A plain-English guide to Sophos Endpoint, MDR, Firewall, Email, ZTNA, Wireless and Switch for 10- to 100-person organizations, with bundles by company size.
Sophos makes a lot of products, and its website is organized for enterprise buyers. If you run a 10- to 100-person organization and someone has told you "you should look at Sophos," this is the plain-English version: what each product does, which ones a small business actually needs, which ones you can skip, and how to buy them without overpaying. CIRRUS is a Sophos partner, and this is the advice we give our own clients in Maryland, DC and Northern Virginia.
Three reasons. First, everything is managed from one cloud console, Sophos Central, so a small team (or your MSP) can see endpoints, firewall, email, Wi-Fi and switches in one place. Second, the products talk to each other: when the endpoint agent detects a compromised laptop, the firewall can isolate it automatically, a feature Sophos calls Synchronized Security. Third, Sophos sells through partners, which means a small business gets the same product an enterprise gets, with the MSP handling deployment and monitoring.
This is the agent on every laptop, desktop and server. It combines next-generation antivirus, behavioral ransomware protection with automatic file rollback, exploit prevention and, in the Advanced tiers, endpoint detection and response (EDR) and XDR for investigating what happened across devices. If you buy one Sophos product, buy this one, and buy the tier that includes EDR. Signature-only antivirus doesn't stop modern attacks, and most cyber insurance applications now ask specifically whether you have EDR.
Server protection is licensed separately and includes the same capabilities tuned for Windows and Linux servers.
EDR produces alerts. An alert nobody reads at 2 a.m. is worth nothing. Sophos MDR (managed detection and response) is Sophos's own 24/7 team that investigates and responds to threats on your behalf, including taking action to contain them. It's priced per user and is the fastest way for a small business to get round-the-clock coverage.
If you work with a managed service provider that already runs a 24/7 security operations center, that team may monitor Sophos alerts for you instead. Either way, do not deploy EDR without a human on the other end. We walked through why 24/7 coverage is impossible to build in-house for a small company in our MSP cost comparison.
The XGS hardware line ranges from desktop units for a small office to rack-mounted appliances. For most small businesses the entry and mid-range desktop models are the right fit, including models with built-in Wi-Fi for offices that don't need separate access points. What you're really buying is the Xstream Protection subscription on top of the box: intrusion prevention, web filtering, application control, TLS inspection, sandboxing of downloads, and the Synchronized Security link to your endpoints.
Buy the firewall when you have an office with on-premises equipment, a server, VoIP phones or a need to control what employees can reach from the office network. A fully remote company with no office can often skip it in favor of ZTNA (below).
Sophos Email adds AI-based phishing detection, impersonation protection, time-of-click link scanning, attachment sandboxing and post-delivery cleanup on top of your mail platform's built-in filtering. Deploys through the Microsoft 365 or Google Workspace API in minutes. Pair it with Sophos Phish Threat, the simulation and awareness-training module, if you don't already run a training program. We covered the broader category in our AI email protection guide.
Traditional VPNs put a remote laptop fully onto your network. Sophos ZTNA (zero trust network access) gives each user access only to the specific applications they're allowed to use, checks device health before connecting, and runs through the same endpoint agent, so there's nothing extra to install. If you still have a server or internal application that remote staff reach over a VPN, this is the upgrade to plan for.
Sophos's access points and switches are solid, cloud-managed from Sophos Central, and inherit the firewall's security policies. They are worth it if you're refreshing an office network anyway and want one console for everything. They are not a security necessity; good access points and switches from other vendors work fine with a Sophos firewall. Buy them for simplicity, not because you have to.
DNS Protection blocks connections to malicious domains at the DNS layer for any device on your network and is inexpensive insurance against malware that slips past the endpoint. Sophos Mobile manages and protects phones and tablets; it matters for organizations that issue company phones or allow company email on personal devices and need to enforce encryption and remote wipe.
Sophos is sold through partners on one- or three-year subscriptions. Three-year terms are meaningfully cheaper per year. A partner handles licensing, deployment, policy configuration and renewals, and a managed service provider will typically fold the licenses into your monthly agreement so there is one bill and one team accountable for it.
The costly mistake is letting a license lapse. When an endpoint or firewall subscription expires, protection degrades or stops while the agent and the box keep sitting there looking fine. A lapsed endpoint license is one of the most common findings in our new-client assessments, and it's usually discovered during a security questionnaire or an incident. Put renewal dates in a calendar, or hand renewals to a partner whose job it is to track them.
Yes. The single-console management, partner-delivered support and MDR option make it one of the more practical enterprise-grade stacks for organizations without an internal security team. The main alternatives in the same tier each have strengths; the right choice usually comes down to what your MSP can monitor and support well.
Not necessarily. Endpoint protection is the priority. The firewall adds network-level filtering and the Synchronized Security automation, which is valuable when you have an office network with shared resources. A remote-first team can start with endpoint, MDR and email and add the firewall later.
Pricing is set through partners and varies with tier, term length and user count, so there is no public list price that applies to everyone. As a rough guide, endpoint protection with EDR runs a few dollars per user per month, MDR adds to that, and a small-office firewall is a one-time hardware cost plus an annual Xstream subscription. Ask for a three-year quote and a one-year quote side by side.
Yes. CIRRUS is a Sophos partner and deploys, configures, monitors and renews Sophos Endpoint, MDR, Firewall, Email, ZTNA, Wireless and Switch for clients across Maryland, DC and Northern Virginia as part of our managed IT and security services. Contact us for a quote or a review of your current Sophos licensing.
CIRRUS runs IT, security and websites for organizations across Maryland, DC and Virginia. Tell us what you are working on and we will point you in the right direction.
