Sophos Xstream Plus: Is the new bundle worth it?

Sophos Xstream Plus has been the new additional licensing tier for Sophos Firewall since November 4, 2026. It includes Xstream Protection and adds a fixed allowance of Workspace Protection user licenses, extended reporting and Enhanced Plus Support. Earlier materials and licensing documents also use the name Xstream Protection Plus.

Its value depends on whether these additional services are actually needed. A firewall is sized for traffic and protection performance, whereas Workspace is sized by users. Yet the included quantity is determined by the firewall model. Both requirements should therefore be calculated separately before purchasing.

This article covers the bundle and its recurring costs. The NDR 5500 is a separate appliance and is not included in Xstream Plus.

What Xstream Plus adds

The foundation remains Xstream Protection, with Network Protection, Web Protection, Zero-Day Protection, Central Orchestration and DNS Protection, as well as the included threat feed and NDR Essentials capabilities. Our overview of Sophos Firewall bundles explains the basic package boundaries.

Plus does not automatically include every Sophos product. An MDR service, AI Defense, an NDR hardware platform or unlimited Workspace licensing is not included simply because of the package name.

Workspace Protection: protection beyond the firewall location

Sophos Workspace Protection comprises Protected Browser, ZTNA, DNS Protection for endpoints and the Email Monitoring System. These services address different tasks: browser controls, access to private applications, DNS protection and visibility into email risks.

User licenses do not replace configuration. Browsers, identities, access policies and, where applicable, ZTNA must fit the environment. The Email Monitoring System is also not equivalent to a full email protection license or the firewall’s Email Protection module.

Reporting: up to one year with limited storage

For Central Firewall Reporting, Plus extends the potential retention period from up to 30 days to up to one year. Storage capacity is still limited. High log volumes can shorten the history that can actually be retained.

A retention requirement therefore needs both sufficient time and sufficient capacity. One year as a licensing feature does not guarantee that every company can store twelve months of its actual reporting data within the allocated space. Additional capacity must be planned where needed.

Enhanced Plus Support and HA

Plus adds the upgrade from Enhanced to Enhanced Plus Support. This is particularly relevant for active/passive HA: the corresponding coverage on the active appliance extends Advanced RMA or warranty coverage to the passive appliance under the support terms.

This is a service benefit, not an additional firewall node or a promise of uninterrupted operation. Actual resilience still depends on HA configuration, power supply, network paths and tested failovers. A Technical Account Manager remains an extra-cost option.

Workspace and reporting allowances for all XGS models

Xstream Plus is also available for existing XGS models. The table lists the allowances for both desktop generations and all rackmount models according to the current Sophos Firewall brochure. Models with identical allocations are grouped together; (w) includes the corresponding wireless version. One CFR storage license represents 100 GB.

An XGS 2380 serving 160 Workspace users therefore needs 60 additional user licenses. An XGS 4580 serving 180 users leaves 120 included licenses unused. That is no reason to undersize or oversize the firewall. Select the appropriate hardware first, then compare the bundle and additional user licenses.

The table follows the November 2026 launch brochure. For XGS 3300, 4300 and 4500, publicly available Sophos documents conflict: the brochure lists 20 CFR storage licenses, or 2 TB, while the current licensing policy still lists 25 licenses, or 2.5 TB. This allocation must be clarified before a quote. Both sources agree on 25 Workspace users for XGS 2100, 2300 and 3100.

List prices: Xstream Protection versus Xstream Plus

The comparison below shows launch net list prices in EUR for a new license with a twelve-month term. Hardware, VAT and setup are excluded.

The Xstream Plus SKUs for these twelve-month new licenses are XP238012ZZNCAA, XP338012ZZNCAA, XP458012ZZNCAA and XP558012ZZNCAA. The equivalent Xstream Protection licenses use the XS prefix.

In these four list-price examples, Plus costs around 40 percent more than Xstream Protection. Whether this is worthwhile depends on the cost of the Workspace licenses, reporting capacity and support actually required. These figures do not establish a blanket saving for every company.

Who benefits from the bundle?

Xstream Plus can make sense when Workspace Protection is already planned, the included user count fits the company and longer reporting retention or Enhanced Plus Support is needed. Several planned services can then be purchased together.

Companies that only need firewall protection and already use other browser and application access solutions should examine the additional costs closely. Unused Workspace licenses add no security benefit. A year of reporting is only worthwhile if the capacity is sufficient and the reports are actually used.

A sound decision needs four concrete inputs: the firewall model selected for inspection performance, the required Workspace user count, actual reporting volume and desired support level. These allow a comparison of Xstream Protection with separate additions against Xstream Plus, without making hardware selection dependent on the license allowance.

Conclusion: our assessment of Sophos Xstream Plus

Sophos Xstream Plus can offer a financial advantage over buying its components separately. In our view, that alone does not make another licensing tier necessary. For our advisory work, a clear selection of appropriately licensed add-ons would be more useful than another bundle tying its user allowance to the firewall model.

XGS 2100, 2300 and 3100 illustrate the issue: all three include 25 Workspace licenses. A company needing Workspace Protection for 50 users must buy another 25 licenses. A separate calculation is therefore still required despite the bundle. The right firewall performance and the required Workspace user count do not necessarily grow at the same rate.

An example with an XGS 3100 and 50 Workspace users makes the difference clear. All amounts are net list prices in EUR for twelve months, without individual discounts.

If all the additional services are needed, Plus saves 1’160,24 EUR per year in this example compared with separate purchases. If only Xstream Protection and Workspace are needed, Plus costs 12 EUR more per year. It includes the additional reporting and support upgrade in return.

We calculated the 25 additional users at 105 EUR per user per year. Whether the 25 included users count toward a cheaper volume tier must be clarified in the quote.

For our customer base, we currently see insufficient additional benefit to offer another bundle variant as a regular shop product. As things stand, we will therefore probably not list Sophos Xstream Plus in our shop for the time being. Customers who want to use its included services can request the bundle from us. We will reassess this decision if demand, commercial terms or the scope of services changes.

More choice does not automatically make decisions easier. Additional combinations of firewall model, term, user allowance and reporting storage make an already extensive portfolio harder for administrators to navigate. We would therefore welcome a return to more of the former “Security made simple” approach in product selection and licensing.