Sophos Intercept X

Who owns it

Sophos Limited was founded in Abingdon, Oxfordshire in 1985 by Jan Hruska and Peter Lammer, floated in London in 2015 and was taken private by Thoma Bravo, the US private-equity firm, for about $3.9 billion on 2 March 2020. It is still headquartered in Abingdon (Companies House 02096520) and is the only vendor in this comparison whose home market is the UK. We found no Russian, Belarusian or Chinese engineering presence, current or past. The Pacific Rim disclosure of October 2024, in which Sophos described five years of counter-operations against Chinese state-linked groups attacking its firewalls, is a story about Sophos's network product being targeted, not about Sophos's ownership, and we record it as such.

What it costs

Pricing is the reason it sits sixth rather than second. Sophos publishes no list price for Sophos Endpoint or Intercept X on sophos.com, and its own How to Buy page, read live on 9 September 2026, offers exactly two routes: "Buy now with AWS" through AWS Marketplace, billed to an AWS account, or "Get a quote", a lead form that goes to Sophos sales or a partner. A UK small business cannot buy it with a card from Sophos. UK resellers list Sophos Central Intercept X Advanced in bands such as 10 to 24 users, and US resellers quote around $66 a user a year at small quantities, but those are reseller prices and we do not put them in the grid. The ladder is Sophos Endpoint (formerly Intercept X Essentials), Intercept X Advanced, Sophos EDR, Sophos XDR and Sophos MDR in Essentials and Complete tiers, with servers a separate SKU and legacy operating systems a paid add-on. MDR Complete carries a breach warranty and documented response times (a two-minute case-creation and 30-minute initial-response SLA); no price for any of it is public. A free trial of Sophos Central is offered. In the grid Sophos shows "Not published" and the score reflects Tim's rule: reseller-only buying costs points against a self-service equivalent.

What you get and what to watch

What you get is excellent. Deep-learning detection, CryptoGuard ransomware protection with file rollback, exploit prevention and web filtering on the endpoint; Sophos Central as the cloud console, with the region (including EU Frankfurt) fixed at account creation; integrations for ConnectWise, Datto, N-able and NinjaOne through the MSP Connect Flex programme; Central APIs; and Intercept X for Mobile. Device control, patching, encryption management (Sophos Central Device Encryption exists), email security (Sophos Email is a separate product) and SSO were not confirmed against a datasheet in our pass. Third-party MCP servers wrap Sophos Central; we found no first-party one.

The labs: AV-Comparatives' March to June 2025 business test gave Intercept X Advanced 97.5 per cent real-world protection with seven false alarms and the Approved Business Security Product award for both 2025 rounds; AV-TEST's February 2026 business Windows 11 round scored it 5.5, 6 and 6, 17.5 of 18, Top Product; SE Labs gave 100 per cent protection and legitimate accuracy and AAA in Q4 2025 in both enterprise and small-business categories; MITRE rounds 4, 5 and 2025 were 100 per cent, 99 per cent and zero misses respectively. Against that, Trustpilot is 1.7 on 64 reviews with 75 per cent one-star, mainly macOS uninstall pain, performance and support, on a profile that mixes business and home users; Gartner Peer Insights figures are vendor-cited and we could not verify them. Not yet tested by Saaskly: assessed on published pricing, the independent test labs, vendor documentation and third-party reviews.