CyberIndexBeta

Product

Sophos' core antivirus engine supplied to other vendors as a set of libraries, for integration into their own products. Sophos OEM partners enjoy committed support from dedicated technical account managers and expert OEM integrations teams. Supported platforms are Linux and Windows. It is recorded as supporting api integration and threat intelligence. The stated market is Enterprise.

Current Version
Not known
Market
Enterprise
Licence
Paid
Price
Quote
Record Created
2026-10-05
Last Updated
2026-10-23

Vendor

Sophos was founded in 1985 by Jan Hruska and Peter Lammer, two Oxford doctoral students, and is still headquartered in Abingdon, outside Oxford. It listed in London in 2015 and was taken private in 2020 by Thoma Bravo, and in 2025 it acquired Secureworks, adding that company's managed detection business to its own. It sells to organisations, largely through resellers, and its two halves are endpoint and network. Sophos Intercept X is the endpoint product, Sophos Firewall the appliance line, and Sophos Central the single console that manages both — the integration between them is much of what it sells. Sophos MDR is the managed detection and response service, now the company's fastest-growing line with more than 40,000 customers, and Sophos XDR, Sophos Email and Sophos Backup and Recovery for M365 sit alongside. Sophos Home is the consumer product, and the free version is the one most individuals will have met. SophosLabs publishes its own threat research, and the company's products appear regularly in the public test cycles this index draws on. Vendor page →

Website
sophos.com
Country
United Kingdom
Headquarters
Abingdon, United Kingdom
Year Established
1985
Customers
625K organisations
Users
100M users
Revenue
$1.0B (2023)

Platforms

Linuxnative
Windowsnative

Target Market

Enterprise primary

Capabilities

Multi-Engine ScanningkeyNot known
Archive ExtractionkeyNot known
True File Type VerificationkeyNot known
Password-Protected Archive HandlingNot known
Hash Reputation LookupNot known
Content Disarm & ReconstructionkeyNot known
Sandbox AnalysisNot known
Threat Intelligencenative
File-Based Vulnerability AssessmentNot known
File Structure ValidationNot known
DLP IntegrationNot known
API Integrationkeynative
ICAP / Gateway IntegrationkeyNot known
Object Storage ScanningkeyNot known
Managed Upload PortalNot known
Central Management ConsoleNot known

14 of 16 not yet known — not recorded, which is not the same as not supported.

Specifications

Scanning Engines1 engineestimated by LLM: not disclosed by the vendor

2 other specifications for this category not yet known.

Pricing

PlanLicencePriced perBilledPrice
SummaryPrice on requestnot statedno recurring chargeQuote

Versions

Not known

The newest release each source names per platform, not every release the vendor has shipped. A release date is shown only where one is recorded.

Independent Tests

Not tested This product does not appear in any test run CSI holds. That is not a low score.

Certifications

Not known

Change History

This record was created 2026-10-05. Everything below is what has changed since.

  • 2026-10-09Capability addedThreat Intelligence: built inevidence
  • 2026-10-08Capability addedAPI Integration: built inevidence
  • 2026-10-06Pricing plan addedPrice: price on requestevidence
  • 2026-10-06Platform addedRuns on Linuxevidence
  • 2026-10-06Platform addedRuns on Windowsevidence
  • 2026-10-06Product updatedSold to: Enterpriseevidence
  • 2026-10-05Product createdNew product, listed in Malware File Scannerevidence

May we count your visit? CyberIndex would like to use Google Analytics to see which pages are read. It sets cookies and sends your visit to Google. Decline and nothing is loaded — the site works the same either way. Privacy.