Sophos UTM replacement

Object and zone config, commit, rollback by id

A next-generation firewall / UTM you run on hardware you own. Not a managed detection subscription. The AI layer proposes; a human commits.

If you are coming off Astaro or Sophos UTM, the work is the same: objects and zones as one document, a preview of the rendered diff, an atomic commit, and rollback by id. SecureGuard is that appliance OS — FreeBSD, pf, one canonical document. HA clustering is tested and shipping on Business+. It is not a cloud NGFW and it is not MDR.

Object and zone config as one document, not a pile of per-daemon files.
Validate, preview the rendered diff, commit atomically, roll back by id.
AI proposes and can throttle on a score. A human commits.

Sophos is raising prices. SecureGuard is not.

Sophos told partners of price changes from November 1, 2026 for term and upfront purchases, and January 1, 2027 for MSP. Price lists publish in October.

Sophos Firewall: 10% on XGS Series hardware and related subscriptions. Also North America promotional SKUs. Not Hardware as a Service. Not virtual, software, or cloud subscriptions. Not accessories.

Sophos Wireless: 10% on AP6 Series access points. AP6 support goes from 5% to 10% of hardware cost for a 1-year term.

Sophos Email: 7.5%. Not Email Plus, Phish Threat, EMS, or add-ons.

Stop paying those hikes. Run SecureGuard on hardware you already own. Community is $0. Home is $149/year. Business is $589/year. Enterprise is $1,495/year.

A free Windows app opens a Sophos XGS backup and exports SecureGuard JSON. No license, no signup. Migrate from Sophos XGS.

For email, Secure Message. Community is free for one domain.

What does a Sophos UTM replacement mean here?

A self-hosted FreeBSD NGFW/UTM: named objects, zones, one canonical config document. Validate, preview the rendered daemon diff, commit atomically, roll back by id. Built for teams leaving Astaro or Sophos UTM who want an appliance they own, not a cloud NGFW.

Does the AI change the firewall on its own?

No. The AI layer proposes changes and can throttle on a reputation score. A human commits. We do not advertise auto-block.

Is this MDR or endpoint detection?

No. It is a next-generation firewall / UTM: pf, objects, zones, preview, commit and rollback. HA clustering is tested and shipping on Business+. Endpoint agents and SOC-as-a-service are a different product.

Sophos publishes named application control and endpoint sync; SecureGuard does not ship those — application control, anti-spam, identity in policy, and off-box analysis are coming soon. Endpoint-alert ingestion is coming soon on Orchestrator.

Running Sophos Firewall (XGS / SFOS) rather than UTM? Migrate from Sophos XGS.

Read what is actually built, the FAQ, the FortiGate alternative, and how the AI layer is allowed to act.