PAGES
← all tools
◆ Firewalls & Network Defense

Sophos Central Firewall

2026.44Released on October 29, 2026 commercial

Sophos Central Firewall is a cloud-managed network security solution that provides firewall protection, intrusion prevention, and threat monitoring for organizations, administered through the Sophos Central platform.

Summary

Sophos Central Firewall is a commercial network firewall platform managed through a cloud console, aimed at the network and security administrators who run and patch firewall fleets rather than a single appliance. It runs as a hosted management service that pushes configuration and firmware to firewalls rather than something installed locally, which fits teams already centralizing operations instead of logging into boxes individually. Its core administrative job is keeping firmware current across many devices without breaking production: it lets you set recurring weekly or monthly upgrade schedules and designate staging firewalls that validate a new firmware version before it reaches the rest of the fleet. That staged-rollout model is the kind of safeguard fleet operators look for when deciding whether to trust automated patching at all. With 42 releases tracked in our window and the most recent just 10 days old, it is under active, frequent development.

Sophos Central Firewall is a cloud-managed network security solution that provides firewall protection, intrusion prevention, and threat monitoring for organizations, administered through the Sophos Central platform.

Sophos Central Firewall publishes no documentation we track, so the description above is written from general knowledge rather than the vendor's own words.

How Sophos Central Firewall helps

Which firewalls in the fleet are still running outdated firmware?

the cloud console tracks firmware version against the recurring weekly or monthly schedule assigned to each device and shows which ones are pending their next update

Will an untested firmware version break production before anyone notices?

designated staging firewalls receive the new version first and must validate it before the same firmware is pushed to the rest of the fleet

How much reporting history can be kept before old data starts getting dropped?

the storage entitlement for term-licenced firewall models sets the retention ceiling, and raising that entitlement lets more historical reporting data accumulate before the limit is hit

Are firmware upgrades landing on a predictable cadence across many devices?

recurring schedules set at weekly or monthly intervals apply per fleet, so the console shows the cadence each firewall is enrolled in rather than requiring a manual push each time

all 28 features, with the evidence for each →

Languages

Not documented

Features

28 capabilities

Built from Sophos Central Firewall's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What Sophos Central Firewall offers you

  • Scheduled jobs4
  • Web management console2
  • Built-in AI assistant1
  • Command-line interface1
  • CSV data export1
  • Disaster recovery1
  • Natural-language query1
  • REST API1
  • Role-based access control1
  • Single sign-on1
All capabilities 28 capabilities
Recurring firmware upgrade scheduling shipped Allows administrators to schedule weekly or monthly firmware upgrades for firewalls in Sophos Central Firewall Management, with support for staging firewalls to validate upgrades before rolling them out to the broader fleet. 9 releases · 3 other sources · first seen Sep 2022

Also counts toward: Scheduled jobs

release 9 total

  • Increases the maximum Central Firewall Reporting storage entitlement for firewall models on term licences, retaining more reporting data before the storage limit is reached.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ changelog · Sep 2026 · source · release history
  • Increases the maximum Central Firewall Reporting storage entitlement for firewall models using term licences, allowing more reporting data to be retained before the storage limit is reached. 2026.38Released on September 8, 2026 · Sep 2026 · source · release history
  • Supports staging firewalls to validate firmware upgrades before rolling them out to the broader firewall fleet. changelog · Aug 2026 · source · release history
  • Adds the ability to create recurring firmware upgrade schedules (weekly or monthly) in Sophos Central Firewall Management. 2026.35Released on August 11, 2026 · Aug 2026 · source · release history
  • Enables the use of staging firewalls to test firmware upgrades before rolling them out to other firewalls. 2026.35Released on August 11, 2026 · Aug 2026 · source · release history
  • Enables creating weekly or monthly recurring firmware upgrade schedules via the Sophos Central UI. 2026.35Released on August 11, 2026 · Aug 2026 · source · release history

docs

  • Firewall Reporting We've increased the maximum Central Firewall Reporting storage entitlement available to firewall models that use term licences, allowing more reporting data to be retained before the storage limit is reached. changelog · Sep 2026 · source
  • You can now create recurring firmware upgrade schedules in Sophos Central Firewall Management. With this feature, you can schedule weekly or monthly firmware upgrades. You can also use staging firewalls to test upgrades before they're rolled out to other firewalls. changelog · Aug 2026 · source

example

  • Schedule a monthly firmware upgrade for production firewalls after testing on a staging device. In Sophos Central Firewall Management, go to Device management > Firmware upgrades and create a new recurring schedule selecting 'Monthly' and specifying the staging firewall group for initial… 2026.35Released on August 11, 2026 · Aug 2026 · source
Zero-touch firmware upgrade scheduling shipped Allows administrators to schedule weekly or monthly firmware upgrades for firewalls in Sophos Central Firewall Management, with support for staging firewalls to validate upgrades before rolling them out to the broader fleet. 7 releases · 2 other sources · first seen Jul 2022

Also counts toward: Scheduled jobs

release 7 total

  • Adds search functionality to the Firewall Reporting - Licensing page. 2025.26Released on July 3, 2025 · Jul 2025 · source · release history
  • Adds search functionality to the Firewall Reporting - Licensing page in Sophos Central 2025.26Released on July 3, 2025 · Jul 2025 · source · release history
  • Unlicensed firewalls are grayed out in the Sophos Central interface 2025.11Released on March 28, 2025 · Mar 2025 · source · release history
  • Adds an Alerts Configurator feature to configure the frequency of firewall alerts for a specific time period and their severity rating. 2023.37Released on September 21, 2023 · Sep 2023 · source · release history
  • Adds an 8-hour cooldown period for firewall disconnection alerts to prevent duplicate notifications 2023.22Released on June 8, 2023 · Jun 2023 · source · release history
  • Displays additional high availability firewall details (node number, last status change) in Sophos Central and Central Partner for SFOS 19.5 MR3+ and SFOS 20.0+. 2023.19Released on May 23, 2023 · May 2023 · source · release history

example

  • Verify that staging firewalls are correctly designated for pre-production upgrade testing. In Sophos Central Firewall Management, navigate to the firmware schedule details and confirm the 'Staging Group' selection contains your test firewall devices. 2026.35Released on August 11, 2026 · Aug 2026 · source
  • Monitor HA cluster health by viewing node-specific status details in the partner portal. Navigate to Sophos Central Partner > Firewall Management; verify the 'node number' and 'last status change' fields for HA firewalls running SFOS 19.5 MR3 or later. 2023.19Released on May 23, 2023 · May 2023 · source
Asynchronous SD-WAN connection group management shipped Processes SD-WAN connection group create, edit, and delete operations in the background, with progress visible on the SD-WAN Connection and Task Queue pages, and a Force Delete option for groups that cannot be removed through the normal flow. 2 releases · 2 other sources · first seen Oct 2026

release

  • Manage SD-WAN connection groups asynchronously so that create, edit, and delete operations are processed in the background, with progress visible on the SD-WAN Connection and Task Queue pages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ 2026.44Released on October 29, 2026 · Oct 2026 · source · release history
  • Use Force Delete to remove SD-WAN connection groups that cannot be deleted through the normal flow. 2026.44Released on October 29, 2026 · Oct 2026 · source · release history

example

  • Monitor the status of a large SD-WAN group deletion in progress rather than waiting for a synchronous response. In the Sophos Central Firewall console, go to SD-WAN Connection page > select the connection group > choose Delete, then track progress on the Task Queue page. 2026.44Released on October 29, 2026 · Oct 2026 · source
  • Remove a stuck SD-WAN connection group that cannot be deleted through the normal delete flow. In the Sophos Central Firewall console, go to SD-WAN Connection page > select the stuck group > choose Force Delete. 2026.44Released on October 29, 2026 · Oct 2026 · source
Enhanced scheduled export capacity shipped Increases the limit for scheduled firewall reporting exports to support up to 400,000 records in CSV format. 4 releases · first seen Jun 2025

Also counts toward: CSV data export

release

  • Increases the maximum Central Firewall Reporting storage entitlement for firewall models using term licences. 2026.38Released on September 8, 2026 · Sep 2026 · source · release history
  • Increases the maximum Central Firewall Reporting storage entitlement for firewall models using term licenses 2026.38Released on September 8, 2026 · Sep 2026 · source · release history
  • Scheduled firewall reporting exports now support up to 400,000 records in CSV format. 2025.23Released on June 5, 2025 · Jun 2025 · source · release history
  • Scheduled exports now support up to 400,000 records in CSV reports. 2025.23Released on June 5, 2025 · Jun 2025 · source · release history
Central Firewall Management API access shipped Provides API endpoints for managing firewall configurations, policies, and Secure AI web rules. 3 releases · first seen Jul 2026

Also counts toward: REST API

release

  • Adds configuration export and import APIs to Sophos Central Firewall Management for exporting configurations and importing packages to firewalls. 2026.29Released on July 14, 2026 · Jul 2026 · source · release history
  • Adds Sophos Central Firewall Management APIs for Secure AI to manage web policies, URL groups, and web policy rules. 2026.29Released on July 14, 2026 · Jul 2026 · source · release history
  • Adds Sophos Central Firewall Management APIs for Secure AI to manage web policies, URL groups, and web policy rules 2026.29Released on July 14, 2026 · Jul 2026 · source · release history
Firewall Assistant shipped Provides an AI-powered interface in Sophos Fusion that uses natural language to manage firewall policies, diagnose rules, and troubleshoot connectivity on SFOS 23.0 or later devices. 1 release · 1 other source · first seen Oct 2026

Also counts toward: Built-in AI assistant, Natural-language query

release

  • Adds Firewall Assistant tab in Chat with an assistant — an AI-powered assistant in Sophos Fusion for natural-language firewall management and troubleshooting on firewalls running SFOS 23.0 or later.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ 2026.41Released on October 13, 2026 · Oct 2026 · source · release history

example

  • When you need to diagnose a firewall rule or troubleshoot connectivity without navigating deep menus, open the AI Assistant in Sophos Fusion. In Sophos Fusion, go to Chat with an assistant > Firewall Assistant tab, then type a natural-language query such as 'Why is traffic from 10.0.1.0/24 being dropped?' 2026.41Released on October 13, 2026 · Oct 2026 · source
Role-based access control for firewall management shipped Allows administrators to define granular permissions for firewall access based on user roles within Sophos Central. 2 releases · first seen Jul 2026

Also counts toward: Role-based access control

release

  • Introduces role-based access control (RBAC) for firewall access, granting permissions based on the user's Sophos Central role. 2026.29Released on July 14, 2026 · Jul 2026 · source · release history
  • Introduces role-based access control (RBAC) for firewall access from Sophos Central 2026.29Released on July 14, 2026 · Jul 2026 · source · release history
Global regional data plane deployment shipped Enables the deployment and management of firewalls using new regional data planes to reduce latency for users in specific geographic regions. 1 release · 1 other source · first seen Dec 2025

release

  • Enables data plane services for firewall management in ap-south-1 (Mumbai) and ap-southeast-2 (Sydney) FSC regions. 2025.47Released on December 3, 2025 · Dec 2025 · source · release history

example

  • Deploy or manage firewalls using the new regional data planes to reduce latency for users in India and Australia. N/A - Feature enabled automatically by provider 2025.47Released on December 3, 2025 · Dec 2025 · source
Firewall backup scheduling shipped Enables automatic backups for firewalls in your management console to ensure recovery readiness. 1 release · 1 other source · first seen May 2023

Also counts toward: Disaster recovery, Scheduled jobs

release

  • Adds automatic firewall backup scoring to the Account Health Check dashboard in Sophos Central 2025.26Released on July 3, 2025 · Jul 2025 · source · release history

example

  • Enable automatic backups for firewalls in your management console to ensure recovery readiness. In Sophos Central Firewall Management, select the target firewall and configure 'Backup Schedule' to enable automatic addition to the schedule. 2023.19Released on May 23, 2023 · May 2023 · source
Term to MSP license conversion shipped Enables the conversion of term licenses on firewalls to MSP monthly licenses within the management console. 2 releases · first seen Apr 2025

Also counts toward: Web management console

release

  • You can now convert term licenses on your firewalls to MSP monthly licenses. 2025.14Released on April 15, 2025 · Apr 2025 · source · release history
  • Allows conversion of term licenses on Sophos Central Firewalls to MSP monthly licenses 2025.14Released on April 15, 2025 · Apr 2025 · source · release history
Overlapping subscription support shipped Allows administrators to add a new license subscription to a firewall device that already has an overlapping feature set, without replacing the existing one. 1 release · 1 other source · first seen Jan 2025

release

  • Allow overlapping subscriptions : You can now add a new subscription when you have an existing subscription that includes any of the same features. 2025.02Released on January 21, 2025 · Jan 2025 · source · release history

example

  • Add a new license subscription to a firewall device that already has an overlapping feature set, without replacing the existing one. In Sophos Central Firewall Management, proceed with adding a new subscription even when it overlaps with an existing active subscription. 2025.02Released on January 21, 2025 · Jan 2025 · source
Threat log forwarding control shipped Controls whether firewall logs are sent to the MDR team via the Threat Analysis Center marketplace. 1 release · 1 other source · first seen Nov 2024

release

  • Adds a UI path in Threat Analysis Center - Marketplace to control whether firewall logs (ATP, Sandbox, IDP, Anti-Virus, Anti-Spam) are sent to the MDR team. 2024.48Released on November 20, 2024 · Nov 2024 · source · release history

example

  • Prevent firewall logs from being forwarded to the managed detection and response team. In Threat Analysis Center - Marketplace, click Sophos Firewall, turn off Enable/Disable Integration, and click Save. 2024.48Released on November 20, 2024 · Nov 2024 · source
Local service ACL exception shipped Allows creating an exception rule to grant access to admin services from a specified network or host during DDoS mitigation. 1 release · 1 other source · first seen May 2024

release

  • Adds a local service ACL exception rule to allow access to admin services from a specified network or host 2024.15Released on May 15, 2024 · May 2024 · source · release history

example

  • Configuring an exception to allow a specific admin network to access local services during DDoS mitigation. Create a local service ACL exception rule in Firewall Management settings. 2024.15Released on May 15, 2024 · May 2024 · source
True Zero Touch onboarding shipped Introduces a True Zero Touch process for XGS devices with TPM chips, enabling automated, passwordless onboarding. 1 release · 1 other source · first seen May 2024

release

  • Introduces the True Zero Touch process for XGS devices equipped with Trusted Platform Module (TPM) chips 2024.15Released on May 15, 2024 · May 2024 · source · release history

example

  • Deploying an XGS device with TPM for automated, passwordless onboarding via the new True Zero Touch process. Refer to 'Add a firewall with Zero Touch and Zero Touch FAQ' in documentation for steps. 2024.15Released on May 15, 2024 · May 2024 · source
Firewall alert configuration shipped Allows configuring the frequency and severity thresholds for firewall alerts to reduce noise. 1 release · 1 other source · first seen Jan 2024

release

  • Adds Alerts Configurator to set frequency of firewall alerts for a specific time period and configure their severity rating 2023.52Released on January 16, 2024 · Jan 2024 · source · release history

example

  • Reduce alert noise by configuring the frequency and severity thresholds for firewall alerts. Navigate to Alerts Configurator in Sophos Central and adjust the frequency/severity settings for a specific time period. 2023.52Released on January 16, 2024 · Jan 2024 · source
Immediate configuration push shipped Pushes configuration changes from Sophos Fusion to firewalls running SFOS 23.0 or later in real time, replacing the previous minute-by-minute polling model. 1 release · first seen Oct 2026

release

  • Sophos Fusion now pushes configuration changes immediately to firewalls running SFOS 23.0 or later, replacing the previous pull-every-minute polling model. 2026.41Released on October 13, 2026 · Oct 2026 · source · release history
Large export handling via command interface shipped Allows exporting large historical audit logs or threat summaries that previously exceeded the standard record limit by using a dedicated command interface. 1 other source · first seen Jun 2025

Also counts toward: Command-line interface

example

  • Export large historical audit logs or threat summaries that previously exceeded the record limit and failed or truncated. In Sophos Central, navigate to Reporting > Scheduled Reports and verify the new capacity for CSV exports. 2025.23Released on June 5, 2025 · Jun 2025 · source
License start date adjustment shipped Allows setting the start date of firewall base licenses to an earlier date in the licensing manager. 1 release · first seen Aug 2024

release

  • Allows setting the start date of firewall base licenses to an earlier date in the licensing manager 2024.33Released on August 13, 2024 · Aug 2024 · source · release history
Microsoft Entra ID single sign-on shipped Enables configuration of Microsoft Entra ID single sign-on for firewalls running version 19.5 or later. 1 release · first seen Jun 2024

Also counts toward: Single sign-on

release

  • Enables Microsoft Entra ID single sign-on configuration via Sophos Central for firewalls running version 19.5 or later. 2024.24Released on June 18, 2024 · Jun 2024 · source · release history
Firewall evaluation license reactivation shipped Enables reactivation of firewall evaluation licenses that expired at least 90 days ago. 1 release · first seen Feb 2024

release

  • Enables reactivation of firewall evaluation licenses in Sophos Central and Partner that expired at least 90 days ago 2024.06Released on February 29, 2024 · Feb 2024 · source · release history
Firewall group immediate configuration shipped Allows skipping full synchronization when adding a firewall to a group for immediate configuration application. 1 release · first seen Feb 2024

release

  • Adds the ability to skip full synchronization when adding a firewall to a firewall group in Sophos Central, allowing immediate configuration application with optional later sync 2024.06Released on February 29, 2024 · Feb 2024 · source · release history
Firewall activity metrics review shipped suggested Enables reviewing key activity metrics for the firewall environment via the UI. 1 other source · first seen Feb 2024

Suggested capability: Network traffic analysis. This is our guess, not confirmed.

example

  • Review key activity metrics for your firewall environment via the UI In Sophos Central, go to Firewall Management > Report Generator and generate an SPA report. 2024.03Released on February 6, 2024 · Feb 2024 · source
Security posture assessment reporting shipped Provides Security Posture Assessment (SPA) reports for firewalls in the report generator. 1 release · first seen Feb 2024

release

  • Security Posture Assessment (SPA) reports are now available in Sophos Central, under Firewall Management > Report Generator 2024.03Released on February 6, 2024 · Feb 2024 · source · release history
Grouped firewall recovery shipped Allows recovering suspended grouped firewalls directly from the partner console without using the CLI. 1 other source · first seen Jun 2023

Also counts toward: Web management console

example

  • Recover suspended grouped firewalls directly from the partner console without CLI. In the Central Partner dashboard, locate the suspended firewall group and click Force Sync 2023.22Released on June 8, 2023 · Jun 2023 · source
Partner template migration to Fast Station Creation shipped Allows Sophos partners to migrate existing Central Partner firewall templates to new Fast Station Creation (FSC) stations. 1 release · first seen Jan 2023

release

  • Allows Sophos partners to migrate existing Central Partner firewall templates to new Fast Station Creation (FSC) stations 2023.01Released on January 17, 2023 · Jan 2023 · source · release history
SD-WAN profile creation shipped Allows creating SD-WAN profiles on firewalls within SD-WAN connection groups to route traffic based on gateway availability or performance. 1 release · first seen Jan 2023

release

  • Enables creating SD-WAN profiles on firewalls within SD-WAN connection groups to route traffic based on gateway availability or performance 2023.01Released on January 17, 2023 · Jan 2023 · source · release history
XFRM tunnel IP migration shipped Adds the ability to move XFRM tunnel IPs to a /30 subnet when the IP address is not in that range. 1 release · first seen Jan 2023

release

  • Adds Migrate option to move XFRM tunnel IPs to /30 subnet when the IP address is not in that range 2023.01Released on January 17, 2023 · Jan 2023 · source · release history
Multi-customer firmware upgrade scheduling shipped Allows administrators to schedule weekly or monthly firmware upgrades for firewalls in Sophos Central Firewall Management, with support for staging firewalls to validate upgrades before rolling them out to the broader fleet. 1 release · first seen Sep 2022

Also counts toward: Scheduled jobs

release

  • Enables scheduling firmware upgrades for multiple customers simultaneously from the Central Partner dashboard. 2022.39Released on September 29, 2022 · Sep 2022 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface

Five scores for Sophos Central Firewall, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail Sophos Central Firewall puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Website history

sophos.com, every change

Sophos's home page and 1 more page as they looked each month from September 2021 to October 2026: 12 renders, 3 changes of tagline or palette. Step through them, play them, or put any two months side by side.

Website history is included with Researcher and Business.

See plans →

Releases

29 entries

  1. October 20262
  2. September 20262
  3. August 20262
  4. July 20261
  5. December 20251
  6. October 20251
  7. July 20251
  8. June 20251
  9. April 20251
  10. March 20252
  11. January 20251
  12. November 20241
  13. August 20241
  14. June 20241
  15. May 20241
  16. February 20242
  17. January 20241
  18. September 20231
  19. August 20231
  20. June 20231
  21. May 20231
  22. January 20231
  23. September 20221
  24. July 20221

    29 entries

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →