Coming off Astaro or Sophos UTM? SecureGuard keeps your policy in one validated configuration, with a preview before each change and one-step undo. It runs on FreeBSD and pf, and it is not a cloud NGFW and not MDR.
Sophos UTM software v9 reached EOL on 30-JUN-2026. Teams still on UTM/SG after Sophos’s published EOL window need a path that is not “buy hardware you do not want.” SecureGuard is an appliance OS for amd64 hardware you bring, and it keeps your policy in one validated configuration, with a preview before each change and one-step undo. Community is $0.
Two paths: (1) Leave UTM software → install SecureGuard on BYO hardware (full wipe/reinstall if reusing amd64 SG iron; fit-check vs /docs/install, not Sophos-certified). (2) Coming from Sophos XGS / SFOS → free Windows backup converter at /sophos-migrator — not a UTM config importer.
| Topic | Sophos UTM / SG | SecureGuard (Hub / live site) |
|---|---|---|
| Product status | UTM software v9 reached EOL on 30-JUN-2026; support no later than license expiry or 31-DEC-2026 (whichever first). | Actively sold self-hosted NGFW/UTM; Community perpetual $0. |
| Support after EOL | No support for any customer beyond 31-DEC-2026 irrespective of license expiry (Sophos partner/Community notices). | Support/commercial path via Rubix Hub / site. |
| Deployment | Sophos migration materials point customers toward Sophos Firewall / XGS. | Your own hardware or hypervisor. Your license is checked on the firewall itself, so your network keeps running even if it can't reach us. |
| Config model | (See Sophos UTM docs.) | Your policy in one validated configuration, with a preview before each change and one-step undo. |
| HA | (See Sophos UTM docs.) | Active/passive HA shipping Business+ (/pricing). |
| IPS / web filter | (See Sophos UTM docs.) | Suricata IPS + Web Filter / Safe Search / DoH on Community. |
| Migration tooling | Sophos publishes UTM→Sophos Firewall migration guidance. | Free XGS backup converter (/sophos-migrator) — not a UTM config importer. SG hardware reuse = wipe/reinstall fit-check only. |
| Pricing | Public price not verified. | Community $0 · Home $149/yr · Business $589/yr · Enterprise $1,495/yr. |
Community $0 · Home $149/yr · Business $589/yr · Enterprise $1,495/yr.
A self-hosted FreeBSD NGFW/UTM: named objects, zones, one canonical config document. Validate, preview the rendered daemon diff, commit atomically, roll back by id. Built for teams leaving Astaro or Sophos UTM who want an appliance they own, not a cloud NGFW. Not MDR.
Sophos UTM software v9 reached EOL on 30-JUN-2026. UTM/SG customers with a valid license are supported until license expiry or 31-DEC-2026, whichever comes first. Irrespective of license expiry, Sophos states no support for any customer beyond 31-DEC-2026. Sources: Sophos KBA-000003353 retirement calendar; Sophos partner news on UTM EOL; Sophos Community EOL announcement (confirmed 2026-09-29).
Only if you turn it on. By default, AI suggests changes and a person approves each one. On Business and Enterprise you can turn on automatic blocks, which act only when two signals agree, are rate-limited, and expire on their own.
HA is tested and shipping on Business+: dedicated HA link, active/passive, L2 MAC/IP takeover (Astaro-like model). Not on Community or Home.
No. /sophos-migrator is for Sophos XGS / SFOS backup conversion only. Leaving Sophos UTM software, or reusing amd64 SG hardware after a full wipe/reinstall, is a different path. Do not equate UTM software migration with the XGS backup converter.
No. It is a next-generation firewall / UTM: pf, objects, zones, preview, commit and rollback. HA clustering is tested and shipping on Business+. Endpoint agents and SOC-as-a-service are a different product.
Platform · Sophos XGS migrator · Install · HA · Site-to-site VPN · Pricing · Get started