Xstream Protection bundles together the full Sophos threat protection stack: IPS, advanced threat protection, deep learning malware analysis, real-time cloud sandboxing, TLS 1.3 inspection, DNS protection, and AI-powered threat intelligence from SophosLabs. It also includes Sophos Central management at no extra cost, which lets you manage your entire XGS fleet from one cloud console, push firmware updates across all your appliances, and zero-touch deploy new units shipped directly to a branch office.

Standard Protection covers the base firewall features plus Xstream SD-WAN, ZTNA, and network visibility. Xstream Protection adds the full threat protection stack on top: IPS, advanced threat protection, deep learning, real-time sandboxing, TLS 1.3 inspection, and DNS protection, along with Sophos Central management. For most networks that handle encrypted traffic and need active threat inspection, Xstream Protection is the recommended bundle.

Sophos Central is a single cloud console that manages all your Sophos products, including XGS firewalls, switches, and wireless access points. You can configure changes and push them to a group of firewalls at once or manage each appliance individually. Central also handles scheduled firmware updates, cloud backup with up to five stored copies, and zero-touch deployment for new hardware shipped directly to a remote office. Central management is included at no extra cost with any Xstream Protection or Standard Protection bundle.

Yes. Sophos Firewall OS supports any-to-any backup and restore with a port mapping assistant, so you can migrate your full configuration to new hardware without rebuilding policies from scratch. Customers upgrading from XG Series appliances also receive free license overlap during the transition period so you are not paying for two subscriptions at once. Our certified pre-sales team can help you plan the migration and make sure nothing falls through the cracks.

The right fit depends on your user count and throughput requirements. The Gen.2 XGS desktop series covers most SMB and branch scenarios from roughly 5 to 500 users, with models ranging from the compact fanless XGS 88 up to the XGS 138 with dual 10 GE SFP+ ports. The 1U rackmount series covers mid-market and distributed enterprise environments from roughly 250 to 3,000 users. The 2U series handles data center and campus edge requirements for larger organizations. Our certified pre-sales team can review your network specs and size the right appliance and protection bundle.