Sophos Firewall: new XGS hardware and Xstream Protection Plus
The first customers are already asking us about Xstream Protection Plus. What is behind it, and what does it add to Xstream Protection? The name is certainly already circulating: the shortened form ‘Xstream Plus’ appears in Google search snippets for Sophos pages.
Sophos is also announcing new firewall hardware and a separate NDR appliance. As of 29 October 2026, we do not yet have confirmed prices or reliable throughput figures for the new appliances. We will report on these as soon as we have them. We can already assess the new bundle, however, and in our view it does not make the choice any easier.
New XGS models and a separate NDR appliance
Four new models have been announced:
- Sophos Firewall XGS 2380
- Sophos Firewall XGS 3380
- Sophos Firewall XGS 4580
- Sophos Firewall XGS 5580
Sophos stresses that the new models complement the portfolio and are not direct successors to individual appliances. The existing models remain available; this announcement brings no changes to their lifecycle dates. The first order date for the new appliances is scheduled for 4 November 2026. The ability to place an order and the actual delivery date need to be checked separately.
Based on our many years of experience, a gradual generation change would nevertheless be plausible over the longer term. The XGS 2100 belongs to the XGS generation introduced in April 2021, making it around five and a half years old. It has no onboard 10GbE ports, although these connections can be added through optional Flexi-Port modules. An orderly transition and the reduction of existing stock could also play a part in a longer-term portfolio refresh. This is our assessment, not an announced replacement of the XGS 2100.
Alongside these, the NDR 5500 is coming as dedicated hardware for Network Detection and Response. It is a separate platform for analysing network traffic rather than another XGS firewall. Its first order date is scheduled for 10 November 2026. The specific quotation must set out the protection coverage and additional modules needed for deployment.
What Xstream Protection Plus adds
Xstream Protection Plus builds on Xstream Protection. It adds a model-dependent user allowance for Workspace Protection, longer Central Firewall Reporting retention and an upgrade to Enhanced Plus Support. Workspace includes Protected Browser, ZTNA, DNS Protection for endpoints and the Email Monitoring System. It is therefore a package of several services in its own right, requiring setup in addition to the firewall.
This is how the packages differ, including our Avanet Epic Protection. ‘No’ means that a service is not included in the respective package. Our overview of firewall licence bundles explains the precise differences.
| Service | Standard Protection | Xstream Protection | Xstream Protection Plus | Avanet Epic Protection |
|---|---|---|---|---|
| Network Protection | Yes | Yes | Yes | Yes |
| Web Protection | Yes | Yes | Yes | Yes |
| Zero-Day Protection | No | Yes | Yes | Yes |
| Central Orchestration | No | Yes | Yes | Yes |
| DNS Protection | No | Yes | Yes | Yes |
| MDR/XDR and third-party threat feeds | No | Yes | Yes | Yes |
| Central Firewall Reporting | Up to 7 days | Up to 30 days | Up to 1 year | Up to 30 days |
| Workspace Protection | No | No | Model-dependent allowance | No |
| Enhanced Support | Yes | Yes | Yes | Yes |
| Upgrade to Enhanced Plus Support | No | No | Yes | No |
| Email Protection on the firewall | No | No | No | Yes |
| Webserver Protection / WAF | No | No | No | Yes |
The included threat feed functions also do not constitute an MDR service subscription. An MDR team and a firewall function remain different services.
When the firewall determines the user count
A firewall is selected according to traffic, connectivity and required performance. How many employees need Workspace Protection is a separate question. Yet Sophos determines the included user allowance through the firewall model. Depending on the company, this leaves licences unused, or the included allowance falls short and additional user licences must be purchased. This can be resolved, but it makes selection and subsequent renewal unnecessarily complicated.
For the existing XGS models, the tiers are as follows. One CFR storage licence corresponds to 100 GB:
| XGS model | Workspace users | CFR storage licences | CFR capacity |
|---|---|---|---|
| 88(w), 108(w) | 5 | 5 | 500 GB |
| 118(w) | 5 | 10 | 1 TB |
| 128(w), 138 | 10 | 10 | 1 TB |
| 2100, 2300, 3100 | 25 | 10 | 1 TB |
| 3300, 4300, 4500 | 100 | 25 | 2.5 TB |
| 5500, 6500 | 300 | 50 | 5 TB |
| 7500, 8500 | 500 | 100 | 10 TB |
Reporting includes up to one year of retention. However, that time limit only helps while the allocated storage is sufficient. If it fills up sooner, the oldest reporting data is removed first. One year of retention therefore does not automatically mean there is room for a whole year’s worth of logs.
The table applies to the existing models listed. We do not yet have confirmed allowances for the XGS 2380, 3380, 4580 and 5580, and they cannot be inferred from this table.
Our assessment
The bundle can make sense when Workspace Protection and longer reporting retention are needed alongside firewall protection. A combined package can simplify purchasing. For us, the deciding factor is whether the included services and user allowances fit the company concerned.
Workspace Protection in particular therefore warrants a look at actual requirements. The right firewall size and the number of users needed do not necessarily align. Whether Plus offers an advantage over a separately assembled package also depends on the specific commercial terms.
The first order date for the new XGS appliances is scheduled for 4 November. We still need confirmed prices and reliable throughput figures for a final assessment. We will report on these as soon as the information is available to us. It will then be possible to assess which hardware and which package offer good value for money for each use case.
