Sophos UTM Alternative
Sophos ended support for UTM 9 and the SG appliances on 2026-06-30. Every SG still in service is now an unpatched perimeter. Sophos’s own path is a rebuild onto XGS; since you are rebuilding anyway, this page compares that path with FortiGate on the points that decide it for a small or mid-size business, and explains how we migrate a UTM in one after-hours window. Last reviewed 2026-10-06.
What Changed
Sophos published the UTM/SG lifecycle in March 2023: last renewal 2025-12-31, end of life and end of support 2026-06-30. Since that date the UTM 9 operating system receives no security updates, and SG appliances that have not been migrated are running an unsupported firewall. Sophos’s own path is a migration to the XGS series on the Sophos Firewall OS, a different operating system with a different console.
A firewall is the device most exposed to the internet on your network. After 2026-06-30, UTM 9 vulnerabilities are not fixed. Cyber-insurance questionnaires ask whether perimeter devices are supported; this one no longer is.
Moving from UTM 9 to SFOS on an XGS appliance is a rebuild: new OS, new management console, new rule model. Policies do not lift and shift. That is the same effort as moving to another vendor, which is why this is the moment to evaluate rather than renew by habit.
Objects, VLANs, routes and VPN peers transfer to any platform with a conversion step. UTM-specific features (the web application firewall, the email protection module, the Sophos RED tunnels) need a per-feature decision: replace, retire or re-host.
Sizing and quote in week one, hardware lead time two to four weeks, pre-staging remote, cutover in one after-hours window with the UTM kept powered for rollback. Most single-site migrations finish inside six weeks of the order.
The Comparison
Both are capable firewalls. The differences that matter to a 20-to-200-person business are inspection throughput with services on, how remote access is done after SSL-VPN, management, and lifecycle predictability. Figures are from each vendor’s published datasheets and notices.
| Decision point | FortiGate G-series | Sophos XGS | Why it matters |
|---|---|---|---|
| Inspection hardware | SP5 ASIC on every model, 30G to 120G | Xstream flow processor offloads networking; security inspection runs on the CPU | With IPS, AV and SSL inspection all on, ASIC-accelerated units hold throughput; CPU-bound units slow down under load |
| Threat-protection throughput, entry models | 50G: 1.1 Gbps; 70G: 1.3 Gbps; 90G: 2.2 Gbps | Per Sophos XGS datasheets; compare the “threat protection” line, not the firewall line | Size to this number against your circuit |
| Remote access | IPsec and ZTNA (FortiClient or agentless); SSL-VPN removed from current hardware | SSL-VPN and IPsec; ZTNA via Sophos ZTNA gateway | Either way, plan the VPN migration as part of the project |
| Management | FortiOS GUI, FortiManager for fleets, FortiGate Cloud for small sites | Sophos Central cloud console | Both are mature; the question is which one your team or your MSP already runs |
| Lifecycle | G-series has no published end-of-order date; Fortinet publishes EOO/EOS per model | XGS is current; SG/UTM is end of life as of 2026-06-30 | Buy five years of support runway either way |
| Ecosystem | FortiSwitch and FortiAP managed from the firewall; SD-WAN built in | Sophos switches and APs managed in Central | Single-vendor LAN is a convenience, not a requirement; we run FortiGate with Aruba and UniFi daily |
We sell and support FortiGate; we do not sell Sophos. Read the table with that in mind, and verify the XGS figures on Sophos’s datasheet for the model you are quoted.
How We Migrate
This is the fixed-fee firewall migration we publish on the firewall migration page: $6,500 for a FortiGate up to the 90-series class, $8,900 for 100F to 200F or an HA pair, hardware and licenses separate.
Full UTM backup and configuration export. We read every rule, NAT, VPN and object and list what is in use versus what is dead. Most UTMs carry years of dead rules; we do not migrate those.
Circuit speed, user count, switches and APs, PoE needs, and which UTM modules are in use decide the FortiGate model. See the sizing guide. Hardware and the UTP bundle are quoted through our authorized Fortinet distributor.
The FortiGate is configured and tested in parallel: interfaces, VLANs, policies, NAT, IPsec peers, security profiles, and the remote-access replacement. A written test plan per critical application.
An after-hours window, usually under two hours, with the UTM powered and cabled for a five-minute rollback. We stay through the first business morning.
Five business days of priority response, then as-built documentation, config backup under version control, and monitoring if you take an Edge plan.
Track Record
We only do networks. That is not a limitation — it is why the outcomes are different.
Years of network-only practice. Architecture, security, and operations — not IT generalism.
Sites delivered. Healthcare clinics, law offices, financial branches, multi-site operations.
Design target for fully redundant builds with HA firewalls, diverse ISPs, and backed-up power.
Senior engineer–led. No junior handoffs. No ticket queue. No escalation chain.
Career aggregate. The 20+ years and 300+ sites span the operator’s full network-only practice, including prior-employer engagements. 99.99% availability, about 53 minutes of downtime per year, is an architecture design target for engagements that fund full redundancy. It is not a service guarantee or uptime SLA. Contracted response times and service levels are defined in each customer agreement.
Where We Work
Pre-staging and configuration happen remotely; cutover is on site or remote-hands guided, your choice. Local clients: see our Fortinet MSP in Sacramento and Fortinet MSP in San Francisco pages. Replacing a non-Fortinet firewall? See firewall migration. Want it watched afterward? See network monitoring.
FAQ
Yes. Sophos announced the lifecycle in March 2023: the last renewal date was 2025-12-31 and end of life and end of support was 2026-06-30. UTM 9 and SG-series appliances no longer receive security updates or support after that date.
It will keep passing traffic, but it is unpatched and unsupported. For a perimeter firewall that is the wrong place to accept risk, and most cyber-insurance questionnaires now ask whether edge devices are under vendor support.
No. Sophos offers XGS as its migration path and ran promotions for it, but a UTM-to-XGS move is a different operating system and console, so it is a rebuild either way. That makes it a fair moment to compare FortiGate on inspection throughput, remote-access model, management, and five-year cost.
Objects, interfaces, routes, NAT and IPsec definitions carry over through a conversion and review step. We rebuild the policy set by hand against the exported configuration, dropping dead rules, and test each critical application before cutover. UTM-specific modules such as the web application firewall or email protection are replaced or retired by decision, not silently dropped.
Our fixed fee is $6,500 for a FortiGate up to the 90-series class and $8,900 for 100F to 200F or an HA pair, including full policy migration, VPN tunnels, a test plan, an after-hours cutover and five days of hypercare. Hardware and the FortiCare/UTP bundle are additional at Fortinet list; a 70G with a three-year UTP bundle lists at $3,644.78 on Fortinet's current Americas price list.
Current FortiGate G-series hardware does not support SSL-VPN; remote access is IPsec or ZTNA through FortiClient. We migrate the user population as part of the project, usually to ZTNA for staff and IPsec for site-to-site. See our SSL-VPN migration page for the method.
Hardware lead time is the longest part, usually two to four weeks. Discovery and build run in parallel. The cutover itself is one window, typically under two hours, with rollback to the UTM available until you sign off.
Yes. Replacing the firewall does not require replacing Intercept X on the endpoints. We integrate FortiGate with whatever endpoint and identity stack you already run.
Sources
Last reviewed 2026-10-06. Vendor lifecycle dates and promotions change; confirm against the linked pages before you decide.
Fortinet, FortiGate, FortiOS, FortiGuard and FortiCare are trademarks of Fortinet, Inc. Sophos, SonicWall and other vendor names are trademarks of their respective owners, used here to identify the products discussed. Ambio Edge Networks is an independent Fortinet partner and is not affiliated with or endorsed by Fortinet, Sophos or SonicWall.
Replace a Sophos UTM
Tell us the SG model, the modules you use (web, email, RED, SSL-VPN), your internet speed and user count. We size the FortiGate, quote hardware and licensing at Fortinet list, and run the migration as a fixed-fee project with rollback.
Response from a senior engineer within 1 business day.
A direct conversation — no sales team, no runaround.
An honest assessment of whether we are the right fit.
Clear next steps if we are — no pressure if we are not.
