Ask SecureGuard a question. Answers come from this site's docs only. I will cite a page. I will not invent a product claim.
Guide
Sophos UTM replacement: choosing what comes next
Sophos UTM 9 has reached end of life, and plenty of small offices, labs and MSP clients still run it. If that's you, the question isn't whether to move, it's where to and how to make the move calm.
This guide walks through the realistic paths, what to check, and how SecureGuard fits for teams who want to keep running a firewall on hardware they own.
Your realistic options
- Move to Sophos Firewall (XGS / SFOS). The natural upgrade for many. Budget for new hardware and subscriptions.
- Switch to another commercial appliance such as FortiGate, SonicWall or WatchGuard. Good fit if you want a vendor box and support contract.
- Run open-source firewall software on your own hardware, for example OPNsense or pfSense. Flexible and low cost, if you're comfortable managing it.
- Run SecureGuard on your own hardware. A next-generation firewall and UTM you install on hardware or a hypervisor you own.
None of these is right for everyone. The best choice depends on who manages the firewall day to day and how much change your network can absorb.
What to check before you choose
- Hardware: Can you reuse what you have, or does the vendor require its own appliance?
- Licensing failure modes: What happens if the firewall can't reach the vendor? With SecureGuard, the license is checked on the firewall itself, so your network keeps running.
- Change safety: Can you preview a change and roll it back? SecureGuard keeps every configuration as a revision you can re-apply by id, so a bad change isn't a late night. See rollback.
- Migration effort: Be realistic. There's no UTM 9 config importer. Plan to rebuild from your export. If you're on Sophos Firewall (XGS / SFOS), a free Windows app converts a backup to SecureGuard JSON and lets you simulate it before importing: Sophos migrator.
Why one configuration document helps
Most firewalls let you edit each part separately and hope the result holds together. SecureGuard keeps your whole configuration in one document, and every change is validated and previewed before it's applied. You work with named objects and zones rather than IP addresses, so renaming a server updates every rule that uses it. The technical detail is in the architecture docs and policy docs.
A calm migration plan
- Export and document your current UTM rules, VPNs and NAT.
- Install SecureGuard Community on spare hardware or a VM (install guide).
- Rebuild your rules as objects and zones, then preview.
- Run it side by side, then cut over in a maintenance window.
- Keep your previous revision ready to re-apply if anything looks wrong.
More on this path: Sophos UTM notes and UTM replacement. Comparing directly? See vs OPNsense and vs FortiGate.
What it costs
Prices from the Rubix Hub (checked 2026-10-22):
| Plan | Price per year |
|---|---|
| Community | Free |
| Home | $149 |
| Business | $589 |
| Enterprise | $1,495 |
We don't sell appliances; you run it on hardware you choose. See pricing.
FAQ
Can I import my Sophos UTM 9 configuration?
No. There's no UTM 9 config importer; plan to rebuild from your export. Sophos Firewall (XGS / SFOS) backups can be converted with the free migrator.
Do I need to buy new hardware?
No. SecureGuard runs on hardware or a virtual machine you own. We don't sell appliances.
What if the firewall can't reach Rubix?
The license is checked on the firewall itself, so your network keeps running.
Can I undo a change?
Yes. Every configuration state is a revision you can re-apply by id.
Is there a free version?
Yes. Community is free.
Start free
Get a free Community license → Then follow the install guide.