Sophos Intercept X Is Now Sophos Endpoint

What happened to Sophos Intercept X?

Sophos has retired the Intercept X brand and renamed its endpoint line Sophos Endpoint. The protection engine is unchanged; what changed is the naming, the license tiers, and what is sold going forward. Intercept X Advanced is now Sophos Endpoint with identical protection; Intercept X Essentials is end-of-sale and upgrades to Sophos Endpoint at renewal; and three new options arrived: Sophos Endpoint 100 (flat-rate, up to 100 users), Sophos EDR (a dedicated detection-and-response license), and Sophos Endpoint for Legacy Platforms. Nuformat quotes the full line, term or monthly, for Canada and the USA.

The Intercept X name is gone. Here is the full picture.

If you manage endpoint security and you have run Sophos for a while, you have probably noticed that the name Intercept X has quietly disappeared from Sophos product pages, price lists, and marketing. It is not a glitch. Sophos retired the Intercept X brand and moved its full endpoint portfolio under the simpler Sophos Endpoint name.

The protection itself has not changed. What changed is everything around it: the naming, the license tiers, and in some cases what is available to buy going forward. If you are mid-contract, renewing soon, or shopping for new seats, this affects you. Here is what to know.

Why Sophos dropped the Intercept X brand

The stated reason is clarity. "Intercept X" was a strong technical brand, but for buyers doing their own research it raised questions: which version do I need, what does Advanced mean versus Essentials, is XDR the same as EDR, is server protection different from endpoint protection? Leading with Sophos Endpoint makes the line self-explanatory: endpoint protection for users, endpoint protection for servers, and a detection-and-response tier on top. In Sophos's own words, the company is now "leading with the Sophos Endpoint branding" to make its endpoint products easier to find, quote, and sell.

Worth noting: the underlying engine, threat intelligence, deep learning models, exploit protection, and CryptoGuard ransomware rollback are all still there. Sophos changed the label, not the technology.

Intercept X to Sophos Endpoint: full name-change table

Here is a complete mapping of old Intercept X names to their current Sophos Endpoint equivalents. If a quote, renewal, or price list shows something unfamiliar, this is your reference.

Name changes apply across User and Server subscriptions, for both Term and MSP Flex license types.

What is actually new, beyond the name

Sophos used the rebrand to refresh the tiers themselves. Three genuinely new offerings are worth understanding, plus a real performance gain in the core agent.

Sophos Endpoint 100: simple, fixed-price SMB protection

Small businesses have long struggled with endpoint quoting. Per-seat licensing and variable pricing make it hard to budget. Sophos Endpoint 100 answers that with a single flat-rate subscription for organizations with up to 100 users: full Sophos Endpoint protection, one price, no per-seat math. For an IT manager or owner who just wants the protection sorted, this is the option.

Sophos EDR: detection and response as its own license

Previously, endpoint detection and response from Sophos meant buying Sophos XDR, a broader cross-product platform covering firewalls, email, and cloud. A strong platform, but sometimes more than a firm needs if the focus is endpoints and servers. Sophos EDR carves out a dedicated license that bundles the Sophos Endpoint prevention engine with AI-accelerated investigation and response: root-cause analysis, threat hunting, and live response, without buying into the full XDR ecosystem. It is available both as a term license and through MSP Flex.

Sophos Endpoint for Legacy Platforms: security for systems that cannot be updated

This one matters more than people expect. Many organizations, especially in manufacturing, utilities, and healthcare, run production systems on Windows versions Microsoft stopped supporting years ago. Replacing them is not always possible when they are embedded in specialized machinery or medical equipment. Sophos Endpoint for Legacy Platforms is an add-on that brings current-generation threat protection to those older Windows and Linux environments without requiring the OS to be modern.

A 40% lighter agent: same protection, less system impact

The latest Sophos Endpoint Windows agent cut its memory footprint by 40%. On constrained endpoints, older hardware, shared virtual desktops, high-density environments, that is a meaningful difference. Users notice when security software slows a machine. They will not notice this one.

Your current protection: what actually changes

Short answer: almost nothing, depending on which product you are on.

If you are on Intercept X Advanced (user or server), your license is now called Sophos Endpoint. Your renewal invoice uses the new name. Nothing else changes: not the agent on your devices, not the console, not the protection.

If you are on Intercept X Essentials, you upgrade at renewal. That is an improvement: Essentials was a stripped-down tier that left out several of Sophos's stronger defenses. Moving to Sophos Endpoint gives you the full stack, deep learning prevention, exploit mitigation, active adversary detection, and CryptoGuard. You get more, not just a different name.

For context on the vendor: Sophos has been named a Leader in the Gartner Magic Quadrant for Endpoint Protection Platforms 17 consecutive times, every report since the category began in 2007. It also posted 100% detection coverage in the MITRE ATT&CK Enterprise 2025 Evaluation. The console you manage it all from, Sophos Central, is now evolving into Sophos Fusion, with the new name arriving in consoles over the coming months and existing workflows continuing unchanged.

Sophos Endpoint: full feature comparison by tier

Not sure which tier fits? This lays out what each product includes. Treat them as building blocks: each level adds capability on top of the one before. If your team manages security in-house, Sophos Endpoint or EDR is the usual starting point. If you want Sophos analysts handling detection and response around the clock, MDR is where you end up.

Sophos MDR and MDR Plus both include Sophos XDR. All tiers are managed through the Sophos console. Third-party EDR environments including Microsoft Defender, CrowdStrike, and SentinelOne are supported under the MDR tiers via the XDR ecosystem.

Sophos Endpoint licenses at Nuformat

Nuformat is a certified Sophos partner with customers across Canada and the United States. We stock and support the full Sophos Endpoint lineup, including the EDR tier and the Legacy Platforms add-on. Whether you are renewing, upgrading from Essentials, or building a new deployment, we can quote you quickly, and for orders above $5,000 we have access to volume pricing that is not on the standard list.

Monthly subscription options are also available, managed by Nuformat as your MSP, with no multi-year commitment required. Contact Nuformat for a quote.

Frequently asked questions

Is Sophos Intercept X the same as Sophos Endpoint?

Yes, with one exception. Intercept X Advanced has been renamed Sophos Endpoint, and the protection is identical. Intercept X Essentials is being discontinued; customers on Essentials move to Sophos Endpoint at renewal, which is an upgrade to a stronger product.

Do I need to reinstall or reconfigure anything?

No. The agent on your devices is unchanged, the console looks the same, and your policies, exclusions, and device groups carry over without any action on your part.

What happens to my Intercept X Essentials license?

Your devices stay protected through your current term. Essentials is now end-of-sale, so at renewal you move to Sophos Endpoint instead. Pricing is slightly higher, but the protection is meaningfully better, and MSP Flex customers migrate automatically.

What is the difference between Sophos EDR and Sophos XDR?

Sophos EDR focuses on endpoints and servers: it adds AI-powered investigation, threat hunting, and live response on top of the Sophos Endpoint prevention engine. Sophos XDR is broader, pulling in telemetry from firewalls, email, cloud, and third-party tools too. EDR suits teams that want strong endpoint-focused detection and response; XDR suits a more integrated security operations function.

Can we do month-to-month instead of a term license?

Yes. Nuformat offers monthly subscription billing, managed as your MSP, for customers who prefer flexibility over locked-in terms. Get in touch and we will build a quote that fits how your organization buys.

Does Sophos Endpoint work on older operating systems?

Standard Sophos Endpoint supports current Windows, macOS, and Linux versions. For end-of-life systems such as Windows 7, Windows Server 2008, or older Linux distributions, the Sophos Endpoint for Legacy Platforms add-on provides coverage. It is especially relevant in healthcare and manufacturing, where OS upgrades are not always feasible.