Major License changes across the Sophos portfolio

Sophos has introduced in the fall of 2025 a set of product, licensing, and pricing updates. These changes impact the Sophos Endpoint, XDR, and MDR product families, as well as Email Security and adding the Advisory Services portfolio.

Simplified Naming for Sophos Endpoint, XDR, and MDR Licenses

Sophos has standardized product names by removing the “Central Intercept X” label across various licenses. For example:

• “Central Intercept X Advanced” is now Sophos Endpoint – User
• “Central Intercept X Advanced for Server” becomes Sophos Endpoint – Server

This simplification applies across all Endpoint, XDR, and MDR User and Server subscriptions, making the portfolio easier to navigate for partners and customers alike.

Pricing Adjustments for Sophos XDR

For Sophos XDR pricing now includes all third-party integrations, increasing value while maintaining predictable purchasing.

Introducing the New Sophos EDR License Tier

To create new sales opportunities and address mid-market needs, Sophos is launching a dedicated Sophos EDR tier. This new license combines:

• The defensive strengths of Sophos Endpoint
• The detection and response capabilities traditionally found in Sophos XDR

The new EDR and SVREDR licenses will be available:

• Term subscriptions: November 1, 2025
• MSP Flex: Late January 2026

Nieuwe Sophos Endpoint 100 (EP100) licentie voor kleine bedrijven

Sophos has introduced Sophos Endpoint 100, a fixed-price, term-only license tailored to organizations with up to 100 endpoints and 10 servers. Key advantages include:

• A simplified, highly competitive commercial model
• Predictable margins
• Streamlined selling motions

Beginning December 10, Deal Registration discounts will apply to EP100 without minimum thresholds.

Expanded Sophos Advisory Services Portfolio

Sophos is launching four new expert-led Advisory Services designed to uncover weaknesses in customer environments. Available starting October 1, 2025, these services include:

1. Internal Penetration Testing
2. External Penetration Testing
3. Wireless Penetration Testing
4. Web Application Security Assessment

These services enhance Sophos’ ability to support partners with comprehensive security assessments across attack surfaces.

Integration Packs for XDR and MDR: End of Sale

As all integrations are now bundled natively into Sophos XDR and MDR subscriptions, the standalone Integration Packs are being retired:

• New term: November 1
• Existing term: November 8
• MSP Flex: Late January

This change simplifies procurement while ensuring all customers benefit from complete integration capability.

Sophos Intercept X Essentials: End of Sale

The “Central Intercept X Essentials” (CIXE) and “CIXE for Server” (SVRCIXE) licenses are being discontinued:

• Last order for new term licenses: November 1, 2025
• Last order for existing term renewals: January 7, 2026
• MSP Flex: Available until late January 2026

Following these retirements, Sophos Endpoint (CIXA) becomes the foundational security offering for all customers.

Early Access: Sophos DNS Protection for Endpoints

Sophos has launched an early access program (EAP) for DNS Protection on Windows endpoints, bringing:

• Full visibility into user/device DNS queries
• Support for HTTPS
• Transparent web protection across all ports, protocols, and applications

This new capability strengthens endpoint-level web defense and threat visibility.

Sophos Email Now Includes Sophos Phish Threat

Effective December 10, 2025, Sophos Phish Threat will be automatically bundled with all Sophos Email licenses (CEMA and CEMA-MSP). This integration provides:

• End-to-end protection against email-based attacks
• Embedded user-awareness training
• Improved early detection and reduced human-error risks

Key implications include:

• New Email customers automatically receive both Email and Phish Threat.
• Existing Email customers without Phish Threat will see it added automatically.
• Customers with both products continue as-is.
• At renewal, Term customers only renew Sophos Email, as Phish Threat is included.
• MSPs will be billed only for Email usage when both products are present.

Introducing Sophos ITDR (Identity Threat Detection and Response)

Sophos is expanding further into identity security with Sophos ITDR. This solution monitors identity infrastructure for:

• Identity risks and misconfigurations
• Compromised credentials (including dark web exposure)

As identity-based attacks continue to rise, ITDR strengthens customer defense strategies by addressing a critical layer of the attack chain.

Conclusion

These updates represent one of Sophos’ most significant product evolutions in recent years. With simplified licensing, stronger bundled value, expanded service offerings, and strategic new tiers like Sophos EDR and Endpoint 100, Sophos is positioning both partners and customers for improved security outcomes and streamlined commercial engagement.

For more information, please contact [email protected].