We will add to these questions in the coming weeks and months, so please check for any updates.
You can discuss your Sophos UTM lifecycle and migration questions here or reach out to your local Sophos representative.
We are announcing the lifecycle milestones for most versions of Sophos UTM plus the SG Series hardware appliances. These conclude with an End-of-Life (EOL) date of June 30, 2026.
The following products are impacted by one or more of the lifecycle milestones:
Sophos UTM on Amazon Web Services (AWS) is explicitly excluded from this end-of-sale announcement.
Sophos has built a powerful, next-gen firewall platform, which seamlessly integrates with our complete product ecosystem, sharing a single management plane in Sophos Central.
Sophos Firewall and the latest XGS Series hardware appliances provide a single, scalable architecture, built to serve customers from the smallest single-person office to large campus networks. This platform has evolved to become the firewall of choice for the majority of our customers and partners.
The table below shows the relevant lifecycle milestones and the products they impact.
See also: Retirement Calendar
Any order placed must not extend beyond the EOL date, June 30, 2026. If you/your customer already own/s a license which extends beyond June 30, 2026, your local Sophos representative will be happy to discuss your options.
Product Description
Milestone
Date
Migration Path
Sophos UTM
All versions incl. Home Edition but excluding UTM on Amazon Web Services
End-of Sale
Final order date for all new and 3-year renewal subscriptions only
June 30, 2023
Sophos Firewall OS
SG Series
Hardware appliances - all revisions
Sales for as long as stock lasts
Or until further notice
Sophos Firewall and XGS Series
Final order date for 2-year renewal subscriptions and accessories
June 30, 2024
Final renewal
Final order date for 1-year and 1-month renewal subscriptions
June 30, 2025
End-of-Life
End of support
June 30, 2026
Subscription terms must not extend beyond this date.
Sophos UTM on AWS
No change
n/a
For SG appliances running SFOS, the equivalent XG Series lifecycle milestones apply.
The Sophos lifecycle policy states:
“When running SFOS on an SG appliance, the EOS/Last renewal/EOL dates of the corresponding XG model will apply.”
We would strongly encourage existing SG Series customers, who are already running SFOS, to make use of our promo to upgrade to the XGS Series at a significant discount. Your local partner can provide further details.
The following table outlines how and when you will be impacted by the lifecycle changes.
#
Your Deployment
Your Options
Recommendations
1
Sophos UTM on
SG Series hardware
License expires on/before June 30, 2026
On or before the license expiry date
Check the lifecycle milestones.
2
Sophos UTM (software/virtual) on 3rd party hardware
On or before license expiry
3
Sophos UTM hardware/software/virtual
License expires after June 30, 2026
You can continue to use Sophos UTM up to the EOL date.
Please reach out to your local Sophos partner or representative to discuss your options.
4
Sophos UTM Home User
If you haven’t recently taken a look at Sophos Firewall, we would recommend that you do so.
5
Sophos UTM in AWS
There is no change for you at this time.
You can check the expiry date of a Sophos UTM license and any associated subscriptions in the product’s WebAdmin.
Select Management > Licensing from the WebAdmin menu after login.
You or your partner can also confirm your recorded expiry date by logging into MyUTM and searching for the license ID for the relevant UTM/SG installation. If the expiry date shown in MyUTM differs from that shown in the product WebAdmin, download a new copy of the license from MyUTM and apply it to your product.
Yes, early renewals are possible. The expiry date of any subscription must not extend beyond the EOL date, June 30, 2026.
The primary migration path for UTM customers is Sophos Firewall OS (SFOS) plus the XGS Series appliances for those using SG hardware.
In some cases, we recommend using additional products:
Customers using the legacy Sophos SSLVPN agent, or the IPsec VPN Agent provided by NCP, will need to migrate to using Sophos Connect client. You should also consider whether Sophos ZTNA is a more appropriate solution for your remote connectivity needs.
We would always recommend that you start with a fresh installation when moving to Sophos Firewall. This has proven to be the best practice, shared by our partners who have helped their customers with numerous migrations over the past months.
Sophos has provided partners with a couple of migration tools which can be used under some circumstances. We also have a Migration HelpDesk which your partners can access.
For some more complex deployments, further assistance may be required. Your Sophos partner can advise you on the best course of action for your individual scenario.
Yes, you can request a trial via our website, or reach out to your Sophos partner for further assistance.
In addition to the experiences shared here on the Sophos Community, you can read the many reviews from Sophos Firewall customers around the globe on the Gartner® Peer Insights website.
Sophos UTM deployments that still have a valid license and subscriptions will continue to run after the end-of-life date but over time, functionality and security will be degraded.
Features that depend on pattern updates or live lookup services will be immediately impacted.
The following updates and live services will stop on, or shortly after July 1, 2026:
You will no longer be protected against new threats or the latest changes to website categorization.
As these services shut down and the installed data and engines age, the behavior of the features that depend on those components may become unreliable. Web Filtering, Email Filtering, and Intrusion Prevention in particular may fail and cause traffic disruption beyond the failure to detect new threats.
Basic Firewall and others features that do not depend on data services or updates, such as routing, VPN, high availability and reporting should not be directly impacted.
After the end-of-life date:
This may result in the product, your data, and networks protected by the UTM/Firewall becoming increasingly vulnerable to attack. We strongly advise against using any EOL product. As a business, this could seriously impact your compliance status.
When feature subscriptions expire, the affected features will no longer be available for use. You will see warnings in the WebAdmin user interface that features are not licensed.
When all feature subscriptions expire, the system reverts to the Essential Firewall (base license) with very limited functionality. For more information about features and subscriptions, see this page in the Sophos UTM documentation: Licensing (sophos.com)
On hardware appliances with licenses appropriate to the appliance model, the WebAdmin will continue to be available but unlicensed features will be unavailable.
On installations with software or virtual machine licenses, the WebAdmin user interface will only allow access to the license upload page. It is no longer possible to configure the device or view reports or other information.
You are welcome to try. However, Sophos will not provide support for running anything other than the appropriate Sophos UTM or Sophos Firewall software/firmware on the device. Sophos will not provide support beyond the stated end-of-life dates for the software or hardware products.
As a piece of hardware in general, you may be able to re-use or recycle various components from your appliance for other purposes.