Own Your Sophos Firewall in 12 Months

A firewall is one of the few purchases where the right answer is often a size up, and budget is the thing that stops people. Spreading the appliance over twelve payments removes that, without turning the hardware into a rental you never stop paying for.

What the plan actually is

You pick the Sophos XGS model and the protection subscription. The appliance cost is divided into twelve equal monthly payments. On the twelfth payment the hardware is yours, and hardware payments stop. The protection subscription is billed monthly and keeps running.

That is the whole mechanism. No balloon payment at the end, no buyout figure to negotiate, nothing shipped back.

This is not Sophos HWaaS, and the difference matters

Sophos launched its own Hardware as a Service program in July 2026 for the United States and Canada. Under that program the appliance stays part of an ongoing subscription. It suits organizations that would rather never own hardware and refresh on the vendor's cycle.

The Nuformat plan does the opposite. You are buying the firewall, just over twelve months instead of on day one. After that the capital cost is behind you and only the subscription remains.

Neither is better in the abstract. If you refresh every three years and prefer operating expense, Sophos HWaaS is worth a look. If you keep appliances for five or six years, owning it after twelve months costs less over the life of the box. We quote both, so ask for the comparison rather than guessing.

The part that confuses people

There are two bills, and they have different lifespans.

The hardware is finite. Twelve payments and it is done.

The subscription is not. A Sophos firewall with an expired subscription keeps passing traffic, but it stops receiving threat intelligence updates, IPS signatures and sandboxing. It quietly becomes a router with a rule set, which is the worst kind of failure because nothing appears broken. The subscription is what keeps it a security appliance.

Standard, Xstream, or Xstream with WAF and Email

Standard covers the base firewall features and SD-WAN. It cannot inspect encrypted traffic.

Xstream adds full threat protection, sandboxing and TLS inspection. This is what most buyers need, for a blunt reason: almost everything on the web is encrypted now, so a firewall that cannot inspect TLS is inspecting very little.

Xstream plus WAF and Email adds web application firewall for servers you publish and email protection on the same appliance. Worth it if you are currently paying for those separately.

Sizing: use the TLS number

Every vendor leads with firewall throughput because it is the biggest figure on the datasheet. It is also the least useful one. Size on TLS inspection instead.

The desktop XGS 128 inspects 1,450 Mbps of encrypted traffic. The larger rackmount XGS 2100 inspects 1,100 Mbps. On the headline firewall number the 2100 looks like the bigger box, at 30,000 Mbps against 19,100. On the number that governs what actually gets examined, the desktop model is ahead.

That is not an argument for buying small. It is an argument for comparing the right column.

Which models are on the plan

All fifteen current XGS models. Desktop: 88 and 88w, 108 and 108w, 118 and 118w, 128 and 128w, 138. Rackmount 1U: 2100, 2300, 3100, 3300, 4300, 4500. Rackmount 2U: 5500, 6500, 7500, 8500.

Frequently asked questions

Is this Sophos Hardware as a Service?

No. Sophos runs its own HWaaS program where the appliance stays inside an ongoing subscription. This is a Nuformat payment plan: twelve monthly hardware payments, then you own the firewall.

What happens after the twelfth payment?

Hardware payments stop and the appliance is yours. There is no balloon payment, no buyout figure and nothing to return.

Does the subscription stop too?

No. The protection subscription is billed separately and continues monthly. A Sophos firewall without an active subscription stops receiving threat intelligence, IPS signatures and sandboxing.

Which XGS models are available?

The desktop XGS 88, 108, 118, 128 and 138 including Wi-Fi variants, the 1U rackmount 2100 through 4500, and the 2U rackmount 5500 through 8500.

Which protection subscription do most buyers need?

Xstream. Standard covers the base firewall and SD-WAN but cannot inspect encrypted traffic, and almost all web traffic is encrypted. Xstream plus WAF and Email adds web application firewall and email protection.