protection, Central Orchestration and DNS Protection). Resellers list 1-, 3- and 5-year terms.Sources: Sophos Central licensing guide: SFOS licensing model · Sophos Firewall help: licensing · avanet.com (Sophos reseller): bundles | Software, licensed per firewall. It installs as a package on the OPNsense or pfSense CE box you already run, or from an image as ZedmosOS on x86 hardware you own. No hardware in the licence. |
| Management console | Sophos Central, a cloud console, renamed Sophos Fusion in July 2026. A firewall is registered to it with a Sophos Central account over IPv4 and needs an active paid subscription or support contract. The former on-premises Sophos Firewall Manager was retired as a legacy platform. Multi-tenant MSP management is a separate console, Sophos Central Partner.Sources: sophos.com: Sophos Firewall and Sophos Central · Sophos Central help: managing firewalls · Sophos blog: switching to Sophos Central · Sophos Fusion press release, July 2026 | One console, multi-tenant from the first firewall. Run it as a container on your server under your domain, or use ours at console.zedmos.com, operated from Frankfurt. If it is unreachable, every firewall keeps enforcing. |
| Jurisdiction | Sophos Ltd, incorporated in England and Wales and headquartered in Abingdon near Oxford, privately owned by the US private-equity firm Thoma Bravo since March 2020. Sophos Central data is hosted in AWS data centres in the region chosen at account creation; the data-processing addendum is governed by English law.Sources: sophos.com: legal entities · Thoma Bravo take-private, March 2020 · Sophos sub-processor list · Sophos data processing addendum | A German company. A self-hosted console keeps firewall logs, personal data under the GDPR (CJEU C-582/14), in your own controllership. Our licence and threat-intelligence services run in Frankfurt. |
| Hardware lifecycle | XGS Series hardware is supported for at least five years after End-of-Sale, with up to 90 days' notice of End-of-Sale. The XG Series reached end of life on 31 March 2025; first-generation XGS desktop models entered their post-End-of-Sale phase on 30 September 2025 (end of life 30 September 2030); Sophos UTM on SG hardware reaches end of life on 30 June 2026.Sources: Sophos hardware lifecycle policy · End-of-sale: XGS first-generation desktop appliances · Sophos UTM end of life, 30 June 2026 · Sophos partner news: XG end of life | The support period is the software's: at least five years from placing on the market (CRA Art. 13(8)), published, and independent of any box. The hardware is yours to keep or replace. |
| Exploit record | 7 entries in the CISA Known Exploited Vulnerabilities catalogue (version 2026.09.11), 2 of them flagged for known ransomware use, naming CyberoamOS, SFOS, XG Firewall, SG UTM and the Web Appliance. None were added in 2026.Sources: CISA KEV — Sophos | 0 entries. Published, with our CRA class, an SBOM per release, the disclosure path and the support period, on a page that stays up whatever the number becomes. |
| MSP billing | MSP Flex: consumption-based, billed monthly in arrears, with a minimum monthly commitment of USD 200 after a six-month ramp-up and subject to Sophos's approval. MSP Elevate adds discounts in return for a committed minimum monthly spend over twelve months.Sources: Sophos MSP partner terms and conditions · sophos.com: managed service providers · Sophos partner news: MSP Elevate | MSP tier: multi-tenant, unlimited firewalls, billed monthly in arrears on the month-end count. Your brand on the console and on the box. |
| AI and data loss prevention | Zero-Day Protection sends new files to SophosLabs Intelix, a Sophos-run cloud service combining machine learning and sandboxing; the Sophos AI Assistant lives in the cloud console. On the firewall, DLP is data-control lists in email policies; broader DLP is delivered by the endpoint agent and Sophos Email, configured in Sophos Central.Sources: Sophos Firewall help: zero-day protection · Sophos Firewall help: data control lists · Sophos Central help: endpoint DLP · sophos.com: AI assistant | DLP and the AI gateway run on the box. 61 content detectors; prompts, uploads and files checked before they leave; the model that decides runs on your hardware. |
| Price changes, 2025–2026 | A 20 % increase on all SG/UTM renewal SKUs from 1 June 2025, per Sophos partner news. Authorised resellers report a flat 10 % worldwide increase on XGS hardware and the related subscriptions in 2026, communicated to partners by e-mail.Sources: Sophos partner news, UTM renewal pricing · avanet.com (Sophos reseller): 2026 price increase | No hardware in the price. The licence is not tied to an appliance list, so a hardware price change does not propagate into a renewal. |
| What Sophos has that Zedmos does not | More than 600,000 customers, Sophos MDR protecting 40,000+ organisations from nine regional SOC teams, Sophos X-Ops with 500+ threat researchers, an endpoint line placed as a Leader in the 2026 Gartner Magic Quadrant for Endpoint Protection Platforms for the 17th time, Gartner Peer Insights Customers' Choice for Network Firewalls 2024, and 24×7 support.Sources: sophos.com: Sophos Firewall · sophos.com: MDR · sophos.com: what is Sophos · Sophos blog: Gartner EPP Magic Quadrant 2026 | None of those. A small German vendor with a published exploit record, a console you own, and a licence that does not care which box it runs on. |
Sophos is a far larger company than Zedmos, with a managed-detection service, an endpoint line and an X-Ops research organisation that Zedmos does not have. The comparison is about how the firewall is licensed, where it is managed from, under whose law, and what the public record says. Every claim on the left carries its source; if one is wrong, write to us and it will be corrected.
Checked: 2026-09-13
Zedmos is compared with Sophos above on licensing, management, jurisdiction, exploit record and what each is delivered as. Zedmos is software on hardware you own, managed from a console you host yourself or use hosted from Frankfurt, licensed per firewall, from a German vendor under EU law, with zero entries in the CISA Known Exploited Vulnerabilities catalogue. The last row of the table is what Sophos has that Zedmos does not.