What subscriptions do I need for Sophos NGFW?
Posted on 10 August 2026 by Beaming SupportThe Sophos XGS includes the Standard Protection bundle and a few extra a-la-carte modules. Based on the business’ needs, please see the breakdown below:
The Base Firewall license include:
- Networking & SD-WAN: Basic routing, traffic shaping, and application-aware routing.
- VPN: Unlimited Site-to-Site and Remote Access VPN (IPsec and SSL).
- Wireless: Management for Sophos wireless access points.
- Xstream Architecture: Hardware acceleration for trusted traffic to improve performance
Optional subscriptions:
- Network Protection: Provides Intrusion Prevention (IPS) to block hacks, Sophos X-Ops for real-time threat intelligence, and SD-RED management for connecting remote branch offices securely.
- Web Protection: Inspects web traffic for malware, provides Application Control (e.g., blocking specific apps like BitTorrent), and allows you to enforce web filtering policies based on categories or keywords.
- Enhanced Plus Support: This is a step up from Standard support. It includes 24/7 phone/email support, firmware updates, and an advanced hardware replacement warranty.
A la carte modules:
- Zero-Day Protection (Formerly Sandstorm): Uses AI and cloud-based sandboxing to execute and analyze unknown files before they enter your network. Protects against brand-new malware and ransomware that haven’t been seen by standard antivirus databases yet.
- Email Protection: Provides Anti-spam, Antivirus, and Data Loss Prevention (DLP) specifically for your mail traffic. Essential if you host an on-premise email server (like Exchange) to block malicious attachments and spam at the gateway.
- Web Server Protection (WAF): Acts as a Web Application Firewall to protect web servers hosted behind your firewall. If you have public-facing websites or portals, it protects them from SQL injection, cross-site scripting, and other common hacks.
- Central Orchestration: Enables advanced cloud-based management features, including SD-WAN VPN Orchestration. Allows you to create complex VPN mesh networks with a few clicks and provides 30 days of advanced cloud reporting.
- NDR Essentials for Firewall: Uses cloud-hosted machine learning to analyse network patterns and identify Indicators of Compromise (IoCs) like lateral movement. Helps detect attackers who are already inside the network and communicating with “command and control” servers.
- Enhanced Plus Support: An upgrade from your standard “Enhanced Support”. Includes VIP support with higher priority, consultative setup assistance, and an advanced hardware replacement warranty for your XGS.
How Beaming can support your Next Generation Firewall
Having experts provide an additional layer of oversight alongside your internal team can help reduce risk and ensure your firewall continues to meet the needs of your business.
When you trust Beaming to manage your firewalls, we can take over your existing firewall infrastructure or design and deploy a new secure network from the ground up. The service includes discovery, auditing, deployment, migration support, ongoing management and responsive support from Beaming engineers.
Find out more about our Managed Firewall Services
Beaming experts share more advice in the knowledge base
This content is brought to you by the Helpdesk Support Team, who provide the backbone for our specialist UK internet service provider.
Being part of this technical-led ISP, the team is committed to constantly sharing their practical, expert advice on reliable connectivity, troubleshooting, and cyber security to help UK organisations maintain secure and smooth operations.