In short: Sophos Endpoint for Legacy Platforms is an optional add-on that keeps Sophos protection on eligible Windows and Linux systems after the operating system vendor's support ends, such as Windows 7, Windows 8.1 and Windows Server 2012. It is available to customers with a Sophos Endpoint, Sophos XDR or Sophos MDR subscription, managed in the same console.
What is Sophos Endpoint for Legacy Platforms?
When Microsoft or a Linux distributor stops supporting an operating system, Sophos eventually stops updating its agent for it too. Sophos Endpoint for Legacy Platforms is an add-on, introduced in 2025, that extends Sophos protection on a range of older Windows and Linux systems beyond the vendor's standard end-of-support date. Sophos's release notes still say legacy platforms "may require an Extended Support license", so you may see that wording too.
It is not a standalone product. Sophos makes it available as an optional add-on for customers with a Sophos Endpoint, Sophos XDR or Sophos MDR subscription. That means the legacy machines appear in the same Sophos Fusion console as the rest of your estate, rather than needing a separate tool.
Which operating systems it covers
Sophos's current release notes list Windows 7, Windows 8.1 and Windows 10 32-bit as legacy Windows platforms, and Windows Server 2008 R2, Windows Server 2012 and Windows Server 2012 R2 as legacy server platforms. Sophos's solution brief for the add-on also lists older Linux distributions, namely Red Hat Enterprise Linux 7, CentOS 7, Oracle Linux 7, Debian 10 and Ubuntu 18.04 LTS, and the Linux release notes add SUSE Linux Enterprise Server 12 and Ubuntu 20.04 LTS to the legacy list. macOS is not part of the add-on.
For context, Microsoft's own support for these systems ended some time ago:
| Operating system | Microsoft support ended |
|---|---|
| Windows 7 and Windows Server 2008 R2 | January 2020 |
| Windows 8.1 | January 2023 |
| Windows Server 2012 and 2012 R2 | October 2023 |
| Windows 10 (most editions, version 22H2) | October 2025 |
Each legacy platform has its own Sophos extended support end date, published in Sophos's retirement calendar, and Sophos describes its coverage list as correct at the time of publishing. We check the current list and date for every operating system in your estate before quoting. Microsoft's Extended Security Updates are a separate purchase from Microsoft and are not part of the Sophos add-on.
What protection legacy systems get
Sophos says legacy systems keep the core of its protection, managed alongside modern devices in Sophos Fusion:
- deep learning malware prevention for known and unknown threats
- CryptoGuard anti-ransomware and anti-exploitation technology
- web, application and peripheral controls to reduce the attack surface
- access to EDR and XDR investigation, and to Sophos MDR monitoring, if you hold those tiers
Sophos's release notes are also clear that some features and resolved issues may not be available, supported or updated on legacy platforms. And because the underlying operating system no longer receives security patches, the add-on is a safety net, not a return to full support.
A stopgap, not a strategy
Endpoint protection cannot fix vulnerabilities in an operating system that no longer gets patches. An unsupported machine can still be exploited through flaws Microsoft will never fix, and attackers know these systems are out there. So we recommend using the add-on as part of a plan:
- List every legacy system and why it cannot be upgraded: application dependency, hardware, certification or cost.
- Protect it with Sophos Endpoint for Legacy Platforms so it is not left with outdated or no protection.
- Segregate it. Put legacy systems on their own network segment with tight firewall rules, for example with Sophos Firewall, and remove internet access where possible.
- Watch it. Legacy systems are prime targets, so they benefit most from Sophos MDR or Sophos NDR visibility.
- Set an upgrade date and budget for it, before Sophos's own extended support ends.
For Cyber Essentials, unsupported software must be removed, or moved out of scope into a segregated sub-set with no internet access. Sophos protection on its own does not make an out-of-support operating system compliant.
Who needs it
The add-on is aimed at organisations with systems that are hard to replace quickly, for example:
- manufacturing and engineering firms with machine controllers or test rigs tied to an old version of Windows
- healthcare and laboratory settings where equipment software is certified on a specific operating system
- energy and utilities with operational technology
- larger estates where a Windows upgrade programme will run past the end-of-support date
- organisations currently running a separate security tool just for old systems
Licensing and how we help
The add-on is bought alongside your main Sophos Endpoint, XDR or MDR subscription, for the legacy systems that need it. Contact us with a list of the legacy systems you have. We will confirm which are eligible, quote the add-on with your Sophos Endpoint or server licences, and help you plan segregation and the eventual upgrade.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Sophos still protect Windows 7?
Yes, with the Sophos Endpoint for Legacy Platforms add-on. Sophos lists Windows 7 as a legacy platform; coverage requires the add-on and has its own extended support end date in Sophos's retirement calendar. Some features and fixes may not be available on it.
Does Sophos support Windows Server 2012 R2?
Windows Server 2008 R2, 2012 and 2012 R2 are legacy platforms for Sophos. Sophos lists Windows Server 2012 and 2012 R2 in its coverage for Sophos Endpoint for Legacy Platforms, until Sophos's extended support end date for that platform.
What is a Sophos Extended Support licence?
Sophos's release notes say legacy platforms may require an Extended Support licence. Sophos now sells legacy coverage as the Sophos Endpoint for Legacy Platforms add-on; we confirm which licence applies to each of your systems when we quote.
Can I buy the legacy add-on on its own?
No. Sophos offers it as an optional add-on for customers with a Sophos Endpoint, Sophos XDR or Sophos MDR subscription.
Which Linux versions does the legacy add-on cover?
Sophos's solution brief lists Red Hat Enterprise Linux 7, CentOS 7, Oracle Linux 7, Debian 10 and Ubuntu 18.04 LTS, and says the list is correct at the time of publishing. We check the current product documentation before quoting.
Does it make an unsupported system safe?
It makes it much safer, but it cannot patch the operating system. Combine it with network segregation and monitoring, and plan to upgrade or replace the system.