Sophos Firewall as a Service
Enterprise-grade Sophos XGS firewalls - hardware, full Xstream Protection licensing, 24/7 Sophos support and lifecycle replacement - for one monthly price. No capital outlay. No licence renewals to track. No surprise refresh costs.
- ✔ Full Xstream Protection licence included on every unit
- ✔ Minimum 12-month term, then rolling 30-day — hardware replacement is on us
- ✔ Add colocation from £60/month per firewall: we rack, power and connect it in our data centre
- ✔ Prefer to own your hardware? Upfront purchase options available too
Choose your firewall - every model, one monthly price
Every subscription includes the appliance, the full Xstream Protection bundle, Sophos Enhanced Support and hardware replacement for the life of the service. Specs below are from official Sophos datasheets.
| Model | Form factor | Firewall | IPS | TLS 1.3 inspection | IPsec VPN | Ports (fixed) | Per month (ex VAT) | |
|---|---|---|---|---|---|---|---|---|
| XGS 88 | Desktop, fanless | 9.9 Gbps | 2.0 Gbps | 600 Mbps | 6.0 Gbps | 4× 2.5GE | £33.24 | Subscribe |
| XGS 108 | Desktop, fanless | 12.5 Gbps | 2.5 Gbps | 800 Mbps | 8.25 Gbps | 6× 2.5GE + SFP | £62.24 | Subscribe |
| XGS 118 | Desktop | 15.5 Gbps | 3.5 Gbps | 1.1 Gbps | 13.0 Gbps | 9× 2.5GE + SFP | £85.36 | Subscribe |
| XGS 128 | Desktop | 19.1 Gbps | 4.65 Gbps | 1.45 Gbps | 15.05 Gbps | 9× 2.5GE + SFP | £123.51 | Subscribe |
| XGS 138 | Desktop, NPU | 19.1 Gbps | 5.85 Gbps | 1.7 Gbps | 6.6 Gbps | 2× 10GE SFP+, 2× 2.5GE PoE, 6× copper | £173.71 | Subscribe |
| XGS 2100 | 1U rackmount | 30 Gbps | 6.0 Gbps | 1.1 Gbps | 17.0 Gbps | 8× GE (bypass pair) + 2× SFP + Flexi bay | £339.58 | Subscribe |
| XGS 2300 | 1U rackmount | 39 Gbps | 7.0 Gbps | 1.45 Gbps | 20.5 Gbps | 8× GE (bypass pair) + 2× SFP + Flexi bay | £478.12 | Subscribe |
| XGS 3100 | 1U rackmount | 47 Gbps | 10.5 Gbps | 2.47 Gbps | 25.0 Gbps | 2× 10GE SFP+, 2× SFP, 8× GE (bypass pair) + Flexi bay | £697.43 | Subscribe |
| XGS 3300 | 1U rackmount | 58 Gbps | 14.0 Gbps | 3.13 Gbps | 31.1 Gbps | 2× 10GE SFP+, 2× SFP, 8× GE (bypass pair) + Flexi bay | £909.56 | Subscribe |
Throughput figures are Sophos datasheet maximums under ideal test conditions. Minimum 12-month commitment on all subscriptions, then rolling 30-day. Not sure which model fits? Ask us for a free sizing recommendation.
Add colocation - your firewall, in our data centre
If your servers already live with us, your firewall should too.
Add colocation to any firewall subscription and we rack, power, cable and connect your XGS appliance in our data centre - directly in front of your colocated hardware, dedicated servers or private cloud. Rack space, power, cross-connects, remote hands and physical security are all included.
Desktop models
XGS 88 - 138, rack mounted
£70/month
per firewall, ex VAT
Rackmount models
XGS 2100 - 3300, 1U
£90/month
per firewall, ex VAT
includes 1U rack space
Why colocate it?
Your firewall sits on the same low-latency fabric as your servers, protected by data-centre power and security - and our engineers are physically next to it if anything ever needs hands-on attention.
Colocation is added at checkout as an optional extra on any firewall subscription and follows the same term as the firewall it accompanies.
Why firewall as a service?
Zero capital outlay
No four-figure hardware invoice and no multi-year licence bill. One monthly operating cost your finance team can forecast to the penny.
Never run unlicensed
Lapsed licences silently strip a firewall of IPS updates, sandboxing and support. Your Xstream Protection licence is bundled into the service - it cannot expire mid-contract.
Hardware lifecycle is our problem
Failed units are replaced under the service. When Sophos end-of-lifes a platform, we refresh the hardware - you're never left sweating an unsupported box.
Scales with you
Outgrow your model? Move up the range on a new term instead of writing off owned hardware.
Prefer to own your firewall?
We also supply every XGS model for outright purchase:
- Appliance + licence upfront — hardware with a 12, 36 or 60-month Xstream licence as a single one-off payment
- Appliance upfront + monthly licence — own the hardware, pay for the licence monthly with no fixed term
Every subscription includes the full Xstream Protection bundle
This is Sophos' complete commercial security stack - the same bundle an enterprise buys - included on every model, for the life of your service.
Network Protection
Next-gen intrusion prevention, Active Threat Response with Sophos X-Ops threat feeds, and Security Heartbeat linking your firewall to your endpoints.
Web Protection
URL filtering, application control and high-performance TLS 1.3 decryption of encrypted traffic - where most modern threats hide.
Zero-Day Protection
Suspicious files are detonated in Sophos' cloud sandbox and analysed by SophosLabs AI before they reach your network.
Email & Web Server Protection
On-box anti-spam and a reverse-proxy web application firewall to shield your published services.
Central Orchestration
SD-WAN VPN orchestration, advanced central reporting and MDR/XDR-ready connectors.
Enhanced Support
24/7 Sophos support, unlimited firmware updates and hardware warranty - on top of our own service cover.
Better together: the Sophos ecosystem
A Sophos firewall is strong alone. Connected to Sophos endpoint and email protection, it becomes a coordinated defence system.
Firewall + Endpoint
Synchronized Security links your firewall to Sophos Intercept X on your devices via Security Heartbeat. When an endpoint is compromised, the firewall sees its health status change and automatically isolates it - stopping lateral movement in seconds, not hours, with no admin intervention.
Firewall + Email
Pair your firewall with Sophos Email Protection and phishing, impersonation and malware defence happens in the cloud before mail ever reaches your network - while the firewall's Zero-Day Protection sandboxes anything that slips through via web or file transfer.
One console for everything
Sophos Central manages your firewalls, endpoints, email, and more from a single cloud console - one pane of glass, one policy framework, and a clean upgrade path to Sophos MDR if you ever want 24/7 human threat hunting on top.
Let's talk Sophos!
We can providing free sizing recommendations, solution designs and help implementation where needed.