In short: Sophos Workspace Protection is a per-user subscription bundle that combines Sophos Protected Browser (or its extension), Sophos ZTNA, Sophos DNS Protection for endpoints and the Sophos Email Monitoring System, all managed in Sophos Fusion. It can be bought on its own or with Sophos Endpoint, and it does not require Sophos Firewall.
What is Sophos Workspace Protection?
Most work now happens in a browser. Staff open SaaS apps, internal web tools and AI services from home, from client sites and from personal laptops. Traditional controls, such as a firewall at head office and a remote access VPN, were built for a different pattern and struggle to see or control that activity.
Sophos Workspace Protection brings four Sophos products together under one licence to cover that gap. It protects the browser session, gives users access to specific private applications rather than the whole network, filters DNS lookups on the device wherever it is, and adds a second layer of inspection to email. Everything is managed in Sophos Fusion (formerly Sophos Central), alongside any other Sophos products you run.
Sophos positions it as a complement to an existing Sophos Firewall or Sophos Endpoint deployment, but neither is a prerequisite. Protection is applied in the browser and on the device itself, rather than by sending all of a user's traffic through a central proxy.
What is in the bundle
| Component | What it does | How Sophos counts it |
|---|---|---|
| Sophos Protected Browser | Chromium-based secure browser, or a lighter extension for Chrome and Edge, with per-app controls over copy and paste, uploads, downloads, printing and screenshots | Unique authenticated users over 30 days |
| Sophos ZTNA | Identity- and device-aware access to individual private applications, replacing remote access VPN | Unique authenticated users over 30 days |
| Sophos DNS Protection for endpoints | Blocks malicious, risky and unwanted domains at lookup time on Windows devices, with queries sent over HTTPS | Devices using DNS Protection |
| Sophos Email Monitoring System | Inspects mail after it has passed your existing email security and flags threats that were missed, without changing mail flow | Mailboxes |
Sophos's own product page describes the subscription as priced by the number of users who need protection, with the total licence count set by the highest user or device count across the bundled products. In practice that means we size the licence on whichever component you use most widely.
Ways to buy it
- Standalone Workspace Protection: a term licence, or through the Sophos MSP Flex programme, that covers the four components above but does not include a Sophos Endpoint licence
- Sophos Endpoint plus Workspace Protection: a combined bundle that adds Sophos Endpoint prevention (the technology long known as Sophos Intercept X, including CryptoGuard anti-ransomware, anti-exploit and deep learning) to the four workspace components
- Alongside Sophos Firewall: the Xstream Protection firewall subscription already includes network-level DNS Protection; Workspace Protection is the licence Sophos requires for DNS Protection on the devices themselves, wherever they connect from
- Alongside XDR or MDR: the Email Monitoring System is already included with Sophos XDR and Sophos MDR, so check what you hold before buying
Licences are activated and managed in Sophos Fusion under Licensing. For a wider view of how Sophos counts users, servers and add-ons, see Sophos licensing explained. Pricing depends on user numbers, term and what you already own, so ask us for a quote.
Who it suits: common use cases
- Hybrid and remote staff who need consistent web protection and private app access without a full VPN tunnel
- Contractors, suppliers and other third parties who need access to one or two applications, not your network
- Bring your own device (BYOD) where you cannot install a full endpoint agent but still need to stop data leaving managed apps
- Mergers and acquisitions, giving staff from an acquired business access to selected systems before their devices are brought into line
- Shadow IT and generative AI: seeing which generative AI services people use, blocking unsanctioned ones and controlling what data reaches them; Sophos AI Defense, an add-on for eligible Sophos EDR, XDR and MDR customers, extends this to central AI usage policies
- A second opinion on email: organisations staying on Microsoft 365 or Google Workspace filtering that want another layer without moving their MX records
Platforms and identity providers
| Component | Supported platforms (per Sophos tech specs) |
|---|---|
| Protected Browser | Windows 10 and 11, Windows Server 2022 and 2025 (Intel processors; ARM listed as coming), and macOS Sonoma, Sequoia and Tahoe on Intel and Apple silicon |
| Protected Browser extension | Chromium-based browsers such as Google Chrome and Microsoft Edge on Windows and Mac |
| ZTNA agent | Windows 10 and 11 (Intel and ARM) and macOS Sonoma, Sequoia and Tahoe |
| ZTNA gateway | Sophos Firewall, VMware ESXi 7 or later, or Hyper-V 2016 or later |
| DNS Protection for endpoints | Windows 10 and 11 (Intel and ARM) |
| Identity providers | Microsoft Entra ID and Okta for Protected Browser; Microsoft Entra ID, Okta and on-premises Active Directory for ZTNA and endpoint DNS Protection |
Device posture checks differ by component: the ZTNA agent uses the Sophos Security Heartbeat from Sophos Endpoint, while Protected Browser can check the operating system, the presence of endpoint protection (from Sophos or other vendors) and disk encryption status. Sophos updates these lists regularly, so we confirm support for your exact estate before you commit.
How it fits with the rest of your Sophos estate
Workspace Protection is designed to share context with other Sophos products through Synchronized Security. If Sophos Endpoint reports a device as compromised, ZTNA and Protected Browser can temporarily block that device from sensitive applications until it is cleaned up. Activity from ZTNA, DNS Protection and the Email Monitoring System also feeds the Sophos data lake, so your own team using Sophos XDR, or Sophos analysts on Sophos MDR, can investigate denied access attempts, suspicious domains and missed phishing alongside endpoint and firewall data.
If you are comparing approaches rather than products, our vendor-neutral guides to SASE and ZTNA on cloud-security.cloud explain where a browser-and-agent model like this differs from a cloud-proxy service.
How we help
We start by mapping who needs access to what, from which devices, and which components you already own through your firewall, XDR or MDR subscriptions. Then we size the licence, set up identity provider integration and MFA, publish your first private applications through ZTNA, roll out Protected Browser or the extension to a pilot group, and tune data controls so they protect information without getting in people's way.
Contact us for a quote or a pilot plan.
Explore Workspace Protection
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is included in Sophos Workspace Protection?
Sophos Protected Browser (or the Protected Browser extension), Sophos ZTNA, Sophos DNS Protection for endpoints and the Sophos Email Monitoring System, all managed in Sophos Fusion. A separate bundle also adds a Sophos Endpoint licence.
Does Sophos Workspace Protection need Sophos Firewall?
No. It works in any environment. A Sophos Firewall can host the ZTNA gateway, but you can also run the gateway as a virtual appliance on VMware ESXi or Hyper-V.
Does Sophos Workspace Protection include Sophos Endpoint?
The standalone Workspace Protection licence does not include Sophos Endpoint. Sophos sells a combined Sophos Endpoint plus Workspace Protection bundle if you need both.
How is Sophos Workspace Protection licensed?
It is a subscription priced by the number of users, available as a term licence or through the Sophos MSP Flex programme. Sophos sets the quantity using the highest user or device count across the bundled products. Ask us for a quote.
Is Sophos ZTNA still sold on its own?
Sophos now presents Sophos ZTNA as part of the Workspace Protection bundle, and its licensing documentation lists ZTNA as one of the bundle's components. If you have an existing ZTNA subscription, we can check your renewal options.