It deploys as a virtual appliance on VMware, Microsoft Hyper-V, KVM, and Citrix, and you can also install it on your own x86 Intel hardware or in the cloud through the Microsoft Azure and AWS marketplaces. Sophos ships ready-made images for each platform, an OVF for VMware and Citrix, a VHD for Hyper-V, and a QCOW2 for KVM, so getting it running is quick.

The base license is a one-time purchase that unlocks the core firewall: networking, wireless management, the Xstream architecture, unlimited remote access VPN, site-to-site VPN, and SD-WAN. To add threat protection you layer on a subscription, either the Xstream or Standard Protection bundle or individual modules, on a 1, 3, or 5 year term. It works the same way an XGS hardware appliance does.

The license caps how many CPU cores the firewall will use, in this case up to six virtual cores. As of March 2025 Sophos removed the RAM limit on virtual and software firewalls, so licensing is based on cores alone and you can give the VM as much memory as you like. Actual throughput depends on the cores, RAM, and network cards you assign on the host, so size the VM to your traffic rather than to a fixed number.

Both bundles include Network Protection, Web Protection, and Enhanced 24/7 support. Xstream adds Zero-Day Protection with Sandstorm sandboxing, DNS Protection, and Central Orchestration, and it's the bundle Sophos recommends for full coverage. Standard is the lighter option when you mainly need IPS, web filtering, and application control.

You manage the virtual firewall from Sophos Central, the same cloud console you'd use for your XGS appliances and Intercept X endpoints, which also gives you Synchronized Security and Security Heartbeat. The base license includes 90 days of manufacturer support to get you started, ongoing 24/7 Enhanced support comes with the Xstream and Standard bundles, and you can step up to Enhanced Plus for a higher tier.

Yes. The Sophos Virtual Firewall runs SFOS, the current firewall OS, so moving off an older SG (UTM) or XG means standing up the virtual firewall, importing or rebuilding your configuration, then retiring the old unit. If you're renewing licenses across several Sophos firewalls, we can line up the terms so they co-terminate on the same date, which is a request we handle often.