New Sophos XGS appliances: More performance, but at what price?

Ordering for four new Sophos firewalls is scheduled to open on Wednesday, 4 November 2026: the XGS 2380, XGS 3380, XGS 4580 and XGS 5580. On paper, they offer considerably more performance. Alongside them comes another licence bundle: Xstream Protection Plus, also called Xstream Plus.

Three questions matter most to me. What will the appliances cost? What will their subscriptions cost? And will the built-in connectivity finally meet my expectations for a new rackmount firewall in 2026?

Sophos has become increasingly expensive over recent years. In my working environment, I have seen smaller businesses look for alternatives or choose another solution. With a cumulative 21 percent increase in affected XGS list prices this year alone, I understand that decision.

Preview, checked on 1 November 2026: I have not tested these appliances. The planned first order date is not a confirmed delivery date. The performance figures below come from the supplied Sophos deskaid and are preliminary. The document is marked for internal and partner use and carries the later date of 28 November 2026; public confirmation of these table values is still outstanding.

Four new models with substantial performance increases

The new devices cover several performance tiers. The XGS 2380 stands out: at 23.3 Gbps of Threat Protection and 8 Gbps of TLS inspection, the supplied overview puts it considerably above the existing XGS 2300 and XGS 3300.

The XGS 3380 is listed at 32 Gbps of Threat Protection, the XGS 4580 at 45 and the XGS 5580 at 58 Gbps. All four new models are listed as 1U rackmount appliances. That makes the XGS 5580 particularly interesting: the older XGS 5500 occupies two rack units.

How this translates into everyday operation remains to be seen. A datasheet number tells me little about the headroom remaining with my actual rules, encrypted connections, VPNs and enabled protection features.

The performance table

Here is the rackmount table reproduced from the supplied document as a readable table. New models are highlighted in bold. All throughput figures are in Gbps.

Some figures for existing models differ from older public datasheets. I have deliberately reproduced this document’s table without mixing values from different revisions. It does not specify the software version, detailed measurement conditions or a reproducible common test. These figures therefore establish neither guaranteed real-world throughput nor reliable comparative performance ratios.

For sizing, I would focus on Threat Protection and TLS inspection. A headline firewall throughput of 105 Gbps does little for me if inspected encrypted traffic is the actual bottleneck. Maximum port count also says nothing about port speeds.

10 Gigabit should be built in

The exact interface configuration of the new appliances remains an open question for me. Twelve ports do not tell me whether two, four or none support 10 Gigabit.

My expectation is straightforward: all four new rackmount models should have onboard 10GbE. The smaller XGS 138 already has two built-in 10 GE SFP+ ports.

The XGS 2100 and XGS 2300 require an optional Flexi-Port module for 10GbE. Based on prices I have encountered, that can mean more than US$1,200 extra. This is my previous pricing experience, rather than a currently verified quote for a particular SKU, region or tax basis. I would still find a repeat of that approach difficult to justify on new hardware.

The FortiGate 90G, for example, includes two 10GbE shared-media interface groups offering RJ45 or SFP+. Only one socket in each group can be used at a time; these are not four independently usable 10G ports. My comparison here concerns built-in connectivity, rather than equivalent protection performance or a complete price comparison.

Portfolio expansion or a gradual replacement?

Sophos’s position as communicated so far is that the new models expand the portfolio. They are not direct successors to specific appliances; existing models are intended to remain available, with no lifecycle changes resulting from this announcement.

I take that statement at face value. My expectation for what happens later is nevertheless different.

The XGS 2100 belongs to the 2xxx models made available on 21 April 2021. By the planned first order date of 4 November 2026, it will be just over five and a half years old. With substantially faster devices alongside it, selling the remaining stock will eventually become more difficult.

My suspicion is that both ranges will initially run in parallel, existing inventory will be reduced and selected older models will later reach end of sale. That would fit the pattern I recognise from previous Sophos generation changes. This is my assessment, not a confirmed roadmap or an announced end-of-sale date for the XGS 2100. End of sale would also not mean an immediate end to support.

Hardware and subscription prices will decide the value

More performance is welcome. Whether the appliances offer good value depends on the full cost of the hardware, required modules, protection bundle and subsequent renewals.

Two ten-percent increases were reported for affected XGS items in 2026: the first from 1 July and the second for the relevant term offerings from 1 November. Together, 1.10 × 1.10 = 1.21, or 21 percent. An affected list-price item previously costing 1,000 becomes 1,210 on the same basis. Discounts, currencies and contract terms can change the actual invoice; this does not apply indiscriminately to every Sophos product or billing model.

Recurring costs concern me especially: an already purchased firewall does not become a different device when its subscription is renewed.

Smaller businesses have limited budgets. When renewals keep becoming more expensive, considering alternatives is reasonable. A faster appliance alone will hardly resolve that concern if subscription costs continue to climb too.

Xstream Protection and Xstream Plus compared

Alongside the hardware comes Xstream Protection Plus. It extends the existing Xstream package with Workspace Protection, longer reporting retention and Enhanced Plus Support. Sophos lists the bundle in its public licensing guidelines, effective from 16 October 2026.

The table below reproduces the scope in the supplied licensing overview. The Base License provides the technical foundation and is included with hardware; it does not replace a full protection bundle.

Reporting retention depends on storage capacity and data volume. “Up to one year” does not guarantee a full year for every traffic volume. The Workspace user allowance for each new model needs confirmation in the quotation.

Workspace Protection comprises Protected Browser, ZTNA, DNS Protection for endpoints and Email Monitoring System. That monitoring system is distinct from on-box Email Protection. Support for MDR threat feeds likewise does not include a managed MDR service.

How many Workspace licences are included?

The public guidelines specify these allowances for existing XGS models. The final column counts CFR storage licences, not gigabytes.

The new 2380, 3380, 4580 and 5580 are not listed yet. Their allowances cannot be inferred from these tiers.

Workspace uses the highest count of authenticated browser users, authenticated ZTNA users and DNS agent installations. Sophos specifies 15,000 DNS agent queries per user per day and average ZTNA cloud-gateway data transfer of 15 GB per user per month. A larger firewall therefore does not mean unlimited Workspace usage.

To me, Plus looks primarily like a way to sell Workspace

My impression is that Sophos wants to sell Workspace Protection through the firewall subscription. In my experience, standalone demand for that package is limited. That is an observation from my own working environment, rather than a claim about Sophos’s global sales figures.

A protected browser can be useful for specific applications, contractors or controlled access. Personally, I find it an unexciting reason to upgrade a firewall licence. Businesses with working browser and device management need a tangible benefit to justify changing their setup.

For DNS protection, I would evaluate DNSFilter as a standalone alternative. Network-wide filtering and policies for devices used away from the office are explicit deployment scenarios. For a business focused on that particular problem, I often consider a specialist approach the better fit. That is not a claim of universally better detection rates.

For Zero Trust access, I would favour Tailscale, Twingate or Cloudflare Access, depending on the job. Tailscale interests me especially for connecting business locations, servers and mobile teams with identity-based access rules. Twingate focuses access on private resources. Cloudflare Access provides application-specific policies within Cloudflare One. Their architectures differ; a mesh network and an application proxy are not interchangeable components.

In my view, UniFi was also underestimated for a long time as an option for businesses. I therefore assess these solutions by their capabilities, operation and the actual requirements. Ease of use or popularity among home users tells me little about how well a product fits a business.

My preference concerns architectural fit and operation. Here it rests on the documented approaches and editorial assessment, rather than a new common comparative test of these products.

The bundle problem is straightforward for me: if a business already has satisfactory DNS protection and remote access, additional Workspace licences initially create overlap. Firewall size also determines the included user allowance, even though throughput requirements and employee numbers are different sizing factors.

Longer reporting retention and Enhanced Plus Support can still provide real value. I simply want to know the premium and whether I actually need the included user licences.

What I will look for on Wednesday

The performance figures make these XGS models interesting. Higher protection throughput in a single rack unit could be attractive for new deployments.

Before reaching a firm verdict, I need actual hardware prices, new-purchase and renewal subscription prices, exact port configurations and Workspace allowances for the new models. Delivery availability after ordering opens matters too.

My expectations of Sophos are modest: current connectivity without expensive mandatory modules, understandable subscription costs and a protection bundle that fits the business. After this year’s increases, the new generation still needs to demonstrate its economic value. Higher throughput alone will not settle that for me.

Until next time,
Joe