Zenarmor vs Sophos: the alternative to Sophos XGS and Sophos UTM after end of life

Short answer: choose Zenarmor if you want to pay per user, protect home workers with agents, avoid buying new firewall hardware and keep reporting on-premises or in a Dutch or German cloud region. Stay with Sophos if you already rely heavily on Sophos Endpoint, MDR and Sophos Central and Synchronized Security matters a lot to you. Still running Sophos UTM 9? It reached end of life on 30 June 2026, so you have to migrate anyway, which makes this the right moment for an honest comparison.

Secrotec is an independent ISO 27001 Lead Auditor and the official Zenarmor partner in the Netherlands (listed on Zenarmor's partner directory). We deliver Zenarmor licences and projects across Europe and have satisfied Zenarmor customers throughout the European Union. This article compares Zenarmor with Sophos Firewall (XGS) and sets out a concrete migration plan for anyone still on Sophos UTM. Prices are indicative (October 2026, excl. VAT, reseller prices vary) and linked to a source.

Sophos UTM end of life: what does 30 June 2026 mean for you?

Sophos closed the lifecycle of Sophos UTM and the SG Series appliances with an end-of-life date of 30 June 2026. This covers UTM on SG hardware, software installations on third-party hardware, virtual deployments and the Home Edition. After that date there are no more security updates, patches or new threat signatures, and no technical support (Avanet).

Sophos offered UTM customers who ordered a replacement Sophos Firewall before 30 June 2026 up to six months of extra term. According to Sophos itself, no support can be provided beyond 31 December 2026 under any circumstances, and protection features stop working as soon as the related licence expires. Anyone who still has a UTM at the network edge today is running a system without updates, or at best one that is covered until the end of 2026 on an extended term.

Your options at a glance:

• Move to Sophos Firewall on XGS hardware. Sophos offers migration promotions, usually tied to a subscription of at least three years. A logical route if you are deeply invested in the Sophos ecosystem.
• Move to Zenarmor on OPNsense. If your UTM ran as a software or virtual installation, you can often reuse the same server or hypervisor. You pay per user and protect home workers with agents.
• Do nothing. Not an option: a firewall without updates is a known vulnerability and a likely finding in an ISO 27001 audit or a NIS2 assessment.

You will find a six-step migration plan further down. For broader regulatory context, see our NIS2 preparation service.

Zenarmor vs Sophos at a glance

Zenarmor is a security engine (NGFW, secure web gateway, SSE and ZTNA) that runs as software on OPNsense, pfSense CE, Linux or Docker, and as an agent on Windows, macOS, Linux, Android and iOS, managed centrally in Zenconsole. Sophos Firewall runs on XGS appliances or as a software/virtual appliance and is managed through the local interface or Sophos Central, with per-device licensing.

Criterion	Zenarmor	Sophos Firewall (XGS)
Architecture	Software on your own x86 hardware, VM (Proxmox, Hyper-V, VMware), cloud or Deciso appliance, plus endpoint agents	XGS appliances with Xstream architecture; also a software/virtual appliance licensed by cores and RAM
Licensing model	Per user per month (min. 10); first site included, each extra site +$50/month	Per appliance: Standard or Xstream Protection; Sophos ZTNA per user
Application control	5,000+ applications, dynamically updated app database	Application filter (Web Protection module)
Web filtering	300+ million websites in 120+ categories, Safe Search and YouTube Restricted Mode	Web policies (Web Protection module)
TLS inspection	Lightweight and full; add-on on Unified Secure, included in Unified Secure Plus	TLS/HTTPS inspection on the appliance
Threat protection	IPS, DNS deep inspection, cloud threat intelligence, Essential and Advanced security rules	IPS (Network Protection), machine learning and sandbox (Zero-day Protection), MDR threat feeds in Xstream
Remote users / ZTNA	Endpoint agents, encrypted mesh VPN, ZTNA with device posture checks	Remote-access VPN with Sophos Connect; Sophos ZTNA per user via Sophos Central
Endpoint integration	Own agents; works alongside any endpoint protection	Synchronized Security with Sophos Endpoint (a real strength)
Central management	Zenconsole: cloud, multi-tenant, policy import, audit trail	Sophos Central: one console for firewall, endpoint, email and more
Reporting and data residency	Local (Elasticsearch/SQLite), SIEM/Syslog or cloud reporting with a Netherlands or Germany region; 15/30-day retention in the plans	On-box reports; Central Firewall Reporting 7 days free, up to 1 year with CFR Advanced
Email and WAF	Not included (arrange separately)	Email Protection and Webserver Protection modules available
When the licence expires	OPNsense firewall, routing and VPN keep running (open source); paid Zenarmor features need a valid licence	IPS and application policies no longer applied, web policies and HTTPS decryption (proxy mode) stop, zero-day protection off
Hardware lock-in	None: per-user licence, platform can be changed freely	XGS subscriptions are hardware-bound
SD-WAN	Mostly on the roadmap	Available, with orchestration via Sophos Central
Price trend 2026	New, published pricing model since 30 September 2026	+10% from 1 July and +10% from 1 November 2026 on XGS hardware and hardware-bound subscriptions
Indicative price	From $5.00 per user/month (Unified Secure), $9.00 (Unified Secure Plus)	XGS 88 €817, XGS 108 €1,249, XGS 118 €1,811 incl. 1 year Xstream; XGS 108 renewal ≈ €536/year

Sources: Zenarmor plans; Sophos prices via Software Express (appliances and renewals); licence behaviour per the Sophos documentation; virtual licences by core and RAM. Status October 2026.

Security features compared

Application control, web filtering and TLS inspection

Both solutions identify applications, filter websites by category and can inspect TLS traffic. Zenarmor cites more than 5,000 applications and over 300 million categorised websites, with profiles (Permissive, Moderate, High), Safe Search enforcement and a bypass list of 80+ exceptions for sensitive categories. Policies can be tied to interface, VLAN, device category, user, group and time schedule, with identities from Entra ID, Google Workspace, Okta or SAML 2.0. Sophos offers comparable web and application filters in its Web Protection module. Read more: application control, web filtering and TLS inspection and the GDPR.

Threat protection

Sophos is strong here: Xstream Protection combines IPS, zero-day protection with machine learning and sandboxing, and threat feeds from its own MDR team. Zenarmor relies on cloud threat intelligence, IPS, DNS deep inspection against tunnelling and security rules covering malware, phishing, botnet C&C, compromised sites and newly registered domains, among others. Real-time file scanning is part of the SSE plans and above. For most SME environments the level of protection is comparable; if you buy Sophos MDR, you get more out of the Sophos integration.

Remote workers and ZTNA

With Sophos, remote access runs through Sophos Connect (VPN) or Sophos ZTNA, which is licensed per user and managed in Sophos Central. Zenarmor puts the policy on the device itself: agents for Windows, macOS, Linux, Android and iOS apply the same web, app and security policy in the office, at home and on the road. Unified Secure includes 5 endpoint and 5 mesh agents; Unified Secure Plus includes 2 agents per user and mesh VPN for up to 20 sites.

Synchronized Security: the honest story

Synchronized Security is a genuine strength of Sophos. Sophos Firewall and Sophos Endpoint share their health status, so a compromised device can be isolated automatically. If you use Sophos Endpoint and perhaps MDR extensively, you lose that integration when you replace the firewall. Zenarmor has no equivalent link with Sophos Endpoint, although you can simply keep your endpoint protection.

Management, reporting and data residency

Sophos Central is a strong console if you use several Sophos products. For firewall reporting, Central Firewall Reporting offers up to 7 days of retention for free; with CFR Advanced you buy extra storage for up to one year (Sophos CFR FAQ).

Zenarmor is managed through Zenconsole: one cloud portal for gateways and agents, multi-tenant for MSPs, with policy import, backup and an audit trail. Retention is 15 days (Unified Secure) or 30 days (Unified Secure Plus). Reporting can stay entirely local (Elasticsearch or SQLite), be streamed to your SIEM, or be stored in the Zenarmor cloud in a region of your choice, including the Netherlands and Germany (2.7 release notes). See also Zenconsole central management.

Licensing, 2026 price increases and three-year cost

Sophos is raising prices twice in 2026: +10% from 1 July 2026 and another +10% from 1 November 2026 for XGS hardware and hardware-bound XGS subscriptions; for MSP offerings the second increase applies from 1 January 2027. Combined, that is about 21% (Avanet). So check whether your renewal quote is already based on the new price list.

Zenarmor charges per user per month; one user licence covers two actively used devices, and printers, cameras and IoT are not counted. Add the platform: OPNsense Community Edition is free, the Business Edition costs €149 per year, and Deciso appliances start at €978 (DEC740), or you reuse existing hardware or a VM (OPNsense shop).

Zenarmor plan	10–49 users	50–99 users	100–150 users	Key contents
Unified Secure	$5.00	$4.50	$4.00	NGFW, IPS, app and web filtering, DNS deep inspection, 5 endpoint + 5 mesh agents, gateway HA, 15-day retention; TLS add-on $3 per user/month
Unified Secure Plus	$9.00	$8.50	$8.00	Everything in Unified Secure + full TLS inspection, 2 agents per user, mesh VPN up to 20 sites, 30-day retention
SSE / ZTNA / SASE	On request			CASB, posture checks, 90-day retention, custom data residency

Zenarmor list prices in USD per user per month, excl. VAT, October 2026, subject to change. Zenarmor's own prepay discounts: −15% (1 year), −25% (3 years), −35% (5 years). Extra site: $50 per month (up to 20 sites).

Example 1: around 25 users, one site

Cost item (3 years)	Zenarmor Unified Secure	Sophos XGS 108 + Xstream
Licences / subscription	25 × $5.00 × 36 = $4,500; with 3-year prepay $3,375	Year 1 incl. hardware €1,249 + 2 × renewal ≈ €536 = approx. €2,321
Hardware	€0 (existing hardware or VM) or DEC740 €978	Included in year 1
Platform	OPNsense CE €0 or Business Edition 3 × €149 = €447	—
Remote workers	5 endpoint + 5 mesh agents included	Sophos Connect VPN; Sophos ZTNA per user (price on request)
Reporting retention	15 days included	7 days free; longer via CFR Advanced

To be fair: for one small site without remote workers, the Sophos bundle is cheaper at list price, and renewals ordered after 1 November 2026 may come in around 10% higher than older quotes. Zenarmor becomes more attractive once you reuse existing hardware, protect home workers with agents (Unified Secure Plus: 25 × $9.00 × 36 = $8,100, or $6,075 with prepay, including full TLS inspection and 30-day retention) or factor in the partner discount via Secrotec.

Example 2: around 100 users, three sites, hybrid work

Cost item (3 years)	Zenarmor	Sophos
Subscription and hardware	Unified Secure: (100 × $4.00 + 2 × $50) × 36 = $18,000, approx. $13,500 with prepay. Unified Secure Plus: $32,400, approx. $24,300 with prepay. Hardware €0 (reuse/VM) or DEC850 + 2 × DEC740 = €3,604	Head office XGS 118: €1,811 + 2 × €901 = €3,613; two branches XGS 108: 2 × €2,321 = €4,642; together approx. €8,255. For more throughput an XGS 128/138 (€2,532/€3,552 in year 1)
HA at head office	Second gateway (hardware or VM); HA is part of the licence	Second appliance; HA licensing terms via your reseller
Remote workers / ZTNA	Plus: 2 agents per user and mesh VPN included	Sophos ZTNA for approx. 100 users (price on request)
Reporting retention	15 or 30 days included; local or SIEM possible	7 days free; CFR Advanced for longer retention

On hardware and bundle price alone, the Sophos set-up in this example is cheaper than Zenarmor Unified Secure Plus at list price. The gap shrinks once you include ZTNA for 100 users, longer reporting retention and a larger head-office model, and as the 2026 price increases feed into your renewals. If home workers connect via a VPN to the office (OPNsense supports WireGuard, IPsec and OpenVPN at no extra cost), Unified Secure is often sufficient. A quote through Secrotec also includes a partner discount. The prepay figures assume Zenarmor's discount applies to the whole subscription.

What happens when the licence expires?

According to the Sophos documentation, when a Network Protection licence expires, IPS signatures are no longer loaded and IPS policies are no longer applied. With Web Protection, application signatures and application filter policies are no longer applied, and in proxy mode web policies and HTTPS decryption stop. Zero-day protection is switched off and Central Firewall Reporting falls back to 7 days. With Zenarmor, the open-source OPNsense firewall, routing and VPN keep running; the paid Zenarmor functions require an active licence.

Compliance: evidence for ISO 27001, NIS2 and TISAX

A firewall does not make you compliant; it produces evidence. Sophos and Zenarmor can both support ISO 27001:2022 Annex A controls such as A.8.20 (network security), A.8.22 (segregation of networks), A.8.23 (web filtering), A.8.15 (logging) and A.8.16 (monitoring activities), as well as the measures in NIS2 Article 21 and national laws such as the Dutch Cyberbeveiligingswet (in force since 15 August 2026). An end-of-life UTM, by contrast, will almost certainly produce an audit finding under A.8.8 (management of technical vulnerabilities).

Secrotec is both auditor and implementer: we configure Zenarmor so that policies, segmentation, logging and reports map onto your Statement of Applicability. For automotive suppliers, we support TISAX® readiness (gap review against VDA ISA, self-assessment, implementation); the assessment itself is carried out by an ENX-approved audit provider. Read more about reporting as evidence, TISAX and network security or an ISO 27001 gap analysis.

When is Sophos the better choice?

• You use Sophos Endpoint and possibly Sophos MDR, and Synchronized Security is an important control for you.
• You want firewall, endpoint and email in a single vendor console (Sophos Central).
• You genuinely need the firewall's email protection or Webserver Protection (WAF).
• SD-WAN with central orchestration across many sites is core functionality.
• You can use a Sophos migration promotion with a sharp three-year price, or you already have a multi-year Xstream subscription.

When is Zenarmor the better choice?

• Your UTM is end of life and you do not want to reinvest in hardware-bound subscriptions; you would rather reuse your server or hypervisor.
• You want predictable per-user costs, independent of hardware cycles and the 2026 price increases.
• Your staff work hybrid and you want the same policy in the office, at home and on the road through agents.
• You want to keep reporting on-premises or in a Dutch or German cloud region.
• You manage several sites or customers (MSP) from one multi-tenant console.
• You want to control cloud actions, such as blocking uploads to WeTransfer; see SSE, CASB and DLP.

More about the platform: how Zenarmor goes beyond NGFW with SSE, ZTNA and CASB.

Partner discount via Secrotec: send us your Sophos renewal quote

As the official Zenarmor partner in the Netherlands, we supply licences based on the list prices above, with a partner discount. In Zenarmor projects the price is always negotiable. Have you received a Sophos renewal quote or an XGS migration quote for your UTM? Send it to us. We will prepare a fair side-by-side comparison: the same users, sites, remote workers and retention, with a clear 3-year TCO. If Sophos is the better choice for your situation, we will tell you so.

Request a quote with partner discount, see the full Zenarmor price comparison or read Zenarmor vs Fortinet FortiGate. Prefer to hand it all over? Our managed firewall service combines Zenarmor with management and monitoring.

Sophos, Sophos Firewall, Sophos UTM, Sophos Central, Xstream and Synchronized Security are trademarks of Sophos Ltd. Zenarmor is a trademark of Sunny Valley Cyber Security Inc. OPNsense is a trademark of Deciso B.V. All prices are indicative, October 2026, excl. VAT; reseller prices and exchange rates vary. This comparison is based on public sources linked in the text and is not a statement by Sophos or Zenarmor.