Sophos Intercept X Advanced Review: Now Sold as Sophos Endpoint

Fix it now

The product you are looking for is now called Sophos Endpoint. Intercept X Advanced does not appear in Sophos’s current endpoint pages, and the capability the old name implied – detection and response – is sold one tier up as Sophos EDR, with XDR and the managed MDR service above that.

1. Ask for Sophos Endpoint, not Intercept X Advanced. The old name will not match a current quote and the mapping is the first thing to settle.
2. Buy Sophos Endpoint if you want prevention with central management and someone will own the console.
3. Buy Sophos EDR if you need detection, investigation and case creation, because that capability starts there rather than in the base product.
4. Buy Sophos XDR if you need cross-product event correlation and third-party data brought into the same picture.
5. Buy Sophos MDR if nobody in your organisation will read an alert. Unwatched detection is telemetry, not protection.
6. Add Sophos Workload Protection for Windows Server and Linux machines. Sophos states plainly that those devices require it.

Cloud data retention differs by tier: 30 days at EDR, 90 days at XDR and MDR, with a one-year retention add-on available. If a contract or an insurer specifies a retention period, that number decides your tier.

If the tier is settled you can stop here. If you want to know what the agent prevents and what running it demands of you, read on.

Why it happens

Sophos has retired the Intercept X branding for its endpoint product. Search its current endpoint pages and technical specifications and the term does not appear; the product is Sophos Endpoint, and above it sit Sophos EDR, Sophos XDR and Sophos MDR. Management is now presented under the name Sophos Fusion, while the administration documentation is still written around Sophos Central. If someone is quoting you Intercept X Advanced, that is a name being carried forward, and the first job is to establish which current tier it maps to.

The prevention stack is where Sophos puts its best work and it is the same stack under the new name. Deep Learning AI Prevention identifies known and never-seen malware before execution. Anti-Exploitation applies more than sixty proprietary mitigations by default to every running process, which catches attacks that never write a recognisable file to disk. CryptoGuard monitors file contents for malicious encryption, blocks the offending process and can roll files back. Adaptive Attack Protection triggers on behaviour combinations and known toolkit usage rather than file hashes.

Around those sit the controls that decide what may run and what may be plugged in: Application Lockdown, which blocks actions not normally associated with a process; Application Control by category; Peripheral Control for removable media, Bluetooth and mobile devices; Web Protection and Web Control, which now includes enforcing policy on generative AI usage; Data Loss Prevention; and Tamper Protection, kernel-level self-defence that stops interference with the agent itself. Account Health Check reports posture drift and high-risk misconfiguration.

That is a lot of prevention, and it is genuinely strong. What it is not is detection and response. Sophos publishes rich on-device data, case creation and threat intelligence access as starting at the Sophos EDR tier. XDR adds cross-product event correlation and the ingestion of third-party data. MDR is the 24/7 expert-led service with threat hunting and incident response, and it carries a $1M Breach Protection Warranty. The old title’s promise of EDR power in the base product was wrong when it was written, and it is unambiguously wrong now.

This is the heart of the review, and it has not changed with the renaming. Detection technology produces signals, and signals only become protection when a person or a service acts on them. An organisation that buys a detection tier and never assigns an owner ends up with an expensive antivirus and a console nobody logs into. If that describes your likely reality, the honest purchase is MDR, where Sophos does the watching, and the running cost of that is the cost of the capability rather than an upsell.

Servers are the other thing to settle before a quote arrives. Sophos states that Windows Server and Linux devices require a subscription to Sophos Workload Protection. That is not a nuance of policy configuration, it is a separate subscription, and a file server counted as another desktop seat is a quote that will be wrong.

On the commercial side, this review says less than most, deliberately. Sophos does not publish its licensing model, term lengths, volume bands or minimum quantities on the pages checked, so nothing here asserts that it is sold per device or per user, or for one, two or three years. Those belong in the quote, in writing, and a review that guesses at them is doing you a disservice.

Full reference

Mapping the old names onto the current ones

What each tier adds

A one-year retention add-on is available on top. That matters more than it sounds: retention is the number a customer questionnaire or an insurer is most likely to specify, and it is the one thing in this table you cannot fix later by changing how you work.

Named protection features in Sophos Endpoint

• Deep Learning AI Prevention, identifying known and never-seen malware before execution.
• Anti-Exploitation, with over sixty proprietary mitigations enabled by default on every running process.
• CryptoGuard, blocking malicious encryption and rolling affected files back.
• Adaptive Attack Protection, triggering on behaviour combinations and known attack toolkits rather than hashes.
• Application Lockdown, Application Control, Peripheral Control, Web Protection, Web Control including generative AI usage, and Data Loss Prevention.
• Tamper Protection, kernel-level self-defence against interference with the agent.
• Account Health Check, reporting security posture drift and high-risk misconfiguration.

Add-ons Sophos publishes alongside it

• Sophos Workload Protection, required for Windows Server and Linux devices.
• Sophos Endpoint for Legacy Platforms, for the machines you have not retired yet.
• Sophos Device Encryption and Sophos Workspace Protection.
• Sophos Identity Threat Detection and Response, and Sophos Network Detection and Response.
• Sophos Managed Risk powered by Tenable.
• Sophos Advisory Services and an Incident Response Services Retainer.

What to settle before the order goes out

1. Which tier: Endpoint, EDR, XDR or MDR. Write the name on the purchase order rather than ‘Intercept X’.
2. The server count, separately from the workstation count, and a line for Sophos Workload Protection covering them.
3. The retention period you need, checked against the 30 and 90-day figures and the one-year add-on.
4. Who owns the console day to day, by name. If the answer is nobody, price MDR instead.
5. The licensing model, the term and any minimum quantity – all of which come from the quote, because Sophos does not publish them.

Deployment, honestly

On current business hardware the agent is unremarkable in daily use, which is the correct outcome. The two places you will feel it are the initial rollout window and any machine running unusual software that needs exclusions. Pilot before you deploy widely, build the pilot group from the departments most likely to break it, and expect the first fortnight to produce tuning work rather than silence. Database, mail and line-of-business servers need the exclusions their own vendors publish, and skipping that step is how a week disappears chasing a problem you created.

Questions people ask about this