In short
Sophos SASE, for most buyers, means Sophos Workspace Protection: Sophos Protected Browser, the Protected Browser Extension, Sophos ZTNA, DNS Protection for endpoints and the Email Monitoring System, managed in Sophos Fusion and licensed per user. Forever Systems, a Sophos MSP Partner, can quote and set it up for UK organisations, alongside Sophos Firewall at sites.
Get a quote for Sophos SASE
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What is Sophos SASE?
Sophos's answer to SASE is Sophos Workspace Protection (opens in a new tab), which Sophos describes as an integrated security solution for hybrid and remote work. It bundles:
| Component | What it does |
|---|---|
| Sophos Protected Browser | Secures the browser, which Sophos calls the most important app in your organisation, with insight into shadow AI (opens in a new tab) and IT |
| Sophos Protected Browser Extension | Adds shadow IT insight to help decide next steps |
| Sophos ZTNA | Secure access to only the applications users need, in place of a remote access VPN |
| DNS Protection for endpoints | An extra layer of protection against malicious and unwanted web content |
| Sophos Email Monitoring System | Works with your existing email service to add security, visibility and reporting on advanced email threats |
Sophos says the solution is "managed centrally through Sophos Fusion". Source: Sophos, checked 9 November 2026.
Not sure which bundle fits? Ask us
Tell us what you need and we will recommend the right bundle for your organisation, with a quote.
How Sophos differs from gateway-based SASE
Sophos contrasts Workspace Protection with traditional SASE or Security Service Edge (SSE) solutions that rely on routing traffic through cloud gateways. Instead it secures the workspace at the endpoint and in the browser, so traffic does not have to be backhauled and TLS inspection does not have to happen in someone else's cloud.
| Gateway-based SASE | Sophos Workspace Protection | |
|---|---|---|
| Where policy is enforced | Vendor's cloud points of presence | On the device and in the browser |
| Traffic path | Sent to the nearest point of presence | Direct, with controls applied locally |
| Branch SD-WAN | Often included | Not part of the bundle; Sophos Firewall at sites |
| Unmanaged devices | Agentless portals or browser isolation | Protected Browser for work apps |
Neither model is better in general. The Sophos approach suits organisations whose people work mainly from managed laptops and SaaS; gateway SASE suits estates that need full branch traffic inspection in the cloud. Our SASE architecture page explains the models.
Sophos ZTNA and Sophos Firewall
Sophos ZTNA is the private access part of the bundle. Sophos says it "provides secure access to only the applications that users need", and it is covered in depth on our Sophos site under Sophos ZTNA (opens in a new tab), with the zero trust background on ztna.org.uk (opens in a new tab).
Sophos calls Workspace Protection "the perfect complement" to a new or existing Sophos Firewall or Endpoint Protection deployment, and Sophos says Sophos Firewall "integrates a complete SD-WAN solution", so a Sophos estate can cover users with Workspace Protection and sites with firewalls under one vendor. The full bundle is described on Sophos Workspace Protection (opens in a new tab).
Is Sophos SASE the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How Sophos Workspace Protection is licensed
Sophos licenses Workspace Protection as a subscription based on the number of users who need protection. Sophos says the total licence count is set by the highest number of users or devices across the bundled products. Edition and term detail, without prices, is on Sophos Workspace Protection licensing (opens in a new tab).
Subscriptions can be billed monthly, terms confirmed at quote. Ask us for a quote.
What Forever Systems does
As a Sophos MSP Partner, Forever Systems can quote and set up Sophos Workspace Protection. We can:
- Assess how people work: managed and unmanaged devices, SaaS, private applications and the current VPN
- Compare the Sophos device-and-browser approach with gateway-based SASE vendors for your estate
- Pilot Sophos ZTNA and the Protected Browser with one team, then extend
- Support the platform afterwards, with scope confirmed at quote
Contact us to talk it through. Gateway-based platforms are compared on SASE vendors.
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
Does Sophos have a SASE product?
Sophos's answer is Sophos Workspace Protection, which bundles Sophos Protected Browser, the Protected Browser Extension, Sophos ZTNA, DNS Protection for endpoints and the Email Monitoring System.
How is Sophos Workspace Protection different from SASE?
Sophos says it secures work at the endpoint and in the browser, unlike traditional SASE or Security Service Edge (SSE) products that route traffic through cloud gateways.
What console manages Sophos Workspace Protection?
Sophos says the solution is managed centrally through Sophos Fusion.
Is Sophos ZTNA included in Workspace Protection?
Yes. Sophos ZTNA is one of the bundled components, alongside the Protected Browser, DNS Protection for endpoints and the Email Monitoring System.
How is Sophos Workspace Protection licensed?
Per user, as a subscription. Sophos sets the licence count by the highest number of users or devices across the bundled products. Terms are confirmed at quote.
Still have a question about Sophos SASE?
Ask us and a member of our team will get back to you.
More SASE guides
WatchGuard SASEWatchGuard SASE explained: FireCloud Internet Access and Total Access for cloud security and ZTNA.SASE for hybrid workingSASE for hybrid working: the advantages of SASE for hybrid workforce security, with the same policy at home.