In short: Sophos Intercept X Essentials, and Intercept X Essentials for Server, reached end of sale in late 2025. The last new order date was 1 November 2025 and the last renewal order date was 7 January 2026. Essentials customers move to Sophos Endpoint, or Sophos Endpoint 100 for firms with up to 100 users, which include Sophos's full endpoint defences.
What has happened to Intercept X Essentials?
Intercept X Essentials was Sophos's lower-cost endpoint licence, with the core Intercept X protection but not the full set of capabilities in Intercept X Advanced. As part of the late-2025 licence changes, Sophos announced its end of sale, saying the Essentials licences do not include its full endpoint defence capabilities. Sophos Endpoint (formerly Intercept X Advanced) is now the starting point of the range.
The key dates were:
| Milestone | Date |
|---|---|
| Last order for new Essentials term licences | 1 November 2025 |
| Last order for renewals of existing Essentials term licences | 7 January 2026 |
| MSP Flex Essentials subscriptions | Usable until late January 2026, then upgraded automatically to Sophos Endpoint, with billing on the new subscriptions from February 2026 |
The same applies to Intercept X Essentials for Server. Existing term subscriptions keep protecting devices until they expire, so nobody was left unprotected overnight, but Essentials can no longer be renewed. When your current term ends, the renewal is to Sophos Endpoint or another current licence.
Why Sophos withdrew Essentials
Sophos's reason was simple: the Essentials licences did not include its full endpoint defence capabilities, and it wanted every customer on the complete set. Rather than keep a cut-down entry tier, Sophos made Sophos Endpoint the entry point and added a fixed-price option, Sophos Endpoint 100, for organisations with up to 100 users.
For a small organisation the practical effect is that renewal brings the full prevention and control set, rather than a like-for-like copy of what you had. That matters more each year, as insurers and frameworks such as Cyber Essentials ask how you control software, websites and removable media.
What Sophos Endpoint includes
Sophos's tech specs list the following in every Sophos Endpoint tier, so this is what an Essentials customer gets after renewal:
| Capability | Notes |
|---|---|
| Deep learning malware prevention, anti-exploitation and behavioural analysis | Over 60 exploit mitigations on by default on Windows |
| CryptoGuard anti-ransomware with file rollback | Remote ransomware and master boot record protection on Windows |
| Adaptive Attack Protection and Critical Attack Warning | Stronger protection when a hands-on attacker is detected; estate-wide alerts |
| Web protection, web control and download reputation | Windows and macOS |
| Application and peripheral control | Block unwanted applications and restrict USB and other devices |
| Data loss prevention | Windows |
| Root cause analysis threat graphs and automatic clean-up | Shows how a threat arrived and what it touched |
See Intercept X Advanced for more on what Sophos Endpoint – User includes. Once the new licence is in place, the extra policy options are configured in Sophos Fusion (formerly Sophos Central).
Your renewal options
There are three sensible routes, depending on size and need:
- Sophos Endpoint 100: one fixed recommended price for user and server licences, for organisations with up to 100 users. Often the simplest move for a small business.
- Sophos Endpoint – User and Sophos Endpoint – Server: the standard per-user and per-server licences, for any size of organisation, on a term subscription or monthly through a provider on MSP Flex.
- A step up to Sophos EDR or Sophos MDR: if the renewal is a chance to add investigation tools or 24/7 managed response.
Renewing to a fuller licence will usually cost more than Essentials did, because you are getting more. We will set out the options side by side so you can see exactly what the difference buys.
How the move works
- Check your expiry date in Sophos Fusion under licensing, so the renewal is ordered in time.
- Confirm user and server counts, including Macs and virtual servers.
- Choose the licence: Endpoint 100, standard Sophos Endpoint, or a higher tier.
- Apply the new licence in the same Sophos Fusion account, and confirm every device shows the new licence.
- Build fuller policies: separate server and user policies, web control categories, USB rules and application blocking, tested on a pilot group first.
- Run the Account Health Check to confirm everything is protected and configured as recommended.
Contact us before your renewal date and we will handle the quote and the policy work.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Sophos Intercept X Essentials end of life?
It is end of sale. New orders stopped on 1 November 2025 and the last renewal order date was 7 January 2026. Existing subscriptions keep protecting devices until they expire, after which you renew to Sophos Endpoint or another current licence.
What replaces Intercept X Essentials?
Sophos Endpoint (formerly Intercept X Advanced) is the replacement. Organisations with up to 100 users can also choose the fixed-price Sophos Endpoint 100 offer.
Do I need to reinstall Sophos to move off Essentials?
Normally not. The move is a licence change in your existing Sophos Fusion account, and Sophos upgraded MSP Flex Essentials subscriptions automatically. You then configure the extra policies; we check each device reports in correctly.
What happened to MSP Flex Essentials subscriptions?
Sophos said MSP Flex customers could keep using Intercept X Essentials until late January 2026, when subscriptions were upgraded automatically to Sophos Endpoint, with billing on the new subscriptions from February 2026.