Sophos Intercept X Advanced with XDR.
Stop the attack, then see exactly how it happened.
Endpoint protection that stops threats other tools miss, then shows your team exactly how the attack
happened. Deep learning malware detection and anti-ransomware pair with extended detection and response
across your endpoints, servers, firewall, and email.
Deep learning AV, anti-ransomware, exploit prevention
Detection & Response
EDR and XDR built in
Managed From
Sophos Central cloud console
Licensing
Per user, volume tiers
Expert Pre-Sales AdviceCertified reps reply in 1 hour.
Config & Managed ServicesSkip the setup. We'll do it.
POs · Tax-Exempt · Net 30Welcomed for Corp, Edu, & Gov.
Same-Day ShippingOrder by 3pm EST, ships today.
Specifications
Intercept X Advanced with XDR at a Glance
Prevention First
Deep learning malware detection stops known and unknown threats without leaning on signatures.
Exploit prevention blocks the techniques attackers reuse across zero-days, and
CryptoGuard shuts down ransomware and rolls encrypted files back to their last safe
state.
Detection and Response
EDR lets your team hunt active adversaries and run guided investigations. XDR widens that view beyond
the device, pulling in signal from your endpoints, servers, firewall, email, and cloud
so you can trace an attack end to end. Root cause analysis shows how it started.
Platform Support
Protects Windows, macOS, and Linux desktops and laptops, plus Windows Server. Server
workloads are covered by a separate product, Intercept X Advanced for Server with XDR, so you license
desktops and servers on the terms that fit each.
Licensing and Deployment
Licensed per user in volume tiers (1-9, 10-24, 25-49, 50-99, and up) on 1, 2, or 3
year terms. New buyers and teams switching from another vendor (Competitive Upgrade) both have options.
Runs from Sophos Central, so there are no on-prem servers to deploy.
Not sure which Intercept X tier you need?
Compare Intercept X Advanced, Advanced with XDR, and Advanced for Server side by side to see which level of
detection and response fits your team and budget.
It is licensed per user, not per device. A single user license covers the computers
that person works on, so if someone runs a laptop and a desktop you still count one user. Pricing is
set in volume tiers (1-9, 10-24, 25-49, 50-99, and higher), so you buy for the number of people you
need to protect rather than a raw device count. If you are unsure how your team maps to the tiers, ask
us and we will size it for you.
Intercept X Advanced is the prevention layer: deep learning malware detection,
exploit prevention, and CryptoGuard anti-ransomware that stop most threats before they run. Advanced
with XDR adds endpoint detection and response (EDR) plus extended detection and response (XDR) on top
of that, so once something is blocked or looks suspicious your team can investigate it, hunt for
related activity, and see how far it reached across endpoints, servers, firewall, and email. If you
want visibility and threat hunting, not just prevention, XDR is the tier to pick.
This product covers user endpoints such as desktops and laptops. Servers are
protected by a separate product, Intercept X Advanced for Server with XDR, which is built for server
workloads and licensed on its own. A lot of teams run both and manage them together in Sophos Central.
Tell us how many users and how many servers you have and we will quote the right mix.
Yes. Sophos offers Competitive Upgrade licensing for teams moving off another
endpoint or antivirus product, and it is available across the same user tiers and terms. If you are
coming from a tool like a legacy AV suite or another EDR platform, mention your current vendor when
you request a quote and we will check whether the Competitive Upgrade pricing applies to you.
It protects Windows, macOS, and Linux devices, along with Windows Server, and
everything is managed from the cloud through Sophos Central. That means no management server to
install on your side. If you need to cover cloud instances or a mixed fleet, we can confirm the right
coverage before you buy.
Yes, they do different jobs. Your firewall guards the network edge, while Intercept X
protects the device itself, including laptops that leave the office and users clicking links in email.
You are not duplicating effort. In fact, when a Sophos firewall and Intercept X share the same Sophos
Central account they exchange signal through Synchronized Security, so a threat seen on one can
trigger a response on the other. XDR then ties that firewall and endpoint data into one investigation.
Talk to a Sophos-certified expert
Tell us how many users you need to cover and we will help you land on the right tier and term, new or
Competitive Upgrade. Firewalls.com is a Sophos Platinum Partner, so you get certified advice and straight
pricing.
