In short: Sophos Cloud Workload Protection secures servers and containers in public cloud and data centres: Linux on x86_64 and ARM64, Windows Server, Kubernetes clusters and containers running on Docker, containerd or CRI-O, across AWS, Azure, Google Cloud and Oracle OCI. It adds runtime threat detection, and feeds Sophos XDR or 24/7 Sophos MDR.
What is Sophos Cloud Workload Protection?
Sophos Cloud Workload Protection is Sophos's protection for servers and container workloads wherever they run: on premises, in a data centre, or in public cloud. Sophos says the licence policy and agent are the same as for Intercept X for Server (now Sophos Endpoint – Server), whether the server is on premises, virtual or in the cloud, and sophos.com groups server and cloud coverage under the Sophos Workload Protection name.
It covers the four big public clouds: Amazon Web Services, Microsoft Azure, Google Cloud and Oracle Cloud Infrastructure (OCI), and Sophos XDR can ingest cloud telemetry from all four, so cloud activity can be brought into Sophos XDR and Sophos MDR investigations.
Linux workloads on x86_64 and ARM64
Most cloud workloads run Linux, and many now run on ARM-based instances. Sophos supports both x86_64 and ARM64; its current release notes list tested platforms including Red Hat Enterprise Linux, Ubuntu LTS, Debian, Amazon Linux, Oracle Linux, SUSE Linux Enterprise Server and CentOS Stream. ARM64 has some extra minimum requirements, such as a recent kernel, which we check before deployment.
Sophos's Linux detection does not need a kernel module, which matters in the cloud: instances are built and replaced constantly, kernels change with image updates, and you do not want protection that breaks every time. It provides:
- malware prevention on Linux hosts
- behavioural and exploit runtime detection, including kernel exploits and privilege escalation
- Linux container detections with Sophos EDR and above
- with Sophos EDR and above, AI-prioritised detections with automatic MITRE ATT&CK mapping and AI case summaries
Windows Server instances in the cloud get the same Windows protection as on premises: anti-ransomware, anti-exploit, unauthorised file protection and file integrity monitoring.
Kubernetes and containers
Sophos supports the common container runtimes, Docker, containerd and CRI-O. Its Linux sensor can be deployed to Kubernetes clusters with Helm charts, and Sophos's release notes mention support for Amazon EKS auto mode and for Azure Linux in environments such as Azure Kubernetes Service (AKS). Process events sent to Sophos XDR include container information where available, so suspicious behaviour can be traced to the container that caused it.
Key detections include container escape, where an attacker breaks out of a container to reach the host, alongside kernel exploits, privilege escalation and Linux malware. Those detections land in the same Sophos Fusion (formerly Sophos Central) console as your endpoints, and with Sophos MDR Sophos's analysts can investigate and respond to them around the clock.
Cloud telemetry, XDR and MDR
Protecting the workloads is half the picture. Attacks on cloud estates often involve stolen cloud credentials, unusual API calls or changes to identity and network settings. Sophos XDR, and Sophos MDR, which includes it, can ingest cloud telemetry from AWS, Azure, Google Cloud and OCI, so cloud activity is correlated with endpoint, server, network, email and identity data.
That lets one investigation follow an attacker from a phished laptop, through a stolen cloud key, to a compromised container. For identity attacks specifically, see Sophos ITDR, and for a full-estate log store with long retention, Sophos Next-Gen SIEM.
Cloud Optix users: what changed
Sophos Cloud Optix, Sophos's former cloud security posture management (CSPM) product, reached end of life on 30 September 2026. Sophos has not named a direct CSPM replacement. If you used Cloud Optix:
- protect the workloads themselves with Sophos Cloud Workload Protection
- bring cloud telemetry into Sophos XDR or Sophos MDR for threat detection
- choose a posture management tool for misconfiguration and compliance checks; our vendor-neutral CSPM guide compares the options
Our Cloud Optix end of life page covers the migration in more detail.
Deployment and how we help
We deploy Sophos into cloud estates in the way cloud teams work: baking the agent into machine images or launch templates, using configuration management to install it on Linux fleets, and deploying the Linux sensor to Kubernetes clusters with Helm so new nodes are covered as they appear. Policies are set per workload type, with exclusions for data paths where needed, and cloud telemetry connections are set up for XDR or MDR.
Licensing follows the same licence policy as on-premises servers, on a term subscription or monthly through MSP Flex. Contact us with a summary of your cloud accounts, instance counts and container platforms and we will quote and plan the rollout. For a wider review, see our cloud security assessment.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Which clouds does Sophos Cloud Workload Protection support?
Amazon Web Services, Microsoft Azure, Google Cloud and Oracle Cloud Infrastructure (OCI), as well as on-premises and data centre servers.
Does Sophos support ARM64 Linux?
Yes. Sophos lists x86_64 and ARM64 as supported system types for Linux, on distributions including Amazon Linux, Ubuntu LTS, Red Hat Enterprise Linux and Debian. ARM64 has some extra minimum requirements, such as kernel version.
Can Sophos protect Kubernetes and containers?
Yes. Sophos supports the Docker, containerd and CRI-O container runtimes, its Linux sensor can be deployed to Kubernetes clusters with Helm charts, and it detects threats such as container escape, kernel exploits and privilege escalation.
What replaced Sophos Cloud Optix?
Sophos has not named a direct replacement for Cloud Optix, which reached end of life on 30 September 2026. Sophos Cloud Workload Protection covers the workloads, XDR and MDR can ingest cloud telemetry, and a separate CSPM tool covers posture management.
Is cloud workload protection licensed differently from servers?
No. Sophos says the licence policy and agent are the same for cloud, virtual and on-premises servers, with the same Sophos Endpoint, EDR, XDR and MDR tiers.