Sophos antivirus for business

What Sophos antivirus is today

Sophos has sold business antivirus for a long time, but the product names have changed several times. Today the business product is Sophos Endpoint, which was previously sold as Central Intercept X Advanced. Sophos has dropped the Intercept X label from the licence name, though many people still call it Intercept X, and the protection technology is the same.

Sophos Endpoint is much more than signature-based antivirus. Sophos describes it as prevention-first protection that stops threats before they run, adapts when it sees an active attack and rolls back files encrypted by ransomware. Everything is managed from Sophos's cloud console, long called Sophos Central and now called Sophos Fusion.

This page covers Sophos for businesses only. Sophos's home products are separate and are not something we supply. For product depth, deployment guides and edition detail, our specialist site covers Sophos Intercept X and Sophos Endpoint.

Sophos antivirus features

The features that matter most to a business buyer, as Sophos describes them:

• AI and deep learning prevention: Sophos uses several AI models to identify known and never-seen malware before it runs, without relying only on signatures.
• Exploit mitigation: Sophos's exploit mitigations are switched on by default and apply to every running process, with no per-application set-up.
• CryptoGuard anti-ransomware: detects malicious encryption, blocks the process responsible and reverts the affected files to their original state.
• Adaptive Attack Protection: when Sophos detects an attacker at work, the endpoint switches automatically to a more aggressive protection stance.
• Web protection and web control: blocks traffic to malicious or suspicious websites and lets you allow, warn or block by website category, including generative AI.
• Application and device control: blocks risky applications by category, and monitors or blocks removable media, Bluetooth and mobile devices.
• Data loss prevention: monitors and restricts the transfer of files containing sensitive data, for example through web-based email.

That breadth is why many organisations replace a traditional antivirus and several separate controls with one Sophos agent. Our guide to next-generation antivirus explains how techniques such as deep learning and behaviour monitoring differ from signature-based antivirus across vendors.

Sophos antivirus for servers

Servers need their own Sophos licence. Windows and Linux servers, virtual machines and cloud workloads are covered by server protection, which Sophos now markets as Sophos Workload Protection. The licence, policy and agent are the same whether the server is on premises, virtual or in a public cloud.

The server licence adds protections that matter on servers, such as unauthorised file protection, which stops untrusted executables running. Remote Desktop Services sessions are covered by the server licence on the host, so you do not need separate user licences for those sessions.

For the server features in depth, see Sophos Intercept X for Server on our specialist site. For general advice on server exclusions for applications such as SQL Server and Exchange, see our server antivirus guide.

Sophos antivirus for Linux

Sophos protects Linux servers under the server licence. Sophos's Linux detection works without a kernel module and covers container runtimes, including Docker, containerd and CRI-O, which makes it suitable for modern Linux hosts as well as traditional servers.

The Sophos Endpoint user licence covers Windows and macOS computers; Linux is licensed as a server workload. If you run Linux desktops as well as servers, tell us, and we will confirm how they are covered for your estate. Our guide to Linux antivirus compares Linux support across the vendors we supply.

How Sophos antivirus is licensed

Sophos Endpoint is a subscription, counted differently from most other vendors:

Usage is counted separately for each licence type, and a device that has been offline for more than 30 days stops counting while it is inactive. Through Forever Systems, Sophos Endpoint can be billed monthly on the users and servers you protect, or bought on a fixed term with one renewal date; we confirm the options at quote. There is no price list here: ask us for a quote. Our licensing site explains Sophos Endpoint licensing, and our guide to business antivirus cost explains how per-user and per-device models compare.

From antivirus to EDR, XDR and MDR

Sophos Endpoint is the base of the Sophos range. Sophos EDR, Sophos XDR and Sophos MDR all run on the same agent, so moving up is a licence and policy change rather than a reinstall. Sophos MDR is a managed service run by Sophos's own analysts; it is Sophos's service, not ours.

If you are deciding whether you need more than antivirus, start with our EPP vs EDR guide. For detection and response in depth, see our EDR, XDR and MDR guidance on endpointsecurity.uk, and for Sophos's managed service, Sophos MDR on our specialist site.

Sophos or Microsoft Defender?

Many organisations comparing Sophos already have Microsoft Defender Antivirus built into Windows, and some have Defender for Business through Microsoft 365. Our page on whether Windows Defender is enough covers the general question, and our specialist site compares Sophos vs Microsoft Defender directly.

Sophos Endpoint also supports the malware protection control in Cyber Essentials, alongside the other vendors we supply.

How we help

We can count your users and servers, check for legacy systems, recommend whether Sophos Endpoint alone or an EDR or MDR tier fits, deploy the agent, remove your previous antivirus and handle changes and renewals on your Forever Systems account. If you are comparing Sophos with other options, see our endpoint protection vendors page.

Contact us with your user and server numbers and what you run today.