Both bundles start from the same perpetual base license and include Enhanced Support. Standard Protection adds Network Protection, which covers next-gen IPS, Advanced Threat Protection, Security Heartbeat, and SD-RED VPN, plus Web Protection for filtering and application control. Xstream Protection includes everything in Standard and adds Zero-Day Protection for cloud sandboxing and Central Orchestration for SD-WAN VPN and advanced reporting. If your network carries heavy encrypted traffic or you want zero-day sandboxing, Xstream is the safer pick. For predictable workloads, Standard covers the essentials.

Sophos prices the virtual appliance as a perpetual base license plus an annual protection subscription, so the total depends on your core count, the bundle you choose, and the term. Keep in mind that Sophos license and renewal products can only be activated in the United States. Request a quote and a Sophos-certified rep will price the exact configuration you need, usually within the hour.

The virtual firewall runs the same Sophos Firewall OS as the XGS hardware line, so you get the same features and the same Sophos Central management. Go virtual when you already run VMware, Hyper-V, KVM, or Citrix and want to consolidate onto existing hosts, scale without buying a box, or protect cloud and hybrid networks. Choose XGS hardware when you need dedicated Xstream FastPath acceleration and a fixed set of physical ports. If you are weighing the two, tell us your environment and we will point you to the right fit.

The 8 core and UNL RAM package is supported on VMware, Microsoft Hyper-V, KVM, and Citrix. You can also run the SFOS software image on your own Intel based server. Sophos publishes deployment guides for each platform, and our team can walk you through the setup if you would rather hand it off.

The license is scoped by the number of virtual CPU cores you assign, in this case up to eight. In early 2025 Sophos removed the RAM cap on virtual and software licenses, so this configuration runs with unlimited memory and you allocate as much as your host can give it. Match the core count to your expected traffic and user load. If you outgrow it, your subscription can move up to a larger core tier.

Yes. Protection subscriptions renew in 1, 3, and 5 year terms, and you can renew before expiry to avoid a gap in coverage. Keep the base license active and layer on the bundle or individual modules you need. Send us your serial or existing license details and we will line up the correct renewal.