Sophos Intercept X: what it is, features and editions

What is Sophos Intercept X?

Intercept X is the name Sophos gave to the set of prevention technologies in its endpoint agent: the parts that stop ransomware, exploits and unknown malware before they do damage. For years it was also the name on the licence, as Central Intercept X Advanced for user devices and Central Intercept X Advanced for Server.

In late 2025 Sophos dropped "Intercept X" from its product names. Central Intercept X Advanced became Sophos Endpoint – User, Central Intercept X Advanced for Server became Sophos Endpoint – Server, and sophos.com now describes the product simply as Sophos Endpoint. The technology itself did not change, which is why "Intercept X" is still how most people search for it and how many IT teams still refer to it. Throughout this site we write Sophos Intercept X (now sold as Sophos Endpoint) so it is clear we mean the same product.

If you are renewing an old licence, our Intercept X Advanced page explains what the rename means for you, and Intercept X for Server covers servers. Everything is managed in Sophos Fusion (formerly Sophos Central), the cloud console for the whole Sophos portfolio, which we explain on our Sophos Fusion and Sophos Central pages.

This site is run by Forever Systems, a UK IT and cyber security provider and Sophos MSP Partner, which supplies, deploys and supports Sophos products.

Sophos Intercept X features: how it stops attacks

Sophos describes its approach as prevention first: block as much as possible automatically, so that fewer incidents need investigating. The main layers are:

• Deep learning malware prevention: a machine learning model that judges files on their characteristics, so new and unknown malware can be blocked without a signature
• Exploit prevention: Sophos says more than 60 of its own mitigations are switched on by default for every running process on Windows, stopping the techniques attackers use to abuse legitimate software
• Behavioural analysis: watching what processes do, so malicious activity is stopped even when the file itself looks harmless
• CryptoGuard: spots malicious encryption, stops the process responsible and restores affected files; on Windows this includes encryption launched from another compromised machine on the network
• Master boot record protection: on Windows, stops ransomware and wipers from leaving a machine unbootable
• Adaptive Attack Protection: switches a device to a more aggressive protection stance when it detects a hands-on attacker
• Critical Attack Warning: alerts every administrator when adversary activity is seen across several endpoints or servers
• Web, application and peripheral controls, plus data loss prevention on Windows, to cut down what users can run, visit, plug in or send out
• Synchronized Security: with Sophos Firewall, a compromised device can be isolated from the network automatically

Root cause analysis threat graphs show how a blocked threat arrived and what it touched, which helps you close the gap it used.

Choosing a licence tier

Every tier includes the same Intercept X prevention. The tiers differ in how much detection, investigation and response comes with it, and in who does the work.

Our Sophos Endpoint editions page compares the tiers feature by feature. Small businesses should also look at Sophos Endpoint 100, a fixed-price Sophos Endpoint offer for organisations with up to 100 users, covering both computers and servers.

The wider Sophos portfolio

Intercept X is often the first Sophos product an organisation buys, but most of the value comes from how the products share information. Here is a short tour, with a page on each:

Endpoint and servers Sophos Endpoint editions, Intercept X for Server, Sophos Cloud Workload Protection, Sophos Endpoint for Legacy Platforms, Sophos Mobile and Sophos Device Encryption.

Detection, response and managed services Sophos EDR, Sophos XDR, Sophos Next-Gen SIEM, Sophos MDR, Sophos Emergency Incident Response (formerly Rapid Response), Sophos AI Defense and Sophos CISO Advantage. Sophos completed its acquisition of Secureworks in February 2025, and its Secureworks Taegis technology now sits behind what Sophos calls Sophos XDR Powered by Secureworks.

Identity and network Sophos ITDR for Microsoft Entra ID and Active Directory, Sophos NDR, Sophos Firewall on XGS Series appliances, Sophos Switch and Sophos Wireless.

Workspace and email Sophos Workspace Protection (Protected Browser, ZTNA, DNS Protection and the Email Monitoring System), Sophos ZTNA, Sophos DNS Protection, Sophos Email and Sophos Phish Threat.

Platform and licensing Sophos Fusion, Sophos Central, Sophos licensing, what affects Intercept X pricing and Sophos vs Microsoft Defender. If you still use Cloud Optix, see Cloud Optix end of life.

Who Sophos Intercept X suits

Sophos Endpoint works for organisations of almost any size, from a ten-person practice to a large multi-site estate, because the same agent scales from automatic protection up to a fully managed 24/7 service. It is a particularly good fit when:

• you want ransomware rollback and exploit prevention that work without constant tuning
• you have a small IT team and want the option of Sophos MDR to watch your estate out of hours
• you already use, or plan to use, Sophos Firewall, Sophos Email or Sophos ZTNA, so detections can be shared across products
• you need macOS and Linux covered from the same console as Windows
• you need evidence of malware protection for Cyber Essentials or a cyber insurance questionnaire

Organisations on Microsoft 365 Business Premium often ask whether they need it at all, given Microsoft Defender for Business is included. Our Sophos vs Microsoft Defender page sets out the differences side by side. We also supply Cisco Secure Endpoint and Check Point Harmony Endpoint, so our recommendation is based on what fits you.

Getting a Sophos quote

Sophos pricing depends on the tier, the number of users and servers, the term and any add-ons, so there is no single list price that fits everyone. Our Intercept X pricing page explains what moves the cost.

To get a written quote, contact us with a rough count of users, servers and Macs, and tell us what you use today. We can recommend a tier, plan the move from your existing antivirus and, if you want, manage the Sophos tenant for you afterwards. Sophos is one part of the wider cyber security services we provide through Forever Group.